diff --git a/data/templates/cf/SQLCluster.template b/data/templates/cf/SQLCluster.template
new file mode 100644
index 0000000..5a24a63
--- /dev/null
+++ b/data/templates/cf/SQLCluster.template
@@ -0,0 +1,54 @@
+{
+    "Resources": {
+        "$instanceName": {
+            "Properties": {
+                "SecurityGroups": [
+                    {
+                        "Ref": "MsSqlSecurityGroup"
+                    }
+                ]
+            }
+        },
+        "$instancePort": {
+            "Properties": {
+                "allowed_address_pairs": [
+                    {
+                        "ip_address": "$clusterIp"
+                    }
+                ]
+            }
+        },
+        "MsSqlSecurityGroup": {
+            "Type": "AWS::EC2::SecurityGroup",
+            "Properties": {
+                "SecurityGroupIngress": [
+                    {
+                        "ToPort": 4022,
+                        "IpProtocol": "tcp",
+                        "FromPort": 4022,
+                        "CidrIp": "0.0.0.0/0"
+                    },
+                    {
+                        "ToPort": 135,
+                        "IpProtocol": "tcp",
+                        "FromPort": 135,
+                        "CidrIp": "0.0.0.0/0"
+                    },
+                    {
+                        "ToPort": 1433,
+                        "IpProtocol": "tcp",
+                        "FromPort": 1433,
+                        "CidrIp": "0.0.0.0/0"
+                    },
+                    {
+                        "ToPort": 1434,
+                        "IpProtocol": "tcp",
+                        "FromPort": 1434,
+                        "CidrIp": "0.0.0.0/0"
+                    }
+                ],
+                "GroupDescription": "Enable MS SQL access"
+            }
+        }
+    }
+}
diff --git a/data/templates/cf/Windows.template b/data/templates/cf/Windows.template
index c69fc8f..257827c 100644
--- a/data/templates/cf/Windows.template
+++ b/data/templates/cf/Windows.template
@@ -1,26 +1,50 @@
 {
-  "AWSTemplateFormatVersion" : "2010-09-09",
- 
-  "Parameters" : {
-    "KeyName" : {
-      "Description" : "Key Pair name for Load Balancer",
-      "Type" : "String",
-      "Default" : "murano-lb-key"
-    }
-  },
- 
-  "Resources" : {
-    "$instanceName": {
-      "Type" : "AWS::EC2::Instance",
-      "Properties": {
-        "InstanceType" : "$instanceType",
-        "ImageId" : "$imageName",
-        "AvailabilityZone" : "$availabilityZone",
-        "UserData": "$userData",
-        "SecurityGroups" : [ {"Ref" : "MuranoDefaultSecurityGroup"} ]
-      }
+    "AWSTemplateFormatVersion": "2010-09-09",
+
+    "Parameters": {
+        "KeyName": {
+            "Description": "Key Pair name for Load Balancer",
+            "Type": "String",
+            "Default": "murano-lb-key"
+        }
     },
-    "MuranoDefaultSecurityGroup": {
+
+    "Resources": {
+        "$instanceName": {
+            "Type": "AWS::EC2::Instance",
+            "Properties": {
+                "InstanceType": "$instanceType",
+                "ImageId": "$imageName",
+                "AvailabilityZone": "$availabilityZone",
+                "UserData": "$userData",
+                "SecurityGroups": [
+                    {
+                        "Ref": "MuranoDefaultSecurityGroup"
+                    }
+                ],
+                "NetworkInterfaces": [
+                    {
+                        "Ref": "$instancePort"
+                    }
+                ]
+            }
+        },
+        "$instancePort": {
+            "Type": "OS::Neutron::Port",
+            "Properties": {
+                "network_id": {
+                    "Ref": "network"
+                },
+                "fixed_ips": [
+                    {
+                        "subnet_id": {
+                            "Ref": "subnet"
+                        }
+                    }
+                ]
+            }
+        },
+        "MuranoDefaultSecurityGroup": {
             "Type": "AWS::EC2::SecurityGroup",
             "Properties": {
                 "SecurityGroupIngress": [
@@ -45,9 +69,45 @@
                 ],
                 "GroupDescription": "Default security group for Murano Environments"
             }
+        },
+        "network": {
+            "Type": "OS::Neutron::Net",
+            "Properties": {
+                "name": "$networkName"
+            }
+        },
+        "subnet": {
+            "Type": "OS::Neutron::Subnet",
+            "Properties": {
+                "network_id": {
+                    "Ref": "network"
+                },
+                "ip_version": 4,
+                "cidr": "10.0.0.0/24",
+                "allocation_pools": [
+                    {
+                        "start": "10.0.0.20",
+                        "end": "10.0.0.250"
+                    }
+                ]
