diff --git a/tcp_tests/managers/runtestmanager.py b/tcp_tests/managers/runtestmanager.py
index bc71427..eb646d1 100644
--- a/tcp_tests/managers/runtestmanager.py
+++ b/tcp_tests/managers/runtestmanager.py
@@ -123,8 +123,17 @@
         barbican_integration = self.__salt_api.get_single_pillar(
             tgt="ctl01*",
             pillar="_param:barbican_integration_enabled")
+        if self.__salt_api.local('I@opencontrail:compute:enabled:true',
+                                 'match.pillar',
+                                 'opencontrail:compute:enabled:true'
+                                 ).get('return', [{}]) != [{}]:
+            contrail_integration = True
+        else:
+            contrail_integration = False
 
         LOG.info("Barbican integration {0}".format(barbican_integration))
+        LOG.info("Opencontrail integration {0}".format(contrail_integration))
+
         commands = [
             {
                 'description': ("Install docker-ce package and "
@@ -147,6 +156,62 @@
                         "runtest.orchestrate.tempest")},
         ]
 
+        if contrail_integration:
+            vsrx_router = self.__salt_api.get_single_pillar(
+                tgt="I@opencontrail:control:role:primary",
+                pillar="_param:opencontrail_router01_address")
+            public_network = "192.168.200.0"
+            contrail_commands = [
+                {
+                    'description': "Iproute to vsrx router",
+                    'node_name': self.target_name,
+                    'cmd': ("set -ex; ip route replace " +
+                            public_network + "/24 via " + vsrx_router)},
+                {
+                    'description': "Align security group: remove all rules",
+                    'node_name': self.target_name,
+                    'cmd': ("set -ex;" +
+                            "salt 'ctl01*' cmd.run '. /root/keystonercv3; " +
+                            "openstack security group rule list --column ID " +
+                            "-f value | xargs " +
+                            "openstack security group rule delete|true';")},
+                {
+                    'description': "Align security group: remove all default",
+                    'node_name': self.target_name,
+                    'cmd': ("set -ex;" +
+                            " salt ctl01* cmd.run '. /root/keystonercv3; " +
+                            "openstack security group " +
+                            "list --column ID --column Name -f value|" +
+                            "grep default|cut -d \" \" -f 1|" +
+                            "xargs openstack security group delete|true'")},
+                {
+                    'description': "Align security group: add rules",
+                    'node_name': self.target_name,
+                    'cmd': ("set -ex;" +
+                            "salt 'ctl01*' cmd.run '. /root/keystonercv3; " +
+                            "openstack security group rule create default " +
+                            "--egress --protocol tcp'; " +
+                            "salt 'ctl01*' cmd.run '. /root/keystonercv3; " +
+                            "openstack security group rule create default " +
+                            "--ingress --protocol tcp'; " +
+                            "salt 'ctl01*' cmd.run '. /root/keystonercv3; " +
+                            "openstack security group rule create default " +
+                            "--egress --protocol icmp'; " +
+                            "salt 'ctl01*' cmd.run '. /root/keystonercv3; " +
+                            "openstack security group rule create default " +
+                            "--ingress --protocol icmp'; ")},
