One of my colleagues pointed out an improvement I could make to my previous blog post on using PF for NAT for zones. That is to create an etherstub on which to create the VNICs. That way nothing you do in the private network can impact the public network. I've update the blog, but it also realized that I really should say 11.4 now it's out behaves exactly the same way. So you should be able to upgrade from 11.3 to 11.4 and keep the same configuration.
You'll probably have seen by now yesterday we released Oracle Solaris 11.4 Public Beta. I've been working with colleagues to write some blogs about the things we're most excited about. You can download it from OTN to see what we're talking about. Head over to the main Oracle Solaris blog for details of how to get it, what we've been working on these last few years, and some interesting things you can try.