That's a pretty serious limitation of their automation if they are unable to just whack the ACLs on the private network to the affected customer nodes.