After config cleanup, masquerade is auto-enabled on external zone