This firewall requires OVS 2.5+ version supporting conntrack and kernel conntrack datapath support (kernel>=4.3). For more information, see hhttps://review.openstack.org/#/c/249337/ Configuration required: in openvswitch_agent.ini - securitygroup section - set firewall_driver to openvswitch
Patch is now merged in upstream Newton.
I have updated virt/network/network-environment.yaml before overcloud deployment with NeutronOVSFirewallDriver: "openvswitch" . The firewall driver after installation changed to "firewall_driver = openvswitch" /etc/neutron/plugins/ml2/openvswitch_agent.ini as it supposed to be. Setup: Controller and Compute on top of RHEL release 7.3 openstack-tripleo-heat-templates-5.0.0-0.6.0rc3.el7ost.noarch openstack-neutron-9.0.0-1.4.el7ost.noarch All following tests succeeded to run on this setup: 1)test_network_basic_ops.py 2)test_network_advanced_server_ops.py 3)test_security_groups_basic_ops.py
Brent as far as documentation I think we can make do with a doctext here on this RHBZ that would explain how to enable the feature.
Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA. For information on the advisory, and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. https://rhn.redhat.com/errata/RHEA-2016-2948.html