Comment 1 for bug 1662568

Also note that if you switch from openvswitch firewall driver to iptables firewall driver, then security groups won't work as existing instances won't have qbr but tap is plugged directly to br-int. Maybe we should document that migrations of firewalls are not supported yet.