It gets complicated very quickly- if you have isolated Org networking, then isolated vApp networking (fenced vApps), you are NATing twice to get out to the 'standard' network. The best approach is to ...