1. If the entity is a router created by neutron, then there is no issue since the commit takes care of this scenario. E.g. ext net1 net2 | | |src1 |---Router1---|---Router2---|src2 | | |src3 2. Your question is more about a SF performing routing/NAT. E.g. In topoloy below, SF is a Router. ext |--SF1 | | |--src1 |---Router1--|--SF(Router)-|--src2 | | |--src3 |--SF2 In such a case, yes, you are right this commit will break things if only the logical-src-port is specified without the prefixes since it will insert the SRC IP address of SF(Router). However, there are several easy workarounds for this. 1. - Specify the prefixes for the sources (most obvious one). 2. - Specify the SF(Router) interfaces to be router owned. (see below) root@fs-10-145-105-24:/opt/stack/networking-sfc# neutron port-show 0f15bfa0-c522-4cc8-b04a-b2f92df2b7f1 +-----------------------+--------------------------------------------------------------------------- | Field | Value | +-----------------------+--------------------------------------------------------------------------- | admin_state_up | True | | allowed_address_pairs | | | binding:vnic_type | normal | | created_at | 2017-02-21T20:49:48Z | | description | | | device_id | 5f7d0f49-cbae-4f6d-9de5-773f37c9faf1 | | device_owner | compute:None | If the above SF is doing routing or NAT, then change the device owner to be network:router_interface instead of nova:compute neutron port-update --device-owner network:router_interface 0f15bfa0-c522-4cc8-b04a-b2f92df2b7f1 root@fs-10-145-105-24:/opt/stack/networking-sfc# neutron port-show 0f15bfa0-c522-4cc8-b04a-b2f92df2b7f1 +-----------------------+--------------------------------------------------------------------------- | Field | Value | +-----------------------+--------------------------------------------------------------------------- | admin_state_up | True | | allowed_address_pairs | | | binding:vnic_type | normal | | created_at | 2017-02-21T20:49:48Z | | description | | | device_id | 5f7d0f49-cbae-4f6d-9de5-773f37c9faf1 | | device_owner | network:router_interface If the device_owner is a router_interface, the commit will not mess with it (not insert its source IP into the flow classifier)