+                {
+                    'description': "Create public network with target",
+                    'node_name': self.target_name,
+                    'cmd': ("set -ex;" +
+                            "salt -C 'I@opencontrail:control:role:primary' " +
+                            "contrail.virtual_network_create public " +
+                            "'{\"external\":true,\"ip_prefix\":\"" +
+                            public_network + "\",\"ip_prefix_len\":24," +
+                            "\"asn\":64512,\"target\":10000}'")},
+            ]
+            commands = contrail_commands + commands
+
         if barbican_integration:
             commands.append({
                 'description': "Configure barbican",
diff --git a/tcp_tests/templates/cookied-cicd-bm-os-contrail40-maas/lab04-physical-inventory.yaml b/tcp_tests/templates/cookied-cicd-bm-os-contrail40-maas/lab04-physical-inventory.yaml
index 27b5d25..e2788ce 100644
--- a/tcp_tests/templates/cookied-cicd-bm-os-contrail40-maas/lab04-physical-inventory.yaml
+++ b/tcp_tests/templates/cookied-cicd-bm-os-contrail40-maas/lab04-physical-inventory.yaml
@@ -18,12 +18,12 @@
       - infra_kvm
       - linux_system_codename_xenial
       interfaces:
-        enp9s0f0:
-          role: single_dhcp
-        enp9s0f1:
-          role: bond0_ab_ovs_vlan_ctl
-        ens11f0:
-          role: single_mgm_manual
+        enp8s0f0:
+          role: single_mgm_dhcp
+        ens4f1:
+          role: bond_ctl_contrail_lacp
+        ens11f1:
+          role: bond_ctl_contrail_lacp
 
     kvm02.cookied-cicd-bm-os-contrail40-maas.local:
       reclass_storage_name: infra_kvm_node02
@@ -31,12 +31,12 @@
       - infra_kvm
       - linux_system_codename_xenial
       interfaces:
-        enp9s0f0:
-          role: single_dhcp
-        enp9s0f1:
-          role: bond0_ab_ovs_vlan_ctl
-        ens11f0:
-          role: single_mgm_manual
+        enp8s0f0:
+          role: single_mgm_dhcp
+        ens4f1:
+          role: bond_ctl_contrail_lacp
+        ens11f1:
+          role: bond_ctl_contrail_lacp
 
     kvm03.cookied-cicd-bm-os-contrail40-maas.local:
       reclass_storage_name: infra_kvm_node03
@@ -44,12 +44,54 @@
       - infra_kvm
       - linux_system_codename_xenial
       interfaces:
-        enp9s0f0:
-          role: single_dhcp
-        enp9s0f1:
-          role: bond0_ab_ovs_vlan_ctl
-        ens11f0:
-          role: single_mgm_manual
+        enp8s0f0:
+          role: single_mgm_dhcp
+        ens4f1:
+          role: bond_ctl_contrail_lacp
+        ens11f1:
+          role: bond_ctl_contrail_lacp
+
+    kvm04.cookied-cicd-bm-os-contrail40-maas.local:
+      reclass_storage_name: infra_kvm_node04
+      roles:
+      - infra_kvm_wo_gluster
+      - linux_system_codename_xenial
+      - salt_master_host
+      interfaces:
+        enp8s0f0:
+          role: single_mgm_dhcp
+        ens4f1:
+          role: bond_ctl_contrail_lacp
+        ens11f1:
+          role: bond_ctl_contrail_lacp
+
+    kvm05.cookied-cicd-bm-os-contrail40-maas.local:
+      reclass_storage_name: infra_kvm_node05
+      roles:
+      - infra_kvm_wo_gluster
+      - linux_system_codename_xenial
+      - salt_master_host
+      interfaces:
+        enp8s0f0:
+          role: single_mgm_dhcp
+        ens4f1:
+          role: bond_ctl_contrail_lacp
+        ens11f1:
+          role: bond_ctl_contrail_lacp
+
+    kvm06.cookied-cicd-bm-os-contrail40-maas.local:
+      reclass_storage_name: infra_kvm_node06
+      roles:
+      - infra_kvm_wo_gluster
+      - linux_system_codename_xenial
+      - salt_master_host
+      interfaces:
+        enp8s0f0:
+          role: single_mgm_dhcp
+        ens4f1:
+          role: bond_ctl_contrail_lacp
