1. Get this working on the NS conversion path.

2. Add support for additional firewall rules along the path,
   the CM never had support for firewall rules.

3. Set the security_level to zapdisk when firewalling is on.