diff --git a/awsapi.log.2012-07-25.gz b/awsapi.log.2012-07-25.gz
new file mode 100644
index 00000000000..02fd067aac2
Binary files /dev/null and b/awsapi.log.2012-07-25.gz differ
diff --git a/server/src/com/cloud/network/element/VpcVirtualRouterElement.java b/server/src/com/cloud/network/element/VpcVirtualRouterElement.java
index e6959b0f3ac..79795f25719 100644
--- a/server/src/com/cloud/network/element/VpcVirtualRouterElement.java
+++ b/server/src/com/cloud/network/element/VpcVirtualRouterElement.java
@@ -288,11 +288,13 @@ public class VpcVirtualRouterElement extends VirtualRouterElement implements Vpc
         Map<Service, Map<Capability, String>> capabilities = new HashMap<Service, Map<Capability, String>>();
         capabilities.putAll(VirtualRouterElement.capabilities);
         
-        Map<Capability, String> sourceNatCapabilities = capabilities.get(Service.SourceNat);
+        Map<Capability, String> sourceNatCapabilities = new HashMap<Capability, String>();
+        sourceNatCapabilities.putAll(capabilities.get(Service.SourceNat));
         sourceNatCapabilities.put(Capability.RedundantRouter, "false");
         capabilities.put(Service.SourceNat, sourceNatCapabilities);
         
-        Map<Capability, String> vpnCapabilities = capabilities.get(Service.Vpn);
+        Map<Capability, String> vpnCapabilities = new HashMap<Capability, String>();
+        vpnCapabilities.putAll(capabilities.get(Service.Vpn));
         vpnCapabilities.put(Capability.VpnTypes, "s2svpn");
         capabilities.put(Service.Vpn, vpnCapabilities);
         
diff --git a/server/src/com/cloud/network/firewall/FirewallManagerImpl.java b/server/src/com/cloud/network/firewall/FirewallManagerImpl.java
index f80cc578913..21eb1740217 100644
--- a/server/src/com/cloud/network/firewall/FirewallManagerImpl.java
+++ b/server/src/com/cloud/network/firewall/FirewallManagerImpl.java
@@ -462,9 +462,11 @@ public class FirewallManagerImpl implements FirewallService, FirewallManager, Ma
         //remove the rule
         _firewallDao.remove(rule.getId());
         
-        //if the rule is the last one for the ip address assigned to VPC, unassign it from the network
-        IpAddress ip = _ipAddressDao.findById(rule.getSourceIpAddressId());
-        _networkMgr.unassignIPFromVpcNetwork(ip.getId(), rule.getNetworkId());
+        if (rule.getSourceIpAddressId() != null) {
+            //if the rule is the last one for the ip address assigned to VPC, unassign it from the network
+            IpAddress ip = _ipAddressDao.findById(rule.getSourceIpAddressId());
+            _networkMgr.unassignIPFromVpcNetwork(ip.getId(), rule.getNetworkId());
+        }
     }
 
     @Override
diff --git a/server/src/com/cloud/network/router/VpcVirtualNetworkApplianceManagerImpl.java b/server/src/com/cloud/network/router/VpcVirtualNetworkApplianceManagerImpl.java
index 42a7a2df8b0..e2143a8817f 100644
--- a/server/src/com/cloud/network/router/VpcVirtualNetworkApplianceManagerImpl.java
+++ b/server/src/com/cloud/network/router/VpcVirtualNetworkApplianceManagerImpl.java
@@ -891,7 +891,7 @@ public class VpcVirtualNetworkApplianceManagerImpl extends VirtualNetworkApplian
         
         super.finalizeNetworkRulesForNetwork(cmds, router, provider, guestNetworkId);
         
-        if (router.getVpcId() == null) {
+        if (router.getVpcId() != null) {
             if (_networkMgr.isProviderSupportServiceInNetwork(guestNetworkId, Service.NetworkACL, Provider.VPCVirtualRouter)) {
                 List<? extends FirewallRule> networkACLs = _networkACLMgr.listNetworkACLs(guestNetworkId);
                 s_logger.debug("Found " + networkACLs.size() + " network ACLs to apply as a part of VPC VR " + router 
diff --git a/server/src/com/cloud/network/vpc/VpcManagerImpl.java b/server/src/com/cloud/network/vpc/VpcManagerImpl.java
index 201f24328d8..528f4b19185 100644
--- a/server/src/com/cloud/network/vpc/VpcManagerImpl.java
+++ b/server/src/com/cloud/network/vpc/VpcManagerImpl.java
@@ -917,7 +917,7 @@ public class VpcManagerImpl implements VpcManager, Manager{
                 && _ntwkMgr.areServicesSupportedByNetworkOffering(guestNtwkOff.getId(), Service.SourceNat))) {
 
             throw new InvalidParameterValueException("Only networks of type " + GuestType.Isolated + " with service "
-                    + Service.SourceNat +
+                    + Service.SourceNat.getName() +
                     " can be added as a part of VPC", null);
         }