+        ens11f1:
+          role: bond_ctl_contrail_lacp
 
     osd<<count>>:
       reclass_storage_name: ceph_osd_rack01
@@ -57,11 +99,14 @@
       - ceph_osd
       - linux_system_codename_xenial
       interfaces:
-        enp2s0f0:
+        eno1:
           role: single_dhcp
-        enp2s0f1:
-          role: single_vlan_ctl
+        ens1f1:
+          role: bond_ctl_contrail_lacp
+        ens2f1:
+          role: bond_ctl_contrail_lacp
 #          role: bond0_ab_vlan_ceph_storage_backend
+# todo: add storage net for ceph to second lacp bond
 
     cmp<<count>>:
       reclass_storage_name: openstack_compute_rack01
@@ -69,9 +114,13 @@
       - openstack_compute
       - linux_system_codename_xenial
       interfaces:
-        enp2s0f1:
+        eno1:
           role: single_dhcp
-        enp5s0f0:
-          role: bond0_ab_contrail
-        enp5s0f1:
-          role: single_vlan_ctl
+        ens1f0:
+          role: bond_ctl_contrail_lacp
+        ens1f1:
+          role: bond_contrail_lacp
+        ens2f0:
+          role: bond_ctl_contrail_lacp
+        ens2f1:
+          role: bond_contrail_lacp
diff --git a/tcp_tests/templates/cookied-cicd-bm-os-contrail40-maas/salt-context-cookiecutter-contrail.yaml b/tcp_tests/templates/cookied-cicd-bm-os-contrail40-maas/salt-context-cookiecutter-contrail.yaml
index 1a50ff3..5116cd7 100644
--- a/tcp_tests/templates/cookied-cicd-bm-os-contrail40-maas/salt-context-cookiecutter-contrail.yaml
+++ b/tcp_tests/templates/cookied-cicd-bm-os-contrail40-maas/salt-context-cookiecutter-contrail.yaml
@@ -103,6 +103,15 @@
   infra_kvm03_control_address: 10.167.8.243
   infra_kvm03_deploy_address: 172.16.49.69
   infra_kvm03_hostname: kvm03
+  infra_kvm04_control_address: 10.167.8.244
+  infra_kvm04_deploy_address: 172.16.49.70
+  infra_kvm04_hostname: kvm04
+  infra_kvm05_control_address: 10.167.8.245
+  infra_kvm05_deploy_address: 172.16.49.71
+  infra_kvm05_hostname: kvm05
+  infra_kvm06_control_address: 10.167.8.246
+  infra_kvm06_deploy_address: 172.16.49.72
+  infra_kvm06_hostname: kvm06
   infra_kvm_vip_address: 10.167.8.240
   infra_primary_first_nic: eth1
   infra_primary_second_nic: eth2
@@ -116,139 +125,188 @@
   maas_deploy_cidr: 172.16.49.64/26
   maas_deploy_gateway: 172.16.49.65
   maas_deploy_range_end: 172.16.49.119
-  maas_deploy_range_start: 172.16.49.77
+  maas_deploy_range_start: 172.16.49.78
   maas_deploy_vlan: '0'
   maas_dhcp_enabled: 'True'
   maas_fabric_name: fabric-0
   maas_hostname: cfg01
   maas_manage_deploy_network: 'True'
   maas_machines: |
-        kvm01: # cz7341-kvm.host-telecom.com
+        kvm01: # cz8062-kvm.host-telecom.com
           distro_series: "xenial"
           # hwe_kernel: "hwe-16.04"
           # pxe_interface_mac:
-          pxe_interface_mac: "0c:c4:7a:6c:83:56"
+          pxe_interface_mac: "0c:c4:7a:a8:d3:44"
           interfaces:
-            enp9s0f0:
-              mac: "0c:c4:7a:6c:83:56"
+            enp8s0f0:
+              mac: "0c:c4:7a:a8:d3:44"
               mode: "static"
               ip: "172.16.49.67"
               subnet: ${maas:region:subnets:deploy_network:cidr} # create it manually... in UI
               gateway: ${_param:deploy_network_gateway}
           power_parameters:
-            power_address: "5.43.225.117"
+            power_address: "5.43.227.106"
             power_pass: ==IPMI_PASS==
             power_type: ipmi
             power_user: ==IPMI_USER==
-        kvm02: # #cz7342-kvm.host-telecom.com
+        kvm02: # #cz8063-kvm.host-telecom.com
           distro_series: "xenial"
           # hwe_kernel: "hwe-16.04"
-          pxe_interface_mac: "0c:c4:7a:6c:84:2c"
+          pxe_interface_mac: "0c:c4:7a:a8:b8:18"
           interfaces:
-            enp9s0f0:
