VM are not reachable without disabling port_security when OVS Firewall driver is configured "NeutronOVSFirewallDriver: openvswitch" and DPDK.

Issue

• We Configured OVS firewall driver on Openstack environment

• We enabled OVS firewall driver by adding the following to network-environment.yaml:

parameter_defaults:
  NeutronOVSFirewallDriver: openvswitch

• We deployed the overcloud using openstack overcloud deploy .. command

• We then deployed our infra using heat templates and by default we are creating instances with security groups.

• We observed that the vrrp communication is not working during application deployment .

• We removed the security_group from the vms and disabled port_secuirty on ports.

• Then vm communication is then working fine and application deployment successfull.

• Now we need to keep the port_security disable even during run time, without this we are unable to launch the application user interface. When we disable the port_security on load balancer vms then application UI is able to launch.

• Looking at the RH article, we need to disable port_seurity on dataplane interfaces. But we see security impacts with port_security disabled during run time.

• What is the configuration we need to enable to keep port_security enabled with OVS firewall driver?