Had an interesting issue with a client today. He had created quite a few edge gateway firewall rules with success. However a few VMs in his VPGs could not get out to the internet. After much clicking around and testing different settings, it turns out that to allow all outbound traffic, the protocol on the firewall rule needs to be set to ANY and not TCP.