-              mac: "0c:c4:7a:6c:84:2c"
+            enp8s0f0:
+              mac: "0c:c4:7a:a8:b8:18"
               mode: "static"
               ip: "172.16.49.68"
               subnet: ${maas:region:subnets:deploy_network:cidr} # create it manually... in UI
               gateway: ${_param:deploy_network_gateway}
           power_parameters:
-            power_address: "5.43.225.118"
+            power_address: "5.43.227.107"
             power_pass: ==IPMI_PASS==
             power_type: ipmi
             power_user: ==IPMI_USER==
-        kvm03: # #cz7343-kvm.host-telecom.com
+        kvm03: # #cz8064-kvm.host-telecom.com
           distro_series: "xenial"
           # hwe_kernel: "hwe-16.04"
-          pxe_interface_mac: "0c:c4:7a:6c:83:54"
+          pxe_interface_mac: "0c:c4:7a:a8:d0:40"
           interfaces:
-            enp9s0f0:
-              mac: "0c:c4:7a:6c:83:54"
+            enp8s0f0:
+              mac: "0c:c4:7a:a8:d0:40"
               mode: "static"
               ip: "172.16.49.69"
               subnet: ${maas:region:subnets:deploy_network:cidr} # create it manually... in UI
               gateway: ${_param:deploy_network_gateway}
           power_parameters:
-            power_address: "5.43.225.119"
+            power_address: "5.43.227.108"
             power_pass: ==IPMI_PASS==
             power_type: ipmi
             power_user: ==IPMI_USER==
-        osd001: # #cz7343-kvm.host-telecom.com
+        kvm04: # cz8065-kvm.host-telecom.com
           distro_series: "xenial"
           # hwe_kernel: "hwe-16.04"
-          pxe_interface_mac: "0c:c4:7a:55:6a:d4"
+          # pxe_interface_mac:
+          pxe_interface_mac: "0c:c4:7a:a8:b8:22"
           interfaces:
-            enp2s0f0:
-              mac: "0c:c4:7a:55:6a:d4"
+            enp8s0f0:
+              mac: "0c:c4:7a:a8:b8:22"
               mode: "static"
               ip: "172.16.49.70"
               subnet: ${maas:region:subnets:deploy_network:cidr} # create it manually... in UI
               gateway: ${_param:deploy_network_gateway}
           power_parameters:
-            power_address: "185.8.59.243"
+            power_address: "5.43.227.110"
             power_pass: ==IPMI_PASS==
             power_type: ipmi
             power_user: ==IPMI_USER==
-        osd002: # #cz7343-kvm.host-telecom.com
+        kvm05: # #cz8066-kvm.host-telecom.com
           distro_series: "xenial"
           # hwe_kernel: "hwe-16.04"
-          pxe_interface_mac: "0c:c4:7a:55:6a:56"
+          pxe_interface_mac: "0c:c4:7a:a8:b8:1a"
           interfaces:
-            enp2s0f0:
-              mac: "0c:c4:7a:55:6a:56"
+            enp8s0f0:
+              mac: "0c:c4:7a:a8:b8:1a"
               mode: "static"
               ip: "172.16.49.71"
               subnet: ${maas:region:subnets:deploy_network:cidr} # create it manually... in UI
               gateway: ${_param:deploy_network_gateway}
           power_parameters:
-            power_address: "185.8.59.244"
+            power_address: "5.43.227.111"
             power_pass: ==IPMI_PASS==
             power_type: ipmi
             power_user: ==IPMI_USER==
-        osd003: # #cz7343-kvm.host-telecom.com
+        kvm06: # #cz8067-kvm.host-telecom.com
           distro_series: "xenial"
           # hwe_kernel: "hwe-16.04"
-          pxe_interface_mac: "0c:c4:7a:55:6a:2a"
+          pxe_interface_mac: "0c:c4:7a:a8:b8:1c"
           interfaces:
-            enp2s0f0:
-              mac: "0c:c4:7a:55:6a:2a"
+            enp8s0f0:
+              mac: "0c:c4:7a:a8:b8:1c"
               mode: "static"
               ip: "172.16.49.72"
               subnet: ${maas:region:subnets:deploy_network:cidr} # create it manually... in UI
