Comment 6 for bug 1248859

The output from the neutron side is correct.
Actually Yaguang correctly pointed out that the setting for the firewall driver should be different from NoOp, otherwise nova won't apply the hybrid vif plugging strategy.

In my opinion this might still be a nova bug - get_firewall_required should return true if the driver is != noop or security_group_api=neutron; I don't think it is really intuitive to require specifying a firewall driver in nova if then the sec group is implemented by neutron.

Another way of looking at it is that neutron should mandate when it needs an hybrid strategy.

But since this has impact also on nova-network, we need input from some expert on the nova side.