On a groovy-victoria deployment, performing the steps as described in the Test Case I can see before adding the security groups: $ ping -c 3 10.78.95.94 PING 10.78.95.94 (10.78.95.94) 56(84) bytes of data. 64 bytes from 10.78.95.94: icmp_seq=1 ttl=63 time=1.30 ms 64 bytes from 10.78.95.94: icmp_seq=2 ttl=63 time=0.873 ms 64 bytes from 10.78.95.94: icmp_seq=3 ttl=63 time=0.457 ms --- 10.78.95.94 ping statistics --- 3 packets transmitted, 3 received, 0% packet loss, time 2008ms rtt min/avg/max/mdev = 0.457/0.877/1.302/0.344 ms After adding the security groups I can see the NXBAC_BAD_CONJUNCTION messages in /var/log/ovn/ovn-controller.log: 2021-02-16T09:53:39.855Z|00025|ofp_actions|WARN|"conjunction" actions may be used along with "note" but not any other kind of action (such as the "set_field" action used here) 2021-02-16T09:53:39.855Z|00026|ofctrl|INFO|OpenFlow error: OFPT_ERROR (OF1.5) (xid=0x1f0): NXBAC_BAD_CONJUNCTION OFPT_FLOW_MOD (OF1.5) (xid=0x1f0): ***decode error: NXBAC_BAD_CONJUNCTION*** 00000000 06 0e 00 e0 00 00 01 f0-00 00 00 00 00 00 00 00 |................| 00000010 00 00 00 00 00 00 00 00-2c 02 00 00 00 00 07 d2 |........,.......| 00000020 ff ff ff ff ff ff ff ff-ff ff ff ff 00 00 00 00 |................| 00000030 00 01 00 5f 80 00 0a 02-08 00 80 00 14 01 01 80 |..._............| 00000040 01 0f 10 00 00 00 00 00-00 00 03 00 00 00 00 ff |................| 00000050 ff ff ff 00 01 d3 08 00-00 00 22 00 00 00 2b 00 |.........."...+.| 00000060 01 d9 20 00 00 00 00 00-00 00 00 00 00 00 00 00 |.. .............| 00000070 00 00 01 00 00 00 00 00-00 00 00 00 00 00 00 00 |................| 00000080 00 00 01 80 00 04 08 00-00 00 00 00 00 00 03 00 |................| 00000090 00 04 00 50 00 00 00 00-00 19 00 28 00 01 df 20 |...P.......(... | 000000a0 00 00 00 02 00 00 00 00-00 00 00 00 00 00 00 00 |................| 000000b0 00 00 00 02 00 00 00 00-00 00 00 00 00 00 00 00 |................| 000000c0 ff ff 00 10 00 00 23 20-00 0e ff f8 2d 00 00 00 |......# ....-...| 000000d0 ff ff 00 10 00 00 23 20-00 22 01 02 00 00 00 0d |......# ."......| And connectivity to the server is impacted: $ ping -c 3 10.78.95.94 PING 10.78.95.94 (10.78.95.94) 56(84) bytes of data. --- 10.78.95.94 ping statistics --- 3 packets transmitted, 0 received, 100% packet loss, time 2054ms Installing the ovn packages from -proposed removes the messages from the log and connectivity is restored: $ ping -c 3 10.78.95.94 PING 10.78.95.94 (10.78.95.94) 56(84) bytes of data. 64 bytes from 10.78.95.94: icmp_seq=1 ttl=63 time=1.90 ms 64 bytes from 10.78.95.94: icmp_seq=2 ttl=63 time=0.952 ms 64 bytes from 10.78.95.94: icmp_seq=3 ttl=63 time=0.492 ms --- 10.78.95.94 ping statistics --- 3 packets transmitted, 3 received, 0% packet loss, time 2002ms rtt min/avg/max/mdev = 0.492/1.115/1.901/0.586 ms $ lsb_release -a No LSB modules are available. Distributor ID: Ubuntu Description: Ubuntu 20.10 Release: 20.10 Codename: groovy $ dpkg -l | grep ovn ii neutron-ovn-metadata-agent 2:17.0.0-0ubuntu2 all Neutron is a virtual network service for Openstack - OVN metadata agent ii ovn-common 20.06.2-0ubuntu1.2 amd64 OVN common components ii ovn-host 20.06.2-0ubuntu1.2 amd64 OVN host components