To add a bit more of detail: The behavior is related to neutron's "enable_snat_by_default" setting: - if it's set to "true" (which is the default value), then a newly created router will have "enable_snat" set to true (expected) and you can change that setting via CLI (expected) - if it's set to "false", then a newly created router will have "enable_snat" set to false (expected) and you cannot change that setting via CLI (which is unexpected) Below terminal log show the following sequence of commands and results: - enable_snat_by_default is set to true (and neutron restarted, to use that setting) - the router settings show "enable_snat": true (which was created previously) - "neutron router-gateway-set --disable-snat" and "--enable-snat" is invoked on that router, without returning errors, and the router settings are positively changed - enable_snat_by_default is set to false (and neutron restarted, to use that setting) - "neutron router-gateway-set --disable-snat" and "--enable-snat" is invoked on that router, without returning errors. "disable" actually disables SNAT, while "enable" does not change back to enabled state. --- cut here --- control1:~ # grep enable_snat_by_default /etc/neutron/neutron.conf enable_snat_by_default = true control1:~ # systemctl restart openstack-neutron.service control1:~ # neutron router-list +--------------------------------------+----------------+--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+-------------+-------+ | id | name | external_gateway_info | distributed | ha | +--------------------------------------+----------------+--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+-------------+-------+ | cbc39730-34cc-4d18-986a-5b6b9b1b4e96 | ebl-router01 | {"network_id": "18db85e5-36aa-4669-9004-9ec43baad3f2", "enable_snat": true, "external_fixed_ips": [{"subnet_id": "dafed1c4-da5b-4557-bf18-cc7f9266f82a", "ip_address": "192.168.164.40"}]} | False | False | +--------------------------------------+----------------+--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+-------------+-------+ control1:~ # neutron router-gateway-set --disable-snat cbc39730-34cc-4d18-986a-5b6b9b1b4e96 18db85e5-36aa-4669-9004-9ec43baad3f2 Set gateway for router cbc39730-34cc-4d18-986a-5b6b9b1b4e96 control1:~ # neutron router-list +--------------------------------------+----------------+---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+-------------+-------+ | id | name | external_gateway_info | distributed | ha | +--------------------------------------+----------------+---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+-------------+-------+ | cbc39730-34cc-4d18-986a-5b6b9b1b4e96 | ebl-router01 | {"network_id": "18db85e5-36aa-4669-9004-9ec43baad3f2", "enable_snat": false, "external_fixed_ips": [{"subnet_id": "dafed1c4-da5b-4557-bf18-cc7f9266f82a", "ip_address": "192.168.164.40"}]} | False | False | +--------------------------------------+----------------+---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+-------------+-------+ control1:~ # neutron router-gateway-set --enable-snat cbc39730-34cc-4d18-986a-5b6b9b1b4e96 18db85e5-36aa-4669-9004-9ec43baad3f2 Set gateway for router cbc39730-34cc-4d18-986a-5b6b9b1b4e96 control1:~ # neutron router-list +--------------------------------------+----------------+--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+-------------+-------+ | id | name | external_gateway_info | distributed | ha | +--------------------------------------+----------------+--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+-------------+-------+ | cbc39730-34cc-4d18-986a-5b6b9b1b4e96 | ebl-router01 | {"network_id": "18db85e5-36aa-4669-9004-9ec43baad3f2", "enable_snat": true, "external_fixed_ips": [{"subnet_id": "dafed1c4-da5b-4557-bf18-cc7f9266f82a", "ip_address": "192.168.164.40"}]} | False | False | +--------------------------------------+----------------+--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+-------------+-------+ control1:~ # vi /etc/neutron/neutron.conf control1:~ # grep enable_snat_by_default /etc/neutron/neutron.conf enable_snat_by_default = false control1:~ # systemctl restart openstack-neutron.service control1:~ # neutron router-list +--------------------------------------+----------------+--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+-------------+-------+ | id | name | external_gateway_info | distributed | ha | +--------------------------------------+----------------+--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+-------------+-------+ | cbc39730-34cc-4d18-986a-5b6b9b1b4e96 | ebl-router01 | {"network_id": "18db85e5-36aa-4669-9004-9ec43baad3f2", "enable_snat": true, "external_fixed_ips": [{"subnet_id": "dafed1c4-da5b-4557-bf18-cc7f9266f82a", "ip_address": "192.168.164.40"}]} | False | False | +--------------------------------------+----------------+--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+-------------+-------+ control1:~ # neutron router-gateway-set --disable-snat cbc39730-34cc-4d18-986a-5b6b9b1b4e96 18db85e5-36aa-4669-9004-9ec43baad3f2 Set gateway for router cbc39730-34cc-4d18-986a-5b6b9b1b4e96 control1:~ # neutron router-list +--------------------------------------+----------------+---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+-------------+-------+ | id | name | external_gateway_info | distributed | ha | +--------------------------------------+----------------+---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+-------------+-------+ | cbc39730-34cc-4d18-986a-5b6b9b1b4e96 | ebl-router01 | {"network_id": "18db85e5-36aa-4669-9004-9ec43baad3f2", "enable_snat": false, "external_fixed_ips": [{"subnet_id": "dafed1c4-da5b-4557-bf18-cc7f9266f82a", "ip_address": "192.168.164.40"}]} | False | False | +--------------------------------------+----------------+---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+-------------+-------+ control1:~ # neutron router-gateway-set --enable-snat cbc39730-34cc-4d18-986a-5b6b9b1b4e96 18db85e5-36aa-4669-9004-9ec43baad3f2 Set gateway for router cbc39730-34cc-4d18-986a-5b6b9b1b4e96 control1:~ # neutron router-list +--------------------------------------+----------------+---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+-------------+-------+ | id | name | external_gateway_info | distributed | ha | +--------------------------------------+----------------+---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+-------------+-------+ | cbc39730-34cc-4d18-986a-5b6b9b1b4e96 | ebl-router01 | {"network_id": "18db85e5-36aa-4669-9004-9ec43baad3f2", "enable_snat": false, "external_fixed_ips": [{"subnet_id": "dafed1c4-da5b-4557-bf18-cc7f9266f82a", "ip_address": "192.168.164.40"}]} | False | False | +--------------------------------------+----------------+---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+-------------+-------+ control1:~ # --- cut here --- This is 1005 reproducible. Expected behavior: Even if "enable_snat_by_default" is set to "false", indivual routers' SNAT setting should be changeable.