To implement the security groups trunk feature with neutron-openvswitch-agent, openvswitch firewall driver is required. This driver currently contains a bug 1444368 where ingress traffic is wrongly matched if there are two ports with same MAC address on different network segment on the same compute node. As a result, if a subport has the same MAC address as its parent port, ingress traffic won't be matched correctly for one of the ports. A workaround to achieve correctly handled traffic is to disable port-security on the parent port and subports. For example, to disable port security on port with UUID 12345, you need to remove security groups associated with the port: openstack port set --no-security-group --disable-port-security 12345 Note that no security groups rules will be applied to that port and traffic will not be filtered or protected against ip/mac/arp spoofing.