One of my colleagues pointed out an improvement I could make to my previous blog post on using PF for NAT for zones. That is to create an etherstub on which to create the VNICs. That way nothing you do in the private network can impact the public network. I've update the blog, but it also realized that I really should say 11.4 now it's out behaves exactly the same way. So you should be able to upgrade from 11.3 to 11.4 and keep the same configuration.