When a vApp containing internal vApp networks is deployed, the configuration of the internal networks is consistent with the configuration at the time the vApp was added to the catalog. The configuration, including firewall rules, is predefined and does not need to be updated. A user with the appropriate permissions can change this configuration.

The exception to this rule is when you use network address translation (NAT) with the default one-to-one mapping configuration. All virtual machines connected to the given vApp network use this NAT configuration automatically, regardless of any change you made when creating the vApp. For example, if a vApp containing three virtual machines is created and mapped to an organization network with NAT, three NAT-routed IP addresses are allocated. Although it is possible to disable these IP addresses manually as in the LAMP stack example, changes are lost when the vApp is deployed from the catalog. For the changes to remain in effect, use the port forwarding approach where all rules are retained as they would be for firewalls.