Comment 3 for bug 1658682

It sounds like you found an incompatible combination of services that did not rejected: port_security extension and security groups go hand in hand. You can't really have one without the other (and nor it makes sense).

Personally I feel that option enable_security_group has outlived its life, as port_security = False has the same objective, but it's API driver, rather than config-driven.