diff --git a/tcp_tests/templates/cookied-model-generator/underlay--user-data-cfg01.yaml b/tcp_tests/templates/cookied-model-generator/underlay--user-data-cfg01.yaml
index ba4ee4e..7bd7a02 100644
--- a/tcp_tests/templates/cookied-model-generator/underlay--user-data-cfg01.yaml
+++ b/tcp_tests/templates/cookied-model-generator/underlay--user-data-cfg01.yaml
@@ -19,10 +19,12 @@
 
   bootcmd:
    # Block access to SSH while node is preparing
-   - cloud-init-per once sudo iptables -A INPUT -p tcp --dport 22 -j DROP
+   #- cloud-init-per once sudo iptables -A INPUT -p tcp --dport 22 -j DROP
+   - cloud-init-per once sudo ifdown ens4
+
    # Enable root access
-   - sed -i -e '/^PermitRootLogin/s/^.*$/PermitRootLogin yes/' /etc/ssh/sshd_config
-   - service sshd restart
+   - cloud-init-per once sudo sed -i -e '/^PermitRootLogin/s/^.*$/PermitRootLogin yes/' /etc/ssh/sshd_config
+   - cloud-init-per once sudo service sshd restart
 
   output:
     all: '| tee -a /var/log/cloud-init-output.log /dev/tty0'
@@ -30,9 +32,19 @@
   runcmd:
    # Prepare network connection
    - sudo ifdown ens3
-   #- sudo ifup ens3
+   - sudo ifup ens3
    #- sudo route add default gw {gateway} {interface_name}
 
+   # Purge the unattended-upgrades package (Workaround for PROD-17904, PROD-18736)"
+   - echo "APT::Periodic::Update-Package-Lists 0;" > /etc/apt/apt.conf.d/99dont_update_package_list-salt
+   - echo "APT::Periodic::Download-Upgradeable-Packages 0;" > /etc/apt/apt.conf.d/99dont_update_download_upg_packages-salt
+   - echo "APT::Periodic::Unattended-Upgrade 0;" > /etc/apt/apt.conf.d/99disable_unattended_upgrade-salt
+   - apt-get -y purge unattended-upgrades
+   # Stop currently running apt-daily service, source: https://unix.stackexchange.com/a/315517
+   - systemctl stop apt-daily.service
+   - systemctl kill --kill-who=all apt-daily.service
+   - while ! (systemctl list-units --all apt-daily.service | fgrep -q dead); do sleep 1; done
+
    # Configure dhclient
    - sudo echo "nameserver {gateway}" >> /etc/resolvconf/resolv.conf.d/base
    - sudo resolvconf -u
@@ -65,16 +77,11 @@
 
    ########################################################
    # Node is ready, allow SSH access
-   - echo "Allow SSH access ..."
-   - sudo iptables -D INPUT -p tcp --dport 22 -j DROP
+   #- echo "Allow SSH access ..."
+   #- sudo iptables -D INPUT -p tcp --dport 22 -j DROP
+   - sudo ifup ens4
    ########################################################
 
-   # Purge the unattended-upgrades package (Workaround for PROD-17904, PROD-18736)"
-   - echo "APT::Periodic::Update-Package-Lists 0;" > /etc/apt/apt.conf.d/99dont_update_package_list-salt
-   - echo "APT::Periodic::Download-Upgradeable-Packages 0;" > /etc/apt/apt.conf.d/99dont_update_download_upg_packages-salt
-   - echo "APT::Periodic::Unattended-Upgrade 0;" > /etc/apt/apt.conf.d/99disable_unattended_upgrade-salt
-   - apt-get -y purge unattended-upgrades
-   - reboot
 
   write_files:
    - path: /etc/default/grub.d/97-enable-grub-menu.cfg
@@ -87,6 +94,8 @@
      content: |
           auto ens3
           iface ens3 inet dhcp
+          auto ens4
+          iface ens4 inet dhcp
 
    - path: /root/.ssh/config
      owner: root:root
diff --git a/tcp_tests/templates/cookied-model-generator/underlay.yaml b/tcp_tests/templates/cookied-model-generator/underlay.yaml
index 25fb76c..4783bd8 100644
--- a/tcp_tests/templates/cookied-model-generator/underlay.yaml
+++ b/tcp_tests/templates/cookied-model-generator/underlay.yaml
@@ -29,6 +29,16 @@
           ip_ranges:
             dhcp: [+90, -10]
 
+      external-pool01:
+        net: {{ os_env('ADMIN_ADDRESS_POOL01', '10.90.0.0/16:24') }}
+        params:
+          ip_reserved:
+            gateway: +1
+            l2_network_device: +1
+            default_{{ HOSTNAME_CFG01 }}: +15
+          ip_ranges:
+            dhcp: [+90, -10]
+
     groups:
       - name: default
         driver:
@@ -46,11 +56,17 @@
           admin: admin-pool01
 
         l2_network_devices:
+          external:
+            address_pool: external-pool01
+            dhcp: true
+            forward:
+              mode: nat
+
           admin:
             address_pool: admin-pool01
             dhcp: true
             forward:
-              mode: nat
+              mode: route
 
         nodes:
           - name: {{ HOSTNAME_CFG01 }}
@@ -78,9 +94,15 @@
 
               interfaces:
                 - label: ens3
+                  l2_network_device: external
+                  interface_model: *interface_model
+                - label: ens4
                   l2_network_device: admin
                   interface_model: *interface_model
               network_config:
                 ens3:
                   networks:
+                    - external
+                ens4:
+                  networks:
                     - admin