               gateway: ${_param:deploy_network_gateway}
           power_parameters:
-            power_address: "185.8.59.245"
+            power_address: "5.43.227.112"
             power_pass: ==IPMI_PASS==
             power_type: ipmi
             power_user: ==IPMI_USER==
-        cmp001: # #cz7345-kvm.host-telecom.com
+        osd001: # #cz5272-kvm.host-telecom.com
           distro_series: "xenial"
           # hwe_kernel: "hwe-16.04"
-          pxe_interface_mac: "0c:c4:7a:54:a2:5f"
+          pxe_interface_mac: "0c:c4:7a:aa:51:f8"
           interfaces:
-            enp2s0f1:
-              mac: "0c:c4:7a:54:a2:5f"
+            eno1:
+              mac: "0c:c4:7a:aa:51:f8"
               mode: "static"
               ip: "172.16.49.73"
               subnet: ${maas:region:subnets:deploy_network:cidr} # create it manually... in UI
               gateway: ${_param:deploy_network_gateway}
           power_parameters:
-            power_address: "185.8.59.233"
+            power_address: "5.43.225.182"
             power_pass: ==IPMI_PASS==
             power_type: ipmi
             power_user: ==IPMI_USER==
-        cmp002: # cz7346-kvm.host-telecom.com
+        osd002: # #cz7857-kvm.host-telecom.com
           distro_series: "xenial"
           # hwe_kernel: "hwe-16.04"
-          pxe_interface_mac: "0c:c4:7a:54:a0:51"
+          pxe_interface_mac: "0c:c4:7a:6d:3a:80"
           interfaces:
-            enp2s0f1:
-              mac: "0c:c4:7a:54:a0:51"
+            eno1:
+              mac: "0c:c4:7a:6d:3a:80"
               mode: "static"
               ip: "172.16.49.74"
               subnet: ${maas:region:subnets:deploy_network:cidr} # create it manually... in UI
               gateway: ${_param:deploy_network_gateway}
           power_parameters:
-            power_address: "185.8.59.232"
+            power_address: "5.43.225.199"
+            power_pass: ==IPMI_PASS==
+            power_type: ipmi
+            power_user: ==IPMI_USER==
+        osd003: # #cz7787-kvm.host-telecom.com
+          distro_series: "xenial"
+          # hwe_kernel: "hwe-16.04"
+          pxe_interface_mac: "0c:c4:7a:6b:f7:7a"
+          interfaces:
+            eno1:
+              mac: "0c:c4:7a:6b:f7:7a"
+              mode: "static"
+              ip: "172.16.49.75"
+              subnet: ${maas:region:subnets:deploy_network:cidr} # create it manually... in UI
+              gateway: ${_param:deploy_network_gateway}
+          power_parameters:
+            power_address: "5.43.225.123"
+            power_pass: ==IPMI_PASS==
+            power_type: ipmi
+            power_user: ==IPMI_USER==
+        cmp001: # #cz7987-kvm.host-telecom.com
+          distro_series: "xenial"
+          # hwe_kernel: "hwe-16.04"
+          pxe_interface_mac: "0c:c4:7a:a8:72:ac"
+          interfaces:
+            eno1:
+              mac: "0c:c4:7a:a8:72:ac"
+              mode: "static"
+              ip: "172.16.49.76"
+              subnet: ${maas:region:subnets:deploy_network:cidr} # create it manually... in UI
+              gateway: ${_param:deploy_network_gateway}
+          power_parameters:
+            power_address: "5.43.225.181"
+            power_pass: ==IPMI_PASS==
+            power_type: ipmi
+            power_user: ==IPMI_USER==
+        cmp002: # cz7842-kvm.host-telecom.com
+          distro_series: "xenial"
+          # hwe_kernel: "hwe-16.04"
+          pxe_interface_mac: "0c:c4:7a:6d:3a:c6"
+          interfaces:
+            eno1:
+              mac: "0c:c4:7a:6d:3a:c6"
+              mode: "static"
+              ip: "172.16.49.77"
+              subnet: ${maas:region:subnets:deploy_network:cidr} # create it manually... in UI
+              gateway: ${_param:deploy_network_gateway}
