diff --git a/apis/cloudstack/src/main/java/org/jclouds/cloudstack/compute/strategy/AdvancedNetworkOptionsConverter.java b/apis/cloudstack/src/main/java/org/jclouds/cloudstack/compute/strategy/AdvancedNetworkOptionsConverter.java
index bd1e5d7f50..524aeb7f48 100644
--- a/apis/cloudstack/src/main/java/org/jclouds/cloudstack/compute/strategy/AdvancedNetworkOptionsConverter.java
+++ b/apis/cloudstack/src/main/java/org/jclouds/cloudstack/compute/strategy/AdvancedNetworkOptionsConverter.java
@@ -52,7 +52,7 @@ public class AdvancedNetworkOptionsConverter implements OptionsConverter {
          checkArgument(!networks.isEmpty(), "please setup a network for zone: " + zoneId);
          Network defaultNetworkInZone = Iterables.getFirst(filter(networks.values(), and(defaultNetworkInZone(zoneId), supportsStaticNAT())), null);
          if(defaultNetworkInZone == null) {
-             defaultNetworkInZone = Iterables.getFirst(filter(networks.values(), and(isIsolatedNetwork(), not(supportsStaticNAT()))), null);
+             defaultNetworkInZone = Iterables.getFirst(filter(networks.values(), isIsolatedNetwork()), null);
          }
          if (defaultNetworkInZone == null) {
              throw new IllegalArgumentException("please choose a specific network in zone " + zoneId + ": " + networks);
diff --git a/apis/cloudstack/src/main/java/org/jclouds/cloudstack/compute/strategy/CloudStackComputeServiceAdapter.java b/apis/cloudstack/src/main/java/org/jclouds/cloudstack/compute/strategy/CloudStackComputeServiceAdapter.java
index 41cee62477..d0c49592d1 100644
--- a/apis/cloudstack/src/main/java/org/jclouds/cloudstack/compute/strategy/CloudStackComputeServiceAdapter.java
+++ b/apis/cloudstack/src/main/java/org/jclouds/cloudstack/compute/strategy/CloudStackComputeServiceAdapter.java
@@ -329,14 +329,17 @@ public class CloudStackComputeServiceAdapter implements
       // immutable doesn't permit duplicates
       Set<String> ipAddresses = Sets.newLinkedHashSet();
 
-      Set<FirewallRule> firewallRules = client.getFirewallClient()
-          .listFirewallRules(ListFirewallRulesOptions.Builder.ipAddressId(client.getVirtualMachineClient().getVirtualMachine(virtualMachineId).getPublicIPId()));
-
-      for (FirewallRule rule : firewallRules) {
-          if (!FirewallRule.State.fromValue("DELETEING").equals(rule.getState())) {
-              ipAddresses.add(rule.getIpAddressId());
-              client.getFirewallClient().deleteFirewallRule(rule.getId());
-              logger.debug(">> deleting FirewallRule(%s)", rule.getId());
+      String publicIpId = client.getVirtualMachineClient().getVirtualMachine(virtualMachineId).getPublicIPId();
+      if (publicIpId != null) {
+          Set<FirewallRule> firewallRules = client.getFirewallClient()
+              .listFirewallRules(ListFirewallRulesOptions.Builder.ipAddressId(client.getVirtualMachineClient().getVirtualMachine(virtualMachineId).getPublicIPId()));
+          
+          for (FirewallRule rule : firewallRules) {
+              if (!FirewallRule.State.fromValue("DELETEING").equals(rule.getState())) {
+                  ipAddresses.add(rule.getIpAddressId());
+                  client.getFirewallClient().deleteFirewallRule(rule.getId());
+                  logger.debug(">> deleting FirewallRule(%s)", rule.getId());
+              }
           }
       }
       return ipAddresses;