Comment 10 for bug 1377843

Even when you allow IPv6's ICMP to passthrough the security rules for RA, instances won't know to use DHCPv6 because radvd doesn't have the appropriate flag set:

https://github.com/openstack/neutron/commit/4f3a9135acb561172f7af45bc82739d6dc49f23c

Enables the slaac/slaac+stateful (for DNS), but does not enable stateful at all, this flag is missing:

AdvManagedFlag on;