diff --git a/.pre-commit-config.yaml b/.pre-commit-config.yaml
new file mode 100644
index 0000000..2ff8c11
--- /dev/null
+++ b/.pre-commit-config.yaml
@@ -0,0 +1,33 @@
+---
+default_language_version:
+  # force all unspecified python hooks to run python3
+  python: python3
+repos:
+  - repo: https://github.com/pre-commit/pre-commit-hooks
+    rev: v4.5.0
+    hooks:
+      - id: trailing-whitespace
+      - id: mixed-line-ending
+        args: ['--fix', 'lf']
+        exclude: '.*\.(svg)$'
+      - id: check-byte-order-marker
+      - id: check-executables-have-shebangs
+      - id: check-merge-conflict
+      - id: debug-statements
+      - id: check-yaml
+        files: .*\.(yaml|yml)$
+  - repo: https://github.com/lucas-c/pre-commit-hooks
+    rev: v1.5.4
+    hooks:
+      - id: remove-tabs
+        exclude: '.*\.(svg)$'
+  - repo: local
+    hooks:
+      - id: flake8
+        name: flake8
+        additional_dependencies:
+          - hacking>=3.2.0,<3.3.0
+        language: python
+        entry: flake8
+        files: '^.*\.py$'
+        exclude: '^(doc|releasenotes|tools)/.*$'
diff --git a/doc/requirements.txt b/doc/requirements.txt
index 6fe7c34..12d5b68 100644
--- a/doc/requirements.txt
+++ b/doc/requirements.txt
@@ -1,4 +1,4 @@
 reno>=3.1.0 # Apache-2.0
-sphinx>=2.0.0,!=2.1.0 # BSD
+sphinx>=2.2.0 # BSD
 openstackdocstheme>=2.2.1 # Apache-2.0
 
diff --git a/doc/source/conf.py b/doc/source/conf.py
old mode 100755
new mode 100644
index 88b9718..a5d87bb
--- a/doc/source/conf.py
+++ b/doc/source/conf.py
@@ -16,7 +16,10 @@
 import sys
 
 def autodoc_skip_member_handler(app, what, name, obj, skip, options):
-    return skip or (what == "class" and not name.startswith("test"))
+    return skip or (
+        (what == "class" and not name.startswith("test")) or
+        # NOTE(fnordahl): Sphinx does not like the ASCII art in the docstring.
+        (what == 'module' and name == 'NetworkMultipleGWTest'))
 
 def setup(app):
     app.connect('autodoc-skip-member', autodoc_skip_member_handler)
diff --git a/neutron_tempest_plugin/api/admin/test_ports.py b/neutron_tempest_plugin/api/admin/test_ports.py
index e26e122..88c35c6 100644
--- a/neutron_tempest_plugin/api/admin/test_ports.py
+++ b/neutron_tempest_plugin/api/admin/test_ports.py
@@ -65,6 +65,42 @@
         self.assertNotEqual(current_mac, new_mac)
         self.assertTrue(netaddr.valid_mac(new_mac))
 
+    @decorators.idempotent_id('4d75cc60-99d0-4949-b3ce-5826b81aa0a9')
+    @utils.requires_ext(extension="port-trusted-vif",
+                        service="network")
+    def test_port_create_with_trusted_attr_set(self):
+        port = self.admin_client.create_port(
+            network_id=self.network['id'], trusted=True)['port']
+        self.ports.append(port)
+        self.assertTrue(port['trusted'])
+        self.assertTrue(port['binding:profile']['trusted'])
+
+        port = self.admin_client.create_port(
+            network_id=self.network['id'], trusted=False)['port']
+        self.ports.append(port)
+        self.assertFalse(port['trusted'])
+        self.assertFalse(port['binding:profile']['trusted'])
+
+    @decorators.idempotent_id('26c15e2a-55b2-410f-8ed3-84db9406ff3f')
+    @utils.requires_ext(extension="port-trusted-vif",
+                        service="network")
+    def test_port_set_trusted_attr(self):
+        port = self.admin_client.create_port(
+            network_id=self.network['id'])['port']
+        self.ports.append(port)
+        self.assertIsNone(port['trusted'])
+        self.assertNotIn('trusted', port['binding:profile'])
+
+        updated_port = self.admin_client.update_port(
+            port['id'], trusted=True)['port']
+        self.assertTrue(updated_port['trusted'])
+        self.assertTrue(updated_port['binding:profile']['trusted'])
+
+        updated_port = self.admin_client.update_port(
+            port['id'], trusted=False)['port']
+        self.assertFalse(updated_port['trusted'])
+        self.assertFalse(updated_port['binding:profile']['trusted'])
+
 
 class PortTestCasesResourceRequest(base.BaseAdminNetworkTest):
 
diff --git a/neutron_tempest_plugin/api/admin/test_quotas.py b/neutron_tempest_plugin/api/admin/test_quotas.py
index 0cf474e..eb47fa5 100644
--- a/neutron_tempest_plugin/api/admin/test_quotas.py
+++ b/neutron_tempest_plugin/api/admin/test_quotas.py
@@ -87,7 +87,7 @@
         new_quotas = {'network': 0, 'security_group': 0}
 
         # Change quotas for tenant
-        quota_set = self._setup_quotas(tenant_id, **new_quotas)
+        quota_set = self._setup_quotas(tenant_id, force=True, **new_quotas)
         for key, value in new_quotas.items():
             self.assertEqual(value, quota_set[key])
 
@@ -112,6 +112,23 @@
         for q in non_default_quotas['quotas']:
             self.assertNotEqual(tenant_id, q['tenant_id'])
 
+    @decorators.idempotent_id('43d01327-d8be-4773-a8f0-1d2e9664fda2')
+    @decorators.attr(type='gate')
+    @utils.requires_ext(extension='quota-check-limit-default',
+                        service='network')
+    def test_quotas_force_false(self):
+        project_id = self.create_project()['id']
+        self._create_network(project_id)
+
+        new_quotas = {'network': 0}
+        # force=false (by default)
+        self.assertRaises(lib_exc.BadRequest, self.admin_client.update_quotas,
+                          project_id, **new_quotas)
+
+        new_quotas['network'] = 100
+        quota_set = self._setup_quotas(project_id, **new_quotas)
+        self.assertEqual(new_quotas['network'], quota_set['network'])
+
     @decorators.idempotent_id('e974b5ba-090a-452c-a578-f9710151d9fc')
     @decorators.attr(type='gate')
     @utils.requires_ext(extension="quota_details", service="network")
diff --git a/neutron_tempest_plugin/api/admin/test_quotas_negative.py b/neutron_tempest_plugin/api/admin/test_quotas_negative.py
index 9c37d92..2a8e24d 100644
--- a/neutron_tempest_plugin/api/admin/test_quotas_negative.py
+++ b/neutron_tempest_plugin/api/admin/test_quotas_negative.py
@@ -39,6 +39,23 @@
                           self.admin_client.create_network, **net_args)
 
     @decorators.attr(type='negative')
+    @decorators.idempotent_id('9f676a6e-d729-428b-adcd-4de2867c50e6')
+    def test_set_network_quota_lower_than_networks_amount(self):
+        tenant_id = self.create_project()['id']
+        high_quota = 3
+        low_quota = 1
+        new_quotas = {'network': high_quota}
+        self._setup_quotas(tenant_id, **new_quotas)
+        for _ in range(high_quota - 1):
+            self._create_network(tenant_id)
+        # TODO(mblue): remove check_limit=True when it is default
+        new_quotas.update({'network': low_quota, 'check_limit': True})
+
+        self.assertRaises(lib_exc.BadRequest,
+                          self.admin_client.update_quotas,
+                          tenant_id, **new_quotas)
+
+    @decorators.attr(type='negative')
     @decorators.idempotent_id('0b7f99e3-9f77-45ce-9a89-b39a184de618')
     def test_create_subnet_when_quotas_is_full(self):
         tenant_id = self.create_project()['id']
diff --git a/neutron_tempest_plugin/api/base.py b/neutron_tempest_plugin/api/base.py
index b659637..e17cf5e 100644
--- a/neutron_tempest_plugin/api/base.py
+++ b/neutron_tempest_plugin/api/base.py
@@ -531,7 +531,7 @@
 
