We can add new rules to existing network tags(security groups). However, Adding new network tags to node pool require node-pool replacement at this time. That's pretty wierd.