For a clean Workstation install I did not expect the portmap and nfslock
services to be running by default.
They are required for proper NFS client operation, which we include in
Workstation installs. The new firewall rules should prevent outside machines
from contacting portmap, but the kernel's lockd process must be able to
register, otherwise nfs mount requests will hang for a really long time.