     @classmethod
     def reserve_subnet_cidr(cls, addr, **ipnetwork_kwargs):
-        """Reserve given subnet CIDR making sure it is not used by create_subnet
+        """Reserve given subnet CIDR making sure it's not used by create_subnet
 
         :param addr: the CIDR address to be reserved
         It can be a str or netaddr.IPNetwork instance
@@ -875,9 +875,10 @@
                                            association['fixed_port_id'])
 
     @classmethod
-    def create_router_interface(cls, router_id, subnet_id):
+    def create_router_interface(cls, router_id, subnet_id, client=None):
         """Wrapper utility that returns a router interface."""
-        interface = cls.client.add_router_interface_with_subnet_id(
+        client = client or cls.client
+        interface = client.add_router_interface_with_subnet_id(
             router_id, subnet_id)
         return interface
 
@@ -1220,6 +1221,16 @@
         client = client or ndp_proxy.get('client') or cls.client
         client.delete_ndp_proxy(ndp_proxy['id'])
 
+    @classmethod
+    def get_loaded_network_extensions(cls):
+        """Return the network service loaded extensions
+
+        :return: list of strings with the alias of the network service loaded
+                 extensions.
+        """
+        body = cls.client.list_extensions()
+        return [net_ext['alias'] for net_ext in body['extensions']]
+
 
 class BaseAdminNetworkTest(BaseNetworkTest):
 
@@ -1350,13 +1361,14 @@
 
     @classmethod
     def create_provider_network(cls, physnet_name, start_segmentation_id,
-                                max_attempts=30):
+                                max_attempts=30, external=False):
         segmentation_id = start_segmentation_id
         for attempts in range(max_attempts):
             try:
                 return cls.create_network(
                     name=data_utils.rand_name('test_net'),
-                    shared=True,
+                    shared=not external,
+                    external=external,
                     provider_network_type='vlan',
                     provider_physical_network=physnet_name,
                     provider_segmentation_id=segmentation_id)
@@ -1454,6 +1466,10 @@
     def _extract_resources(cls, body):
         return body[cls.plural_name]
 
+    @classmethod
+    def _test_resources(cls, resources):
+        return [res for res in resources if res["name"] in cls.resource_names]
+
     def _test_list_sorts(self, direction):
         sort_args = {
             'sort_dir': direction,
@@ -1505,11 +1521,12 @@
             'sort_key': self.field
         }
         body = self.list_method(**sort_args)
-        expected_resources = self._extract_resources(body)
+        total_resources = self._extract_resources(body)
+        expected_resources = self._test_resources(total_resources)
         self.assertNotEmpty(expected_resources)
 
         resources = lister(
-            len(expected_resources), sort_args
+            len(total_resources), sort_args
         )
 
         # finally, compare that the list retrieved in one go is identical to
@@ -1527,9 +1544,11 @@
                 pagination_args['marker'] = resources[-1]['id']
             body = self.list_method(**pagination_args)
             resources_ = self._extract_resources(body)
-            self.assertEqual(1, len(resources_))
+            # Empty resource list can be returned when any concurrent
+            # tests delete them
+            self.assertGreaterEqual(1, len(resources_))
             resources.extend(resources_)
-        return resources
+        return self._test_resources(resources)
 
     @_require_pagination
     @_require_sorting
@@ -1552,8 +1571,10 @@
                 self.plural_name, uri
             )
             resources_ = self._extract_resources(body)
-            self.assertEqual(1, len(resources_))
-            resources.extend(resources_)
+            # Empty resource list can be returned when any concurrent
+            # tests delete them
+            self.assertGreaterEqual(1, len(resources_))
+            resources.extend(self._test_resources(resources_))
 
         # The last element is empty and does not contain 'next' link
         uri = self.get_bare_url(prev_links['next'])
@@ -1570,8 +1591,10 @@
                 self.plural_name, uri
             )
             resources_ = self._extract_resources(body)
-            self.assertEqual(1, len(resources_))
-            resources2.extend(resources_)
+            # Empty resource list can be returned when any concurrent
+            # tests delete them
+            self.assertGreaterEqual(1, len(resources_))
+            resources2.extend(self._test_resources(resources_))
 
         self.assertSameOrder(resources, reversed(resources2))
 
@@ -1591,14 +1614,15 @@
             'sort_key': self.field,
         }
         body = self.list_method(**pagination_args)
-        expected_resources = self._extract_resources(body)
+        total_resources = self._extract_resources(body)
+        expected_resources = self._test_resources(total_resources)
 
         page_size = 2
         pagination_args['limit'] = page_size
 
         prev_links = {}
         resources = []
-        num_resources = len(expected_resources)
+        num_resources = len(total_resources)
         niterations = int(math.ceil(float(num_resources) / page_size))
         for i in range(niterations):
             if prev_links:
@@ -1610,7 +1634,7 @@
             prev_links, body = self.list_client.get_uri_with_links(
                 self.plural_name, uri
             )
-            resources_ = self._extract_resources(body)
+            resources_ = self._test_resources(self._extract_resources(body))
             self.assertGreaterEqual(page_size, len(resources_))
             resources.extend(reversed(resources_))
 
diff --git a/neutron_tempest_plugin/api/test_auto_allocated_topology.py b/neutron_tempest_plugin/api/test_auto_allocated_topology.py
index 4d70bfc..2177402 100644
--- a/neutron_tempest_plugin/api/test_auto_allocated_topology.py
+++ b/neutron_tempest_plugin/api/test_auto_allocated_topology.py
@@ -79,6 +79,14 @@
         body = client.list_networks(name='auto_allocated_network')
         self.networks.extend(body['networks'])
 
+    @decorators.idempotent_id('10e4ecef-4309-4bda-9c4d-192e1b5a5831')
+    def test_check_requirements_for_auto_allocate_net_topology(self):
+        body = self.client.validate_auto_allocated_topology_requirements()
+        topology = body['auto_allocated_topology']
+        self.assertIn('dry-run', topology['id'])
+        self.assertIn('tenant_id', topology)
+        self.assertIn('project_id', topology)
+
     @decorators.idempotent_id('64bc0b02-cee4-11e5-9f3c-080027605a2b')
     def test_get_allocated_net_topology_as_tenant(self):
         resources_before = self._count_topology_resources()
diff --git a/neutron_tempest_plugin/api/test_router_interface_fip.py b/neutron_tempest_plugin/api/test_router_interface_fip.py
index 5d8ab67..dcaa17c 100644
--- a/neutron_tempest_plugin/api/test_router_interface_fip.py
+++ b/neutron_tempest_plugin/api/test_router_interface_fip.py
@@ -83,7 +83,7 @@
                                fip2['revision_number'])
         # NOTE(yamamoto): The status can be updated asynchronously.
         fip2_shown = self.client.show_floatingip(fip2['id'])['floatingip']
-        if 'revision_number' in fip2:
+        if 'revision_number' in fip2_shown:
             self.assertGreaterEqual(fip2_shown['revision_number'],
                                     fip2_updated['revision_number'])
         fip2_shown.pop('status')
diff --git a/neutron_tempest_plugin/api/test_routers.py b/neutron_tempest_plugin/api/test_routers.py
index 66cea78..7758b1a 100644
--- a/neutron_tempest_plugin/api/test_routers.py
+++ b/neutron_tempest_plugin/api/test_routers.py
@@ -329,13 +329,10 @@
 class ExternalGWMultihomingRoutersTest(base_routers.BaseRouterTest):
 
     @classmethod
+    @tutils.requires_ext(extension="external-gateway-multihoming",
+                         service="network")
     def setUpClass(cls):
         super().setUpClass()
-        ext_alias = 'external-gateway-multihoming'
-        try:
-            cls.client.get_extension(ext_alias)
-        except lib_exc.NotFound:
-            raise cls.skipException(f'{ext_alias} extension not available.')
 
