diff --git a/awsapi.log.2012-07-25.gz b/awsapi.log.2012-07-25.gz
new file mode 100644
index 00000000000..02fd067aac2
Binary files /dev/null and b/awsapi.log.2012-07-25.gz differ
diff --git a/server/src/com/cloud/network/element/VpcVirtualRouterElement.java b/server/src/com/cloud/network/element/VpcVirtualRouterElement.java
index 0e713521a3d..77ae4d4d357 100644
--- a/server/src/com/cloud/network/element/VpcVirtualRouterElement.java
+++ b/server/src/com/cloud/network/element/VpcVirtualRouterElement.java
@@ -287,11 +287,13 @@ public class VpcVirtualRouterElement extends VirtualRouterElement implements Vpc
         Map<Service, Map<Capability, String>> capabilities = new HashMap<Service, Map<Capability, String>>();
         capabilities.putAll(VirtualRouterElement.capabilities);
         
-        Map<Capability, String> sourceNatCapabilities = capabilities.get(Service.SourceNat);
+        Map<Capability, String> sourceNatCapabilities = new HashMap<Capability, String>();
+        sourceNatCapabilities.putAll(capabilities.get(Service.SourceNat));
         sourceNatCapabilities.put(Capability.RedundantRouter, "false");
         capabilities.put(Service.SourceNat, sourceNatCapabilities);
         
-        Map<Capability, String> vpnCapabilities = capabilities.get(Service.Vpn);
+        Map<Capability, String> vpnCapabilities = new HashMap<Capability, String>();
+        vpnCapabilities.putAll(capabilities.get(Service.Vpn));
         vpnCapabilities.put(Capability.VpnTypes, "s2svpn");
         capabilities.put(Service.Vpn, vpnCapabilities);
         
diff --git a/server/src/com/cloud/network/firewall/FirewallManagerImpl.java b/server/src/com/cloud/network/firewall/FirewallManagerImpl.java
index 854d3462217..fe45806810e 100644
--- a/server/src/com/cloud/network/firewall/FirewallManagerImpl.java
+++ b/server/src/com/cloud/network/firewall/FirewallManagerImpl.java
@@ -455,9 +455,11 @@ public class FirewallManagerImpl implements FirewallService, FirewallManager, Ma
         //remove the rule
         _firewallDao.remove(rule.getId());
         
-        //if the rule is the last one for the ip address assigned to VPC, unassign it from the network
-        IpAddress ip = _ipAddressDao.findById(rule.getSourceIpAddressId());
-        _networkMgr.unassignIPFromVpcNetwork(ip.getId(), rule.getNetworkId());
+        if (rule.getSourceIpAddressId() != null) {
+            //if the rule is the last one for the ip address assigned to VPC, unassign it from the network
+            IpAddress ip = _ipAddressDao.findById(rule.getSourceIpAddressId());
+            _networkMgr.unassignIPFromVpcNetwork(ip.getId(), rule.getNetworkId());
+        }
     }
 
     @Override
diff --git a/server/src/com/cloud/network/router/VpcVirtualNetworkApplianceManagerImpl.java b/server/src/com/cloud/network/router/VpcVirtualNetworkApplianceManagerImpl.java
index 03aeed85768..5da75343b9f 100644
--- a/server/src/com/cloud/network/router/VpcVirtualNetworkApplianceManagerImpl.java
+++ b/server/src/com/cloud/network/router/VpcVirtualNetworkApplianceManagerImpl.java
@@ -881,7 +881,7 @@ public class VpcVirtualNetworkApplianceManagerImpl extends VirtualNetworkApplian
         
         super.finalizeNetworkRulesForNetwork(cmds, router, provider, guestNetworkId);
         
-        if (router.getVpcId() == null) {
+        if (router.getVpcId() != null) {
             if (_networkMgr.isProviderSupportServiceInNetwork(guestNetworkId, Service.NetworkACL, Provider.VPCVirtualRouter)) {
                 List<? extends FirewallRule> networkACLs = _networkACLMgr.listNetworkACLs(guestNetworkId);
                 s_logger.debug("Found " + networkACLs.size() + " network ACLs to apply as a part of VPC VR " + router 
diff --git a/server/src/com/cloud/network/vpc/VpcManagerImpl.java b/server/src/com/cloud/network/vpc/VpcManagerImpl.java
index d6977f2e3b1..b3475f24638 100644
--- a/server/src/com/cloud/network/vpc/VpcManagerImpl.java
+++ b/server/src/com/cloud/network/vpc/VpcManagerImpl.java
@@ -893,8 +893,7 @@ public class VpcManagerImpl implements VpcManager, Manager{
                 && _ntwkMgr.areServicesSupportedByNetworkOffering(guestNtwkOff.getId(), Service.SourceNat))) {
             
             throw new InvalidParameterValueException("Only networks of type " + GuestType.Isolated + " with service "
-            + Service.SourceNat + 
-                    " can be added as a part of VPC");
+            + Service.SourceNat + " can be added as a part of VPC");
         }
         
         //3) No redundant router support