diff --git a/server/src/main/java/com/cloud/configuration/ConfigurationManagerImpl.java b/server/src/main/java/com/cloud/configuration/ConfigurationManagerImpl.java
index 2578d66e344..e0963bab78b 100644
--- a/server/src/main/java/com/cloud/configuration/ConfigurationManagerImpl.java
+++ b/server/src/main/java/com/cloud/configuration/ConfigurationManagerImpl.java
@@ -7227,6 +7227,8 @@ public class ConfigurationManagerImpl extends ManagerBase implements Configurati
                     forVpc = false;
                 } else if (service == Service.NetworkACL) {
                     forVpc = true;
+                } else if (service == Service.Firewall) {
+                    forVpc = true;
                 }
             }
 
diff --git a/ui/src/views/network/PublicIpResource.vue b/ui/src/views/network/PublicIpResource.vue
index 79b0da853d5..f92270e576c 100644
--- a/ui/src/views/network/PublicIpResource.vue
+++ b/ui/src/views/network/PublicIpResource.vue
@@ -147,29 +147,16 @@ export default {
           return
         }
 
-        // VPC IPs with static nat have firewall (only if associatednetworkid present)
+        // VPC IPs with static nat have nothing
         if (this.resource.isstaticnat) {
           if (this.resource.virtualmachinetype === 'DomainRouter') {
-            let tabs = this.defaultTabs.concat(this.$route.meta.tabs.filter(tab => tab.name === 'vpn'))
-            if (this.resource.associatednetworkid) {
-              tabs = this.defaultTabs.concat(this.$route.meta.tabs.filter(tab => ['vpn', 'firewall'].includes(tab.name)))
-            }
-            this.tabs = tabs
-          } else {
-            if (this.resource.associatednetworkid) {
-              this.tabs = this.defaultTabs.concat(this.$route.meta.tabs.filter(tab => tab.name === 'firewall'))
-            } else {
-              this.tabs = this.defaultTabs
-            }
+            this.tabs = this.defaultTabs.concat(this.$route.meta.tabs.filter(tab => ['vpn', 'firewall'].includes(tab.name)))
           }
           return
         }
 
         // VPC IPs have all tabs, but firewall only if associatednetworkid present
         let tabs = this.$route.meta.tabs
-        if (!this.resource.associatednetworkid) {
-          tabs = tabs.filter(tab => tab.name !== 'firewall')
-        }
 
         const network = await this.fetchNetwork()
         if (network && network.networkofferingconservemode) {