     @decorators.idempotent_id('33e9a156-a83f-435f-90ee-1a49dc9c350d')
     def test_create_router_enable_default_route_ecmp(self):
diff --git a/neutron_tempest_plugin/api/test_security_groups.py b/neutron_tempest_plugin/api/test_security_groups.py
index 5e8b18e..6992399 100644
--- a/neutron_tempest_plugin/api/test_security_groups.py
+++ b/neutron_tempest_plugin/api/test_security_groups.py
@@ -281,9 +281,10 @@
     def _set_quota(self, val, resource):
         res_quota = self._get_quota(resource)
         project_id = self.client.project_id
-        self.admin_client.update_quotas(project_id, **{resource: val})
+        self.admin_client.update_quotas(project_id, **{resource: val,
+                                                       'force': True})
         self.addCleanup(self.admin_client.update_quotas,
-                        project_id, **{resource: res_quota})
+                        project_id, **{resource: res_quota, 'force': True})
 
     def _get_quota(self, resource):
         project_id = self.client.project_id
@@ -383,7 +384,8 @@
     def _set_sg_rules_quota(self, val):
         project_id = self.client.project_id
         self.admin_client.update_quotas(project_id,
-                                        **{'security_group_rule': val})
+                                        **{'security_group_rule': val,
+                                           'force': True})
         LOG.info('Trying to update security group rule quota {} '.format(val))
 
     def _get_sg_rules_quota(self):
@@ -435,7 +437,8 @@
         sg_rules_quota = self._get_sg_rules_quota()
         project_id = self.client.project_id
         self.addCleanup(self.admin_client.update_quotas,
-                        project_id, **{'security_group_rule': sg_rules_quota})
+                        project_id, **{'security_group_rule': sg_rules_quota,
+                                       'force': True})
         values = [-1, 0, 10, 2147483647]
         for value in values:
             self._set_sg_rules_quota(value)
diff --git a/neutron_tempest_plugin/api/test_subnets.py b/neutron_tempest_plugin/api/test_subnets.py
index f7a38a4..23574ee 100644
--- a/neutron_tempest_plugin/api/test_subnets.py
+++ b/neutron_tempest_plugin/api/test_subnets.py
@@ -11,7 +11,6 @@
 #    under the License.
 
 import netaddr
-from tempest.common import utils as tutils
 from tempest.lib import decorators
 
 from neutron_tempest_plugin.api import base
@@ -25,8 +24,6 @@
 
     @classmethod
     def resource_setup(cls):
-        if tutils.is_extension_enabled('subnet-external-network', 'network'):
-            cls.list_kwargs['router:external'] = False
         super(SubnetsSearchCriteriaTest, cls).resource_setup()
         net = cls.create_network(network_name='subnet-search-test-net')
         for name in cls.resource_names:
@@ -70,6 +67,8 @@
 
     @decorators.idempotent_id('c0f9280b-9d81-4728-a967-6be22659d4c8')
     def test_list_validation_filters(self):
+        if 'subnet-external-network' in self.get_loaded_network_extensions():
+            self.list_kwargs['router:external'] = False
         self._test_list_validation_filters(self.list_kwargs)
         self._test_list_validation_filters({
             'unknown_filter': 'value'}, filter_is_valid=False)
diff --git a/neutron_tempest_plugin/common/utils.py b/neutron_tempest_plugin/common/utils.py
index c62aa78..6bc290b 100644
--- a/neutron_tempest_plugin/common/utils.py
+++ b/neutron_tempest_plugin/common/utils.py
@@ -132,17 +132,6 @@
         return False
 
 
-def spawn_http_server(ssh_client, port, message):
-    cmd = ("(echo -e 'HTTP/1.1 200 OK\r\n'; echo '%(msg)s') "
-           "| sudo nc -lp %(port)d &" % {'msg': message, 'port': port})
-    ssh_client.exec_command(cmd)
-
-
-def call_url_remote(ssh_client, url):
-    cmd = "curl %s --retry 3 --connect-timeout 2" % url
-    return ssh_client.exec_command(cmd)
-
-
 class StatefulConnection:
     """Class to test connection that should remain opened
 
diff --git a/neutron_tempest_plugin/config.py b/neutron_tempest_plugin/config.py
index a6d5c09..55d9d9e 100644
--- a/neutron_tempest_plugin/config.py
+++ b/neutron_tempest_plugin/config.py
@@ -77,6 +77,12 @@
                default='openstackgate.local',
                help='dns_domain value configured at neutron.conf, which will '
                     'be used for the DNS configuration of the instances'),
+    cfg.BoolOpt('snat_rules_apply_to_nested_networks',
+                default=False,
+                help='Whether SNAT rules apply recursively to all connected '
+                'networks. This is the default behavior for ovs and '
+                'linuxbridge drivers. OVN requires '
+                'ovn_router_indirect_snat=True setting to implement it.'),
 
     # Multicast tests settings
     cfg.StrOpt('multicast_group_range',
diff --git a/neutron_tempest_plugin/scenario/base.py b/neutron_tempest_plugin/scenario/base.py
index 72139de..70cb2dc 100644
--- a/neutron_tempest_plugin/scenario/base.py
+++ b/neutron_tempest_plugin/scenario/base.py
@@ -286,6 +286,7 @@
 
     def setup_network_and_server(self, router=None, server_name=None,
                                  network=None, use_stateless_sg=False,
+                                 create_fip=True, router_client=None,
                                  **kwargs):
         """Create network resources and a server.
 
@@ -309,7 +310,8 @@
         self.security_groups.append(secgroup['security_group'])
         if not router:
             router = self.create_router_by_client(**kwargs)
-        self.create_router_interface(router['id'], self.subnet['id'])
+        self.create_router_interface(router['id'], self.subnet['id'],
+                                     client=router_client)
         self.keypair = self.create_keypair()
         self.create_loginable_secgroup_rule(
             secgroup_id=secgroup['security_group']['id'])
@@ -331,9 +333,11 @@
         self.port = self.client.list_ports(network_id=self.network['id'],
                                            device_id=self.server[
                                                'server']['id'])['ports'][0]
-        self.fip = self.create_floatingip(port=self.port)
 
-    def check_connectivity(self, host, ssh_user=None, ssh_key=None,
+        if create_fip:
+            self.fip = self.create_floatingip(port=self.port)
+
+    def check_connectivity(self, host=None, ssh_user=None, ssh_key=None,
                            servers=None, ssh_timeout=None, ssh_client=None):
         # Either ssh_client or ssh_user+ssh_key is mandatory.
         if ssh_client is None:
@@ -696,3 +700,8 @@
         except exceptions.SSHScriptFailed:
             raise self.skipException(
                 "%s is not available on server %s" % (cmd, server['id']))
+
+
+class BaseAdminTempestTestCase(base_api.BaseAdminNetworkTest,
+                               BaseTempestTestCase):
+    pass
diff --git a/neutron_tempest_plugin/scenario/test_floatingip.py b/neutron_tempest_plugin/scenario/test_floatingip.py
index f222396..9b7bfcc 100644
--- a/neutron_tempest_plugin/scenario/test_floatingip.py
+++ b/neutron_tempest_plugin/scenario/test_floatingip.py
@@ -18,7 +18,6 @@
 import ddt
 from neutron_lib import constants as lib_constants
 from neutron_lib.services.qos import constants as qos_consts
-from neutron_lib.utils import test
 from oslo_log import log
 from tempest.common import utils
 from tempest.common import waiters
@@ -147,7 +146,6 @@
 
     same_network = True
 
-    @test.unstable_test("bug 1717302")
     @decorators.idempotent_id('05c4e3b3-7319-4052-90ad-e8916436c23b')
     @ddt.unpack
     @ddt.data({'src_has_fip': True, 'dest_has_fip': True},
@@ -165,7 +163,6 @@
 
     same_network = False
 
-    @test.unstable_test("bug 1717302")
     @decorators.idempotent_id('f18f0090-3289-4783-b956-a0f8ac511e8b')
     @ddt.unpack
     @ddt.data({'src_has_fip': True, 'dest_has_fip': True},
@@ -204,6 +201,60 @@
                                        gateway_external_ip,
                                        servers=[proxy, src_server])
 
