add section on NAT and provisioning