When a user switches from the hybrid firewall to the OVS native firewall the iptables rules will be left behind on the filtering bridge. Since removing the bridge would require difficult coordination with Nova and it would be disruptive to traffic, that is currently not a viable approach.
To make the transition easier, the OVS firewall should at least detect when one of its VM ports contains a filtering bridge and drop all of the iptables rules on it so we don't have stale rules interfering with the traffic.
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.
For information on the advisory, and where to find the updated
files, follow the link below.
If the solution does not work for you, open a new bug report.