Merge branch 'feature/vRouter'
diff --git a/xos/core/models/plcorebase.py b/xos/core/models/plcorebase.py
index 4170697..c8c25a7 100644
--- a/xos/core/models/plcorebase.py
+++ b/xos/core/models/plcorebase.py
@@ -211,7 +211,8 @@
     deleted = models.BooleanField(default=False)
     write_protect = models.BooleanField(default=False)
     lazy_blocked = models.BooleanField(default=False)
-    no_sync = models.BooleanField(default=False)
+    no_sync = models.BooleanField(default=False)     # prevent object sync
+    no_policy = models.BooleanField(default=False)   # prevent model_policy run
 
     class Meta:
         # Changing abstract to False would require the managers of subclasses of
diff --git a/xos/core/models/user.py b/xos/core/models/user.py
index 0b8e3af..4acad99 100644
--- a/xos/core/models/user.py
+++ b/xos/core/models/user.py
@@ -127,6 +127,9 @@
                                       default="Provisioning in progress")
     deleted = models.BooleanField(default=False)
     write_protect = models.BooleanField(default=False)
+    lazy_blocked = models.BooleanField(default=False)
+    no_sync = models.BooleanField(default=False)     # prevent object sync
+    no_policy = models.BooleanField(default=False)   # prevent model_policy run
 
     timezone = TimeZoneField()
 
diff --git a/xos/synchronizers/model_policy.py b/xos/synchronizers/model_policy.py
index e2121ec..8faae81 100644
--- a/xos/synchronizers/model_policy.py
+++ b/xos/synchronizers/model_policy.py
@@ -110,7 +110,7 @@
         deleted_objects = []
 
         for m in models:
-            res = m.objects.filter(Q(policed__lt=F('updated')) | Q(policed=None))
+            res = m.objects.filter((Q(policed__lt=F('updated')) | Q(policed=None)) & Q(no_policy=False))
             objects.extend(res)
             res = m.deleted_objects.filter(Q(policed__lt=F('updated')) | Q(policed=None))
             deleted_objects.extend(res)
diff --git a/xos/tosca/resources/network.py b/xos/tosca/resources/network.py
index 06a366c..32e3fc1 100644
--- a/xos/tosca/resources/network.py
+++ b/xos/tosca/resources/network.py
@@ -90,14 +90,19 @@
         if not xos_args.get("template", None):
             raise Exception("Must specify network template when creating network")
 
+        # XXX TODO: investigate using transaction.atomic instead of setting
+        #   no_sync and no_policy
+
         network = Network(**xos_args)
         network.caller = self.user
         network.no_sync = True        # postprocess might set the cidr
+        network.no_policy = True
         network.save()
 
         self.postprocess(network)
 
         network.no_sync = False
+        network.no_policy = False
         network.save()
 
         self.info("Created Network '%s' owned by Slice '%s'" % (str(network), str(network.owner)))