+          power_parameters:
+            power_address: "5.43.225.201"
             power_pass: ==IPMI_PASS==
             power_type: ipmi
             power_user: ==IPMI_USER==
@@ -278,7 +336,6 @@
   opencontrail_router01_hostname: rtr01
   opencontrail_router02_address: 10.167.8.101
   opencontrail_router02_hostname: rtr02
-  openldap_enabled: 'False'
   openssh_groups: ''
   openstack_benchmark_node01_address: 10.167.8.95
   openstack_benchmark_node01_hostname: bmk01
@@ -286,7 +343,7 @@
   openstack_compute_count: '2'
   openstack_compute_rack01_hostname: cmp
   openstack_compute_single_address_ranges: 10.167.8.101-10.167.8.102
-  openstack_compute_deploy_address_ranges: 172.16.49.73-172.16.49.74
+  openstack_compute_deploy_address_ranges: 172.16.49.76-172.16.49.77
   openstack_compute_tenant_address_ranges: 10.167.10.101-10.167.10.102
   openstack_compute_backend_address_ranges: 10.167.10.101-10.167.10.102
   openstack_control_address: 10.167.8.10
@@ -397,7 +454,7 @@
 
 # for 2018.11.0+
   ceph_osd_single_address_ranges: "10.167.8.200-10.167.8.202"
-  ceph_osd_deploy_address_ranges: "172.16.49.70-172.16.49.72"
+  ceph_osd_deploy_address_ranges: "172.16.49.73-172.16.49.75"
   ceph_osd_storage_address_ranges: "10.167.8.200-10.167.8.202"
   ceph_osd_backend_address_ranges: "10.167.10.200-10.167.10.202"
 
@@ -442,4 +499,6 @@
   openstack_mysql_x509_enabled: 'True'
   rabbitmq_ssl_enabled: 'True'
   openstack_rabbitmq_x509_enabled: 'True'
-  openstack_internal_protocol: 'https'
\ No newline at end of file
+  openstack_internal_protocol: 'https'
+  cinder_backup_engine: 'ceph'
+  cinder_ceph_backup_pool_name: 'backups'
diff --git a/tcp_tests/templates/cookied-cicd-bm-os-contrail40-maas/underlay.yaml b/tcp_tests/templates/cookied-cicd-bm-os-contrail40-maas/underlay.yaml
index 0a5f4f2..e48b817 100644
--- a/tcp_tests/templates/cookied-cicd-bm-os-contrail40-maas/underlay.yaml
+++ b/tcp_tests/templates/cookied-cicd-bm-os-contrail40-maas/underlay.yaml
@@ -98,7 +98,7 @@
             role: salt_master
             params:
               vcpu: !os_env SLAVE_NODE_CPU, 4
-              memory: !os_env SLAVE_NODE_MEMORY, 12288
+              memory: !os_env SLAVE_NODE_MEMORY, 16384
               boot:
                 - hd
               volumes:
diff --git a/tcp_tests/templates/cookied-model-generator/salt_cookied-cicd-bm-os-contrail40-maas.yaml b/tcp_tests/templates/cookied-model-generator/salt_cookied-cicd-bm-os-contrail40-maas.yaml
index 17ad597..3f8102b 100644
--- a/tcp_tests/templates/cookied-model-generator/salt_cookied-cicd-bm-os-contrail40-maas.yaml
+++ b/tcp_tests/templates/cookied-model-generator/salt_cookied-cicd-bm-os-contrail40-maas.yaml
@@ -23,13 +23,6 @@
 
 {{ SHARED.MACRO_GENERATE_AND_ENABLE_ENVIRONMENT_MODEL() }}
 
-- description: Temporary WR for cinder backend defined by default in reclass.system
-  cmd: |
-    sed -i 's/backend\:\ {}//g' /srv/salt/reclass/classes/system/cinder/control/cluster.yml;
-  node_name: {{ HOSTNAME_CFG01 }}
-  retry: {count: 1, delay: 5}
-  skip_fail: false
-
 - description: Temporary WR for correct bridge name according to envoronment templates
   cmd: |
     sed -i 's/br\-ctl/br\_ctl/g' /srv/salt/reclass/classes/cluster/{{ LAB_CONFIG_NAME }}/infra/kvm.yml;
@@ -58,11 +51,3 @@
   node_name: {{ HOSTNAME_CFG01 }}
   retry: {count: 1, delay: 5}
   skip_fail: false
-
-- description: Temporary workaround !! Fix or debug
-  cmd: |
-    sed -i 's/pg_num: 128/pg_num: 4/g' /srv/salt/reclass/classes/cluster/{{ SHARED.CLUSTER_NAME }}/ceph/setup.yml;
-    sed -i 's/pgp_num: 128/pgp_num: 4/g' /srv/salt/reclass/classes/cluster/{{ SHARED.CLUSTER_NAME }}/ceph/setup.yml;
-  node_name: {{ HOSTNAME_CFG01 }}
-  retry: {count: 1, delay: 5}
-  skip_fail: true