+    @decorators.idempotent_id('b911b124-b6cb-449d-83d9-b34f3665741d')
+    @utils.requires_ext(extension='extraroute', service='network')
+    @testtools.skipUnless(
+        CONF.neutron_plugin_options.snat_rules_apply_to_nested_networks,
+        "Backend doesn't enable nested SNAT.")
+    def test_nested_snat_external_ip(self):
+        """Check connectivity to an external IP from a nested network."""
+        gateway_external_ip = self._get_external_gateway()
+
+        if not gateway_external_ip:
+            raise self.skipTest("IPv4 gateway is not configured for public "
+                                "network or public_network_id is not "
+                                "configured")
+        proxy = self._create_server()
+        proxy_client = ssh.Client(proxy['fip']['floating_ip_address'],
+                                  CONF.validation.image_ssh_user,
+                                  pkey=self.keypair['private_key'])
+
+        # Create a nested router
+        router = self.create_router(
+            router_name=data_utils.rand_name('router'),
+            admin_state_up=True)
+
+        # Attach outer subnet to it
+        outer_port = self.create_port(self.network)
+        self.client.add_router_interface_with_port_id(router['id'],
+                                                      outer_port['id'])
+
+        # Attach a nested subnet to it
+        network = self.create_network()
+        subnet = self.create_subnet(network)
+        self.create_router_interface(router['id'], subnet['id'])
+
+        # Set up static routes in both directions
+        self.client.update_extra_routes(
+            self.router['id'],
+            outer_port['fixed_ips'][0]['ip_address'], subnet['cidr'])
+        self.client.update_extra_routes(
+            router['id'], self.subnet['gateway_ip'], '0.0.0.0/0')
+
+        # Create a server inside the nested network
+        src_server = self._create_server(create_floating_ip=False,
+                                         network=network)
+
+        # Validate that it can access external gw ip (via nested snat)
+        src_server_ip = src_server['port']['fixed_ips'][0]['ip_address']
+        ssh_client = ssh.Client(src_server_ip,
+                                CONF.validation.image_ssh_user,
+                                pkey=self.keypair['private_key'],
+                                proxy_client=proxy_client)
+        self.check_remote_connectivity(ssh_client,
+                                       gateway_external_ip,
+                                       servers=[proxy, src_server])
+
 
 class FloatingIPPortDetailsTest(FloatingIpTestCasesMixin,
                                 base.BaseTempestTestCase):
diff --git a/neutron_tempest_plugin/scenario/test_metadata.py b/neutron_tempest_plugin/scenario/test_metadata.py
index af6bd09..26fbab6 100644
--- a/neutron_tempest_plugin/scenario/test_metadata.py
+++ b/neutron_tempest_plugin/scenario/test_metadata.py
@@ -12,7 +12,10 @@
 # License for the specific language governing permissions and limitations
 # under the License.
 
+import base64
 import collections
+import textwrap
+import time
 
 from neutron_lib import constants as nlib_const
 from oslo_log import log as logging
@@ -32,6 +35,8 @@
 Server = collections.namedtuple(
     'Server', ['floating_ip', 'server', 'ssh_client'])
 
+QUERY_MSG = 'Queried the metadata service over IPv6'
+
 
 class MetadataTest(base.BaseTempestTestCase):
 
@@ -86,19 +91,49 @@
                                 security_groups=[self.security_group['id']],
                                 **params)
 
-    def _create_server(self, port, use_advanced_image=False, **params):
+    def _create_server(self, port=None, network_id=None,
+                       use_advanced_image=False, **params):
         if use_advanced_image:
             flavor_ref = CONF.neutron_plugin_options.advanced_image_flavor_ref
             image_ref = CONF.neutron_plugin_options.advanced_image_ref
         else:
             flavor_ref = CONF.compute.flavor_ref
             image_ref = CONF.compute.image_ref
+        if port:
+            networks = [{'port': port['id']}]
+        else:
+            networks = [{'uuid': network_id}]
         return self.create_server(flavor_ref=flavor_ref,
                                   image_ref=image_ref,
                                   key_name=self.keypair['name'],
-                                  networks=[{'port': port['id']}],
+                                  networks=networks,
                                   **params)['server']
 
+    def _get_metadata_query_script(self):
+        sheebang_line = '\n#!/bin/bash'
+        curl_cmd = '\ncurl http://[%(address)s' % {'address':
+                                                   nlib_const.METADATA_V6_IP}
+        ip_cmd = ("%$(ip -6 -br address show scope link up | head -1 | "
+                  "cut -d ' ' -f1)]/openstack/")
+        echo_cmd = '\necho %s' % QUERY_MSG
+        script = '%s%s%s%s' % (sheebang_line, curl_cmd, ip_cmd, echo_cmd)
+        script_clean = textwrap.dedent(script).lstrip().encode('utf8')
+        script_b64 = base64.b64encode(script_clean)
+        return {'user_data': script_b64}
+
+    def _wait_for_metadata_query_msg(self, vm):
+        timeout = 300
+        start_time = int(time.time())
+        while int(time.time()) - start_time < timeout:
+            console_output = self.os_primary.servers_client.get_console_output(
+                vm['id'])['output']
+            pos = console_output.find(QUERY_MSG)
+            if pos > -1:
+                return console_output, pos
+            time.sleep(30)
+        self.fail('Failed to find metadata query message in console log %s' %
+                  console_output)
+
     def _create_ssh_client(self, floating_ip, use_advanced_image=False):
         if use_advanced_image:
             username = CONF.neutron_plugin_options.advanced_image_ssh_user
@@ -134,8 +169,7 @@
             self.network, use_advanced_image=use_advanced_image)
         self.wait_for_server_active(server=vm.server)
         self.wait_for_guest_os_ready(vm.server)
-        self.check_connectivity(host=vm.floating_ip['floating_ip_address'],
-                                ssh_client=vm.ssh_client)
+        self.check_connectivity(ssh_client=vm.ssh_client)
         interface = self._get_primary_interface(vm.ssh_client)
 
         try:
@@ -153,3 +187,27 @@
         except exceptions.SSHExecCommandFailed:
             self._log_console_output()
             self._log_local_network_status()
+
+    @testtools.skipUnless(
+        CONF.neutron_plugin_options.advanced_image_ref or
+        CONF.neutron_plugin_options.default_image_is_advanced,
+        'Advanced image is required to run this test.')
+    @decorators.idempotent_id('7542892a-d132-471c-addb-172dcf888ff6')
+    def test_metadata_ipv6_only_network(self):
+        ipv6_network = self.create_network()
+        ipv6_subnet = self.create_subnet(network=ipv6_network, ip_version=6,
+                                         ipv6_ra_mode="slaac",
+                                         ipv6_address_mode="slaac")
+        if not CONF.neutron_plugin_options.firewall_driver == 'ovn':
+            self.create_router_interface(self.router['id'], ipv6_subnet['id'])
+        use_advanced_image = (
+            not CONF.neutron_plugin_options.default_image_is_advanced)
+        params = self._get_metadata_query_script()
+        params['config_drive'] = True
+        vm = self._create_server(
+            network_id=ipv6_network['id'],
+            use_advanced_image=use_advanced_image, **params)
+        self.wait_for_server_active(server=vm)
+        self.wait_for_guest_os_ready(vm)
+        console_output, pos = self._wait_for_metadata_query_msg(vm)
+        self.assertIn('latest', console_output[pos - 100:])
diff --git a/neutron_tempest_plugin/scenario/test_mtu.py b/neutron_tempest_plugin/scenario/test_mtu.py
index ea62fcf..99c5130 100644
--- a/neutron_tempest_plugin/scenario/test_mtu.py
+++ b/neutron_tempest_plugin/scenario/test_mtu.py
@@ -170,18 +170,12 @@
     networks = []
 
