use network watcher ip flow verify to check one more time if traffic can get to the nva