* If a packet is internal (between two VMs on the same switch), install a l2_pair rule
* idle timeout = 300 seconds