1. A method performed by a gateway, the gateway comprising a first network interface connecting the gateway to a physical network of a cloud data center, the gateway comprising a second network interface connecting the gateway to an external network, the gateway configured to perform: operations to facilitate communication between VMs of the cloud data center and external devices on the external network that is external to the cloud data center, the operations comprising: storing mapping policies for respective tenants of the cloud data center, wherein the mapping policies are updated to reflect migrations of the VMs among physical servers of the cloud data center, the physical servers comprising respective virtualization hypervisors that manage execution of the VMs, the cloud data center comprising a physical network that performs routing for a provider address space (PAS), the physical servers and the first network interface having physical network addresses in PAS, the cloud data center providing customer address spaces (CASs) for the respective tenants thereof, each mapping policy mapping customer addresses (CAs) in a corresponding CAS to provider addresses (PAs) of the physical servers in the PAS; receiving, via the external network, by the second network interface, requests sent from the external devices, the requests addressed to external-facing addresses of the second network interface, the external-facing addresses corresponding to the tenants, respectively, wherein the external devices send the requests to the external-facing addresses, the external-facing addresses facing externally with respect to the cloud data center; enabling communication between the external devices and a tenant's VMs by: (i) for requests sent to the tenant's external-facing address, selecting CAs of the tenant's VMs from the tenant's mapping policy, and (ii) for each CA selected for a corresponding request sent to the tenant's external-facing address, using the tenant's mapping policy to map the selected CA to a PA of a physical server hosting the VM of the selected CA, and sending the corresponding request to the mapped PA.