+            }
+        },
+        "router": {
+            "Type": "OS::Neutron::Router"
+        },
+        "router_interface": {
+            "Type": "OS::Neutron::RouterInterface",
+            "Properties": {
+                "router_id": {
+                    "Ref": "router"
+                },
+                "subnet_id": {
+                    "Ref": "subnet"
+                }
+            }
         }
-   },
-   
-  "Outputs" : {
-  } 
+    },
+
+    "Outputs": {
+    }
 }
diff --git a/data/workflows/AD.xml b/data/workflows/AD.xml
index b961a84..9cd37d5 100644
--- a/data/workflows/AD.xml
+++ b/data/workflows/AD.xml
@@ -17,6 +17,8 @@
 			<parameter name="mappings">
 				<map>
 					<mapping name="instanceName"><select path="state.hostname"/></mapping>
+					<mapping name="instancePort">port-<select path="state.hostname"/></mapping>
+					<mapping name="networkName">network-<select path="/id"/></mapping>
 					<mapping name="userData">
 						<prepare-user-data>
 							<parameter name="hostname"><select path="state.hostname"/></parameter>
diff --git a/data/workflows/AspNetApps.xml b/data/workflows/AspNetApps.xml
index aba3eba..b1b69f6 100644
--- a/data/workflows/AspNetApps.xml
+++ b/data/workflows/AspNetApps.xml
@@ -17,6 +17,8 @@
 			<parameter name="mappings">
 				<map>
 					<mapping name="instanceName"><select path="state.hostname"/></mapping>
+                    <mapping name="instancePort">port-<select path="state.hostname"/></mapping>
+					<mapping name="networkName">network-<select path="/id"/></mapping>
 					<mapping name="userData">
 						<prepare-user-data>
 							<parameter name="hostname"><select path="state.hostname"/></parameter>
diff --git a/data/workflows/MsSqlCluster.xml b/data/workflows/MsSqlCluster.xml
index 47acb35..05447cd 100644
--- a/data/workflows/MsSqlCluster.xml
+++ b/data/workflows/MsSqlCluster.xml
@@ -18,6 +18,8 @@
 			<parameter name="mappings">
 				<map>
 					<mapping name="instanceName"><select path="state.hostname"/></mapping>
+                    <mapping name="instancePort">port-<select path="state.hostname"/></mapping>
+					<mapping name="networkName">network-<select path="/id"/></mapping>
 					<mapping name="userData">
 						<prepare-user-data>
 							<parameter name="hostname"><select path="state.hostname"/></parameter>
@@ -45,6 +47,33 @@
                 <stop/>
             </failure>
 		</update-cf-stack>
+
+        <report entity="unit">
+			<parameter name="id"><select path="id"/></parameter>
+			<parameter name="text">Applying address pair and opening SQL ports on <select path="state.hostname"/> (<select path="name"/>)</parameter>
+		</report>
+		<update-cf-stack template="SQLCluster" error="exception">
+			<parameter name="mappings">
+				<map>
+					<mapping name="instanceName"><select path="state.hostname"/></mapping>
+					<mapping name="instancePort">port-<select path="state.hostname"/></mapping>
+					<mapping name="clusterIp"><select path="::clusterIp"/></mapping>
+				</map>
+			</parameter>
+			<success>
+				<report entity="unit">
+					<parameter name="id"><select path="id"/></parameter>
+					<parameter name="text">Address pair and SQL ports are open on <select path="state.hostname"/> (<select path="name"/>)</parameter>
+				</report>
+			</success>
+            <failure>
+                <report entity="unit" level="error">
+					<parameter name="id"><select path="id"/></parameter>
+					<parameter name="text">Unable to assign address pair and open SQL ports on instance <select path="state.hostname"/> (<select path="name"/>) due to <select source="exception" path="message" default="unknown Heat error"/> </parameter>
+				</report>
+                <stop/>
+            </failure>
+		</update-cf-stack>
 	</rule>
 
 	<rule match="$.services[?(@.type == 'msSqlClusterServer' and @.domain and not @.domainAdminUserName and not @.domainAdminPassword)]"
diff --git a/data/workflows/MsSqlServer.xml b/data/workflows/MsSqlServer.xml
index 547870a..76bbdea 100644
--- a/data/workflows/MsSqlServer.xml
+++ b/data/workflows/MsSqlServer.xml
@@ -17,6 +17,8 @@
 			<parameter name="mappings">
 				<map>
 					<mapping name="instanceName"><select path="state.hostname"/></mapping>
+                    <mapping name="instancePort">port-<select path="state.hostname"/></mapping>
+					<mapping name="networkName">network-<select path="/id"/></mapping>
 					<mapping name="userData">
 						<prepare-user-data>
 							<parameter name="hostname"><select path="state.hostname"/></parameter>
@@ -47,7 +49,7 @@
 
         <report entity="unit">
 			<parameter name="id"><select path="id"/></parameter>
-			<parameter name="text">Openining SQL ports on <select path="state.hostname"/> (<select path="name"/>)</parameter>
+			<parameter name="text">Opening SQL ports on <select path="state.hostname"/> (<select path="name"/>)</parameter>
 		</report>
 		<update-cf-stack template="SQL-security" error="exception">
 			<parameter name="mappings">