     @classmethod
-    def skip_checks(cls):
-        super(NetworkWritableMtuTest, cls).skip_checks()
-        supported_type_drivers = ['vxlan', 'geneve']
-        if not any(type_driver in supported_type_drivers for type_driver in
-                   config.CONF.neutron_plugin_options.available_type_drivers):
-            raise cls.skipException(
-                "Neither VXLAN nor GENEVE type_driver is enabled")
-
-    @classmethod
     @utils.requires_ext(extension="net-mtu-writable", service="network")
     def resource_setup(cls):
         super(NetworkWritableMtuTest, cls).resource_setup()
+        if cls.is_driver_ovn:
+            raise cls.skipException("East/west icmp fragmentation is not "
+                                    "supported with ML2/OVN")
 
     def _create_setup(self):
         self.admin_client = self.os_admin.network_client
diff --git a/neutron_tempest_plugin/scenario/test_multiple_gws.py b/neutron_tempest_plugin/scenario/test_multiple_gws.py
new file mode 100644
index 0000000..686457d
--- /dev/null
+++ b/neutron_tempest_plugin/scenario/test_multiple_gws.py
@@ -0,0 +1,750 @@
+# Copyright 2023 Canonical
+# All Rights Reserved.
+#
+#    Licensed under the Apache License, Version 2.0 (the "License"); you may
+#    not use this file except in compliance with the License. You may obtain
+#    a copy of the License at
+#
+#         http://www.apache.org/licenses/LICENSE-2.0
+#
+#    Unless required by applicable law or agreed to in writing, software
+#    distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
+#    WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
+#    License for the specific language governing permissions and limitations
+#    under the License.
+import json
+import os
+import subprocess
+import time
+import typing
+
+import netaddr
+import testtools
+
+from tempest.common import utils as tutils
+
+from neutron_tempest_plugin import config
+from neutron_tempest_plugin.scenario import base
+
+from neutron_lib import constants as const
+
+from oslo_log import log
+
+from os_ken.tests.integrated.common import docker_base as ctn_base
+
+from tempest.lib.common.utils import data_utils
+from tempest.lib import decorators
+from tempest.lib import exceptions as lib_exc
+
+CONF = config.CONF
+LOG = log.getLogger(__name__)
+
+
+class FRROCIImage(ctn_base.DockerImage):
+    def __init__(
+        self,
+        daemons: typing.Tuple[str],
+        baseimage: typing.Optional[str] = None,
+        use_existing: bool = False,
+    ):
+        super().__init__(baseimage=baseimage or 'ubuntu:22.04')
+        self.daemons = daemons
+        self.tagname = 'frr-' + '-'.join(daemons)
+        if use_existing and self.exist(self.tagname):
+            return
+
+        workdir = os.path.join(ctn_base.TEST_BASE_DIR, self.tagname)
+        pkgs = ' '.join(('telnet', 'tcpdump', 'frr'))
+        c = ctn_base.CmdBuffer()
+        c << f'FROM {self.baseimage}'
+        c << 'RUN apt-get update'
+        c << f'RUN apt-get install -qy --no-install-recommends {pkgs}'
+        c << 'RUN echo "#!/bin/sh" > /frr'
+        c << 'RUN echo mkdir -p /run/frr >> /frr'
+        c << 'RUN echo chmod 755 /run/frr >> /frr'
+        c << 'RUN echo chown frr:frr /run/frr >> /frr'
+        c << (
+            'RUN echo exec /usr/lib/frr/watchfrr '
+            f'-F traditional {" ".join(self.daemons)}>> /frr'
+        )
+        c << 'RUN chmod +x /frr'
+        c << 'CMD /frr'
+
+        self.cmd.sudo(f'rm -rf {workdir}')
+        self.cmd.execute(f'mkdir -p {workdir}')
+        self.cmd.execute(f"echo '{str(c)}' > {workdir}/Dockerfile")
+        self.build(self.tagname, workdir)
+
+
+class FRRContainer(ctn_base.Container):
+    class veth_info(typing.NamedTuple):
+        bridge_name: str
+        bridge_type: str
+        ctn_ifname: str
+        host_ifname: str
+
+    _veths: typing.List[veth_info]
+
+    class route(typing.NamedTuple):
+        dst: netaddr.IPNetwork
+        next_hop: netaddr.IPNetwork
+
+    _ctn_routes: typing.List[route]
+
+    def __init__(
+        self,
+        name: str,
+        image: FRROCIImage,
+    ):
+        self._veths = []
+        self._ctn_routes = []
+        super().__init__(name, image.tagname)
+
+    # XXX upstream to os-ken
+    def next_if_name(self) -> str:
+        name = 'eth{0}'.format(len(self.eths))
+        self.eths.append(name)
+        return name
+
+    # XXX upstream to os-ken
+    def run(self, network: typing.Optional[str] = None) -> int:
+        c = ctn_base.CmdBuffer(' ')
+        c << "docker run --privileged=true"
+        for sv in self.shared_volumes:
+            c << "-v {0}:{1}".format(sv[0], sv[1])
+        if network:
+            c << "--network {0}".format(network)
+        c << "--name {0} --hostname {0} -id {1}".format(
+            self.docker_name(), self.image
+        )
+        self.id = self.dcexec(str(c), retry=True)
+        self.is_running = True
+        self.exec_on_ctn("ip li set up dev lo")
+        ipv4 = None
+        ipv6 = None
+        if network and network != 'none':
+            ifname = self.next_if_name()
+            for line in self.exec_on_ctn(f"ip a show dev {ifname}").split(
+                '\n'
+            ):
+                if line.strip().startswith("inet "):
+                    elems = [e.strip() for e in line.strip().split(' ')]
+                    ipv4 = elems[1]
+                elif line.strip().startswith("inet6 "):
+                    elems = [e.strip() for e in line.strip().split(' ')]
+                    ipv6 = elems[1]
+            self.set_addr_info(
+                bridge='docker0', ipv4=ipv4, ipv6=ipv6, ifname=ifname
+            )
+        return 0
+
+    def wait_for_frr_daemons_up(
+        self,
+        try_times: int = 30,
+        interval: int = 1,
+    ) -> ctn_base.CommandOut:
+        return self.cmd.sudo(
+            f'docker logs {self.docker_name()} '
+            '|grep "WATCHFRR.*all daemons up"',
+            try_times=try_times,
+            interval=interval,
+        )
+
+    @staticmethod
+    def hash_ifname(ifname: str) -> str:
+        # Assuming IFNAMSIZ of 16, with null-termination gives 15 characters.
+        return 'veth' + str(hash(ifname) % 10**11)
+
+    @staticmethod
+    def get_if_mac(ifname: str) -> netaddr.EUI:
+        with open(f'/sys/class/net/{ifname}/address') as faddr:
+            return faddr.readline().rstrip()
+
+    def add_veth_to_bridge(
+        self,
+        bridge_name: str,
+        bridge_type: str,
+        ipv4_cidr: str,
+        ipv6_cidr: str,
+        ipv6_prefix: typing.Optional[netaddr.IPNetwork] = None,
+        vlan: typing.Optional[int] = None,
+    ) -> None:
+        assert self.is_running, (
+            'the container must be running before '
+            'calling add_veth_to_bridge'
+        )
+        assert (
+            bridge_type == ctn_base.BRIDGE_TYPE_OVS
+        ), f'bridge_type must be {ctn_base.BRIDGE_TYPE_OVS}'
+        veth_pair = (
+            self.hash_ifname(f'{self.name}-int{len(self._veths)}'),
+            self.hash_ifname(f'{self.name}-ext{len(self._veths)}'),
+        )
+        self.cmd.sudo(
+            f'ip link add {veth_pair[0]} type veth peer name {veth_pair[1]}'
+        )
+        if ipv6_prefix and not ipv6_cidr:
+            eui = netaddr.EUI(self.get_if_mac(veth_pair[0]))
+            ipv6_cidr = (
+                f'{eui.ipv6(ipv6_prefix.first)}/{ipv6_prefix.prefixlen}'
+            )
+
+        self.cmd.sudo(f'ip link set netns {self.get_pid()} dev {veth_pair[0]}')
+        self.cmd.sudo(f'ovs-vsctl add-port {bridge_name} {veth_pair[1]}')
+        if vlan:
+            self.cmd.sudo(f'ovs-vsctl set port {veth_pair[1]} tag={vlan}')
+
+        ifname = self.next_if_name()
+        self.exec_on_ctn(f'ip link set name {ifname} {veth_pair[0]}')
+
+        # Ensure IPv6 is not disabled in container
+        self.exec_on_ctn('sysctl -w net.ipv6.conf.all.disable_ipv6=0')
+
+        for cidr in (ipv4_cidr, ipv6_cidr):
+            if not cidr:
+                continue
+            self.exec_on_ctn(f'ip addr add {cidr} dev {ifname}')
+        self.exec_on_ctn(f'ip link set up dev {ifname}')
+        self.cmd.sudo(f'ip link set up dev {veth_pair[1]}')
+        self.set_addr_info(
+            bridge_name, ipv4=ipv4_cidr, ipv6=ipv6_cidr, ifname=ifname
+        )
+        self._veths.append(
+            self.veth_info(
+                bridge_name=bridge_name,
+                bridge_type=bridge_type,
+                ctn_ifname=ifname,
+                host_ifname=veth_pair[1],
+            )
+        )
+
+    def add_ctn_route(self, route: route) -> None:
+        self.exec_on_ctn(
+            f'ip -{route.dst.version} route add '
+            f'{str(route.dst.cidr)} via {str(route.next_hop.ip)}'
+        )
+        self._ctn_routes.append(route)
+
+    def del_ctn_route(self, route: route) -> None:
+        self.exec_on_ctn(
+            f'ip -{route.dst.version} route del '
+            f'{str(route.dst.cidr)} via {str(route.next_hop.ip)}'
+        )
+        self._ctn_routes.remove(route)
+
+    def remove(self, check_exist=True) -> ctn_base.CommandOut:
+        for veth in self._veths:
+            # The veth pair itself will be destroyed as a side effect of
+            # removing the container, so we only need to clean up the bridge
+            # attachment.
+            if veth.bridge_type == ctn_base.BRIDGE_TYPE_BRCTL:
+                self.cmd.sudo(
+                    'brctl delif ' f'{veth.bridge_name} ' f'{veth.host_ifname}'
+                )
+            elif veth.bridge_type == ctn_base.BRIDGE_TYPE_OVS:
+                self.cmd.sudo(
+                    'ovs-vsctl del-port '
+                    f'{veth.bridge_name} '
+                    f'{veth.host_ifname}'
+                )
+        super().remove(check_exist=check_exist)
+
+    def vtysh(self, cmd: typing.List[str]) -> ctn_base.CommandOut:
+        cmd_str = ' '.join(f"-c '{c}'" for c in cmd)
+        return self.exec_on_ctn(f'vtysh {cmd_str}', capture=True)
+
+
+class BFDContainer(FRRContainer):
+    def __init__(
+        self,
+        name: str,
+        image: typing.Optional[FRROCIImage] = None,
+    ):
+        image = image or FRROCIImage(
+            daemons=('zebra', 'bfdd'), use_existing=True
+        )
+        super().__init__(name, image)
+        assert 'bfdd' in image.daemons
+
+    def add_bfd_peer(self, ip_address: str) -> None:
+        self.vtysh(
+            [
+                'enable',
+                'conf',
+                'bfd',
+                f'peer {ip_address} interface eth0',
+            ]
+        )
+
+    def del_bfd_peer(self, ip_address: str) -> None:
+        self.vtysh(
+            [
+                'enable',
+                'conf',
+                'bfd',
+                f'no peer {ip_address} interface eth0',
+            ]
+        )
+
+    def show_bfd_peer(self, peer: str) -> typing.Dict[str, typing.Any]:
+        return json.loads(self.vtysh([f'show bfd peer {peer} json']))
+
+    def wait_for_bfd_peer_status(
+        self, peer: str, status: str, try_times=30, interval=1
+    ) -> None:
+        while try_times:
+            peer_data = self.show_bfd_peer(peer)
+            if peer_data['status'] == status:
+                return
+            time.sleep(interval)
+            try_times -= 1
+        raise lib_exc.TimeoutException
+
+
+class NetworkMultipleGWTest(base.BaseAdminTempestTestCase):
+    """Test the following topology
+
+    +------------------------------------------------------------------+
+    |                          test runner                             |
+    |                                                                  |
+    |                                 +-----------+ eth0 public VLAN N |
+    | +-------- br-ex ----------+     | FRR w/BFD |                    |
+    | | +---------------------+ |     +-----------+ eth1 public flat   |
+    | | |   public physnet    | |     +-----------+ eth0 public VLAN N |
+    | | +---------------------+ |     | FRR w/BFD |                    |
+    | +-------------------------+     +-----------+ eth1 public flat   |
+    |     |              |                                             |
+    +-----|--------------|---------------------------------------------+
+          | -  VLAN N  - |
+     +-------------------------+
+     |      project router     | - enable_default_route_{bfd,ecmp}=True
+     +-------------------------+
+                 |
+           +----------+
+           | instance |
+           +----------+
+
+    NOTE(fnordahl) At the time of writing, FRR provides a BFD daemon, but has
+    not integrated it with static routes [0][1].  As a consequence the
+    test will manually add/remove routes on test runner to ensure correct path
+    is chosen for traffic from test runner to instance.  On the return path the
+    BFD implementation in OVN will ensure the correct path is chosen
+    automatically.
+
+    In real world usage most vendors have BFD support for static routes.
+
+    0: https://github.com/FRRouting/frr/wiki/Feature-Requests
+    1: https://github.com/FRRouting/frr/issues/3369
+    """
+    class host_route(typing.NamedTuple):
+        dst: netaddr.IPNetwork
+        next_hop: netaddr.IPNetwork
+
+    host_routes: typing.List[host_route] = []
+
+    credentials = ['primary', 'admin']
+
+    @classmethod
+    def setup_clients(cls):
+        super().setup_clients()
+        if not cls.admin_client:
+            cls.admin_client = cls.os_admin.network_client
+
+    @classmethod
+    @tutils.requires_ext(extension="external-gateway-multihoming",
+                         service="network")
+    def resource_setup(cls):
+        super().resource_setup()
+
+        # Ensure devstack configured public subnets are recorded, so that we
+        # don't attempt to use them again.
+        cls.reserve_external_subnet_cidrs()
+
+        # We need to know prefixlength of the devstack configured public
+        # subnets.
+        for subnet_id in cls.admin_client.show_network(
+                CONF.network.public_network_id)['network']['subnets']:
+            subnet = cls.admin_client.show_subnet(subnet_id)['subnet']
+            if subnet['ip_version'] == 4:
+                cls.public_ipv4_subnet = subnet
+                continue
+            cls.public_ipv6_subnet = subnet
+        cls.ext_networks = []
+        for n in range(0, 2):
+            ext_network = cls.create_provider_network(
+                physnet_name='public',
+                start_segmentation_id=4040 + n,
+                external=True,
+            )
+            ext_ipv6_subnet = cls.create_subnet(
+                ext_network,
+                ip_version=const.IP_VERSION_6,
+                client=cls.admin_client,
+            )
+            ext_ipv4_subnet = cls.create_subnet(
+                ext_network,
+                ip_version=const.IP_VERSION_4,
+                client=cls.admin_client,
+            )
+            cls.ext_networks.append(
+                (ext_network, ext_ipv6_subnet, ext_ipv4_subnet)
+            )
+        cls.host_routes = []
+        cls.resource_setup_container()
+
+    @classmethod
+    def resource_setup_container(cls):
+        cls.containers = []
+        for n in range(0, 2):
+            ext_network, ext_ipv6_subnet, ext_ipv4_subnet = cls.ext_networks[n]
+
+            # frr container
+            bfd_container = BFDContainer(data_utils.rand_name('frr'))
+            cls.containers.append(bfd_container)
+
+            bfd_container.run(network='none')
+            public_ipv6_net = netaddr.IPNetwork(cls.public_ipv6_subnet['cidr'])
+            public_ipv4_net = netaddr.IPNetwork(cls.public_ipv4_subnet['cidr'])
+            ipv6_net = netaddr.IPNetwork(ext_ipv6_subnet['cidr'])
+            ipv4_net = netaddr.IPNetwork(ext_ipv4_subnet['cidr'])
+            # reserve an IP for container on the public network for routing
+            # into the vlan network.
+            fip_address = cls.create_floatingip()['floating_ip_address']
+            cls.veths = [
+                bfd_container.add_veth_to_bridge(
+                    'br-ex',
+                    ctn_base.BRIDGE_TYPE_OVS,
+                    f'{ext_ipv4_subnet["gateway_ip"]}/{ipv4_net.prefixlen}',
+                    f'{ext_ipv6_subnet["gateway_ip"]}/{ipv6_net.prefixlen}',
+                    vlan=ext_network['provider:segmentation_id'],
+                ),
+                bfd_container.add_veth_to_bridge(
+                    'br-ex',
+                    ctn_base.BRIDGE_TYPE_OVS,
+                    f'{fip_address}/{public_ipv4_net.prefixlen}',
+                    '',
+                    ipv6_prefix=public_ipv6_net,
+                ),
+            ]
+            for subnet in (cls.public_ipv4_subnet, cls.public_ipv6_subnet):
+                bfd_container.exec_on_ctn(
+                    f'ip -{subnet["ip_version"]} route add default '
+                    f'via {subnet["gateway_ip"]} dev eth1'
+                )
+            for ip_version in (6, 4):
+                for addr_info in bfd_container.get_addr_info(
+                    'br-ex', ip_version
+                ).items():
+                    if addr_info[1] == 'eth1':
+                        if ip_version == 6:
+                            dst_subnet = ext_ipv6_subnet
+                        else:
+                            dst_subnet = ext_ipv4_subnet
+                        cls.add_host_route(
+                            cls.host_routes,
+                            cls.host_route(
+                                netaddr.IPNetwork(dst_subnet["cidr"]),
+                                netaddr.IPNetwork(addr_info[0]),
+                            ),
+                        )
+            bfd_container.wait_for_frr_daemons_up()
+
+    @classmethod
+    def resource_cleanup(cls):
+        # Ensure common cleanup code can clean up resources created by admin
+        cls.client = cls.admin_client
+        super().resource_cleanup()
+        for ctn in cls.containers:
+            try:
+                ctn.stop()
+            except ctn_base.CommandError:
+                pass
+            ctn.remove()
+        # NOTE(fnordahl): the loop body modifies the list, so we need to
+        # iterate on a copy.
+        for route in cls.host_routes.copy():
+            cls.del_host_route(cls.host_routes, route)
+
+    @staticmethod
+    def add_host_route(
+        lst: typing.List[host_route],
+        route: host_route
+    ) -> None:
+        subprocess.run(
+            (
+                'sudo',
+                'ip',
+                f'-{route.dst.version}',
+                'route',
+                'add',
+                str(route.dst.cidr),
+                'via',
+                str(route.next_hop.ip),
+            ),
+            capture_output=True,
+            check=True,
+            universal_newlines=True,
+        )
+        lst.append(route)
+
+    @staticmethod
+    def del_host_route(
+        lst: typing.List[host_route],
+        route: host_route
+    ) -> None:
+        subprocess.run(
+            (
+                'sudo',
+                'ip',
+                f'-{route.dst.version}',
+                'route',
+                'del',
+                str(route.dst.cidr),
+                'via',
+                str(route.next_hop.ip),
+            ),
+            capture_output=True,
+            check=True,
+            universal_newlines=True,
+        )
+        lst.remove(route)
+
+    def add_ctn_route(
+        self,
+        ctn: BFDContainer,
+        dst: netaddr.IPNetwork,
+        next_hop: netaddr.IPNetwork,
+    ):
+        ctn_route = ctn.route(dst, next_hop)
+        ctn.add_ctn_route(ctn_route)
+        self.per_test_ctn_routes.append((ctn, ctn_route))
+
+    def setUp(self):
+        super().setUp()
+        self.per_test_host_routes = []
+        self.per_test_ctn_routes = []
+
+    def tearDown(self):
+        super().tearDown()
+        # NOTE(fnordahl): the loop body modifies the list, so we need to
+        # iterate on a copy.
+        for ctn_route in self.per_test_ctn_routes.copy():
+            ctn = ctn_route[0]
+            route = ctn_route[1]
+            ctn.del_ctn_route(route)
+        for host_route in self.per_test_host_routes.copy():
+            self.del_host_route(self.per_test_host_routes, host_route)
+
+    def add_routes_for_router(
+        self,
+        router: typing.Dict[str, typing.Any],
+        ctn: FRRContainer,
+        add_ctn_route: bool = True,
+        add_host_route: bool = True,
+    ):
+        for port in self.admin_client.list_router_interfaces(router['id'])[
+            'ports'
+        ]:
+            if port['device_owner'] != const.DEVICE_OWNER_ROUTER_INTF:
+                continue
+            for fixed_ip in port['fixed_ips']:
+                subnet = self.client.show_subnet(
+                    fixed_ip['subnet_id'])['subnet']
+                for addr_info in ctn.get_addr_info(
+                    'br-ex',
+                    subnet['ip_version'],
+                ).items():
+                    if addr_info[1] == 'eth0':
+                        # container route
+                        ctn_net = netaddr.IPNetwork(addr_info[0])
+                        for gw_info in router['external_gateways']:
+                            for ip_info in gw_info['external_fixed_ips']:
+                                if (
+                                    ip_info['ip_address'] in ctn_net and
+                                    add_ctn_route
+                                ):
+                                    self.add_ctn_route(
+                                        ctn,
+                                        netaddr.IPNetwork(subnet['cidr']),
+                                        netaddr.IPNetwork(
+                                            ip_info['ip_address']
+                                        ),
+                                    )
+                    elif addr_info[1] == 'eth1' and add_host_route:
+                        self.add_host_route(
+                            self.per_test_host_routes,
+                            self.host_route(
+                                netaddr.IPNetwork(self.subnet['cidr']),
+                                netaddr.IPNetwork(addr_info[0]),
+                            ),
+                        )
+
+    @testtools.skipUnless(
+        CONF.compute.min_compute_nodes == 1,
+        'More than 1 compute node, test only works on '
+        'single node configurations.',
+    )
+    @decorators.idempotent_id('9baa05e6-ba10-4850-93e3-695f4d97b8f8')
+    def test_create_router_single_gw_bfd(self):
+        ext_network_id = self.ext_networks[0][0]['id']
+        bfd_container = self.containers[0]
+        router = self.create_admin_router(
+            router_name=data_utils.rand_name('router'),
+            admin_state_up=True,
+            enable_snat=False,
+            enable_default_route_bfd=True,
+            external_network_id=ext_network_id,
+        )
+        self.assertTrue(router['enable_default_route_bfd'])
+
+        # Add BFD peers on bfd_container.
+        for gw_info in router['external_gateways']:
+            for ip_info in gw_info['external_fixed_ips']:
+                bfd_container.add_bfd_peer(ip_info["ip_address"])
+                bfd_container.wait_for_bfd_peer_status(
+                    ip_info['ip_address'], 'up'
+                )
+
+        self.setup_network_and_server(
+            router=router,
+            create_fip=False,
+            router_client=self.admin_client,
+        )
+
+        self.add_routes_for_router(router, bfd_container)
+
+        # check connectivity
+        self.check_connectivity(
+            self.port['fixed_ips'][0]['ip_address'],
+            CONF.validation.image_ssh_user,
+            self.keypair['private_key'],
+        )
+
+    @testtools.skipUnless(
+        CONF.compute.min_compute_nodes == 1,
+        'More than 1 compute node, test only works on '
+        'single node configurations.',
+    )
+    @decorators.idempotent_id('75202251-c384-4962-8685-60cf2c530906')
+    def test_update_router_single_gw_bfd(self):
+        ext_network_id = self.ext_networks[0][0]['id']
+        bfd_container = self.containers[0]
+        router = self.create_router(
+            router_name=data_utils.rand_name('router'),
+            admin_state_up=True,
+            enable_snat=False,
+            external_network_id=ext_network_id,
+        )
+        self.assertFalse(router['enable_default_route_bfd'])
+
+        self.setup_network_and_server(
+            router=router,
+            create_fip=False,
+            router_client=self.admin_client,
+        )
+
+        self.add_routes_for_router(router, bfd_container)
+
+        # check connectivity
+        self.check_connectivity(
+            self.port['fixed_ips'][0]['ip_address'],
+            CONF.validation.image_ssh_user,
+            self.keypair['private_key'],
+        )
+
+        # Enable BFD on router.
+        #
+        # NOTE(fnordahl): We need to repeat the `enable_snat` state, otherwise
+        # the state will be toggled to the default value of 'True'.
+        router = self.admin_client.update_router_with_snat_gw_info(
+            router['id'],
+            enable_snat=False,
+            enable_default_route_bfd=True,
+        )['router']
+        self.assertTrue(router['enable_default_route_bfd'])
+
+        # Add BFD peers on bfd_container.
+        for gw_info in router['external_gateways']:
+            for ip_info in gw_info['external_fixed_ips']:
+                bfd_container.add_bfd_peer(ip_info["ip_address"])
+                bfd_container.wait_for_bfd_peer_status(
+                    ip_info['ip_address'], 'up'
+                )
+
+        # check connectivity
+        self.check_connectivity(
+            self.port['fixed_ips'][0]['ip_address'],
+            CONF.validation.image_ssh_user,
+            self.keypair['private_key'],
+        )
+
+    @testtools.skipUnless(
+        CONF.compute.min_compute_nodes == 1,
+        'More than 1 compute node, test only works on '
+        'single node configurations.',
+    )
+    @decorators.idempotent_id('5117587d-9633-48b7-aa8f-ec9d59a601a5')
+    def test_create_router_multiple_gw_bfd_and_ecmp(self):
+        router = self.create_admin_router(
+            router_name=data_utils.rand_name('router'),
+            admin_state_up=True,
+            enable_default_route_bfd=True,
+            enable_default_route_ecmp=True,
+        )
+        router = self.admin_client.router_add_external_gateways(
+            router['id'],
+            [
+                {
+                    'network_id': self.ext_networks[0][0]['id'],
+                    'enable_snat': False,
+                },
+                {
+                    'network_id': self.ext_networks[1][0]['id'],
+                    'enable_snat': False,
+                },
+            ],
+        )['router']
+
+        self.setup_network_and_server(
+            router=router,
+            create_fip=False,
+            router_client=self.admin_client,
+        )
+
+        # Add BFD peers on bfd_containers.
+        for gw_info in router['external_gateways']:
+            for ip_info in gw_info['external_fixed_ips']:
+                ip = netaddr.IPAddress(ip_info['ip_address'])
+                for ctn in self.containers:
+                    for addr_info in ctn.get_addr_info(
+                        'br-ex',
+                        ip.version,
+                    ).items():
+                        if addr_info[1] == 'eth0':
+                            ctn_net = netaddr.IPNetwork(addr_info[0])
+                            if ip not in ctn_net:
+                                break
+                            ctn.add_bfd_peer(str(ip))
+                            ctn.wait_for_bfd_peer_status(str(ip), 'up')
+
+        # Add route to project network on all containers.
+        for ctn in self.containers:
+            self.add_routes_for_router(router, ctn, True, False)
+
+        # Add host route to project network via FRR container and confirm
+        # connectivity one by one.
+        #
+        # We deliberately don't add both host routes at once as that would be
+        # testing test runner configuration and linux kernel ECMP, which is out
+        # of scope for our test.
+        for ctn in self.containers:
+            self.add_routes_for_router(router, ctn, False, True)
+
+            # check connectivity
+            self.check_connectivity(
+                self.port['fixed_ips'][0]['ip_address'],
+                CONF.validation.image_ssh_user,
+                self.keypair['private_key'],
+            )
+            for host_route in self.per_test_host_routes.copy():
+                self.del_host_route(self.per_test_host_routes, host_route)
diff --git a/neutron_tempest_plugin/scenario/test_security_groups.py b/neutron_tempest_plugin/scenario/test_security_groups.py
index 03156c7..dc0f5ef 100644
--- a/neutron_tempest_plugin/scenario/test_security_groups.py
+++ b/neutron_tempest_plugin/scenario/test_security_groups.py
@@ -51,37 +51,13 @@
     credentials = ['primary', 'admin']
     required_extensions = ['router', 'security-group']
 
-    def _verify_http_connection(self, ssh_client, ssh_server,
-                                test_ip, test_port, servers, should_pass=True):
-        """Verify if HTTP connection works using remote hosts.
-
-        :param ssh.Client ssh_client: The client host active SSH client.
-        :param ssh.Client ssh_server: The HTTP server host active SSH client.
-        :param string test_ip: IP address of HTTP server
-        :param string test_port: Port of HTTP server
-        :param list servers: List of servers for which console output will be
-                             logged in case when test case
-        :param bool should_pass: Wheter test should pass or not.
-
-        :return: if passed or not
-        :rtype: bool
-        """
-        utils.kill_nc_process(ssh_server)
-        url = 'http://%s:%d' % (test_ip, test_port)
-        utils.spawn_http_server(ssh_server, port=test_port, message='foo_ok')
-        utils.process_is_running(ssh_server, 'nc')
+    def _test_connection_and_log(self, con, *args, **kwargs):
         try:
-            ret = utils.call_url_remote(ssh_client, url)
-            if should_pass:
-                self.assertIn('foo_ok', ret)
-                return
-            self.assertNotIn('foo_ok', ret)
-        except Exception as e:
-            if not should_pass:
-                return
-            self._log_console_output(servers)
+            con.test_connection(*args, **kwargs)
+        except utils.WaitTimeout:
+            self._log_console_output()
             self._log_local_network_status()
-            raise e
+            raise
 
     @classmethod
     def setup_credentials(cