The outbound NAT policy added for CSE connectivity is automatically deleted after a reboot. The CSE Access Tier AIPs are dynamic and are populated only after the CSE connector comes up. During device boot-up, the CSE AO remains empty, causing validation to fail and preventing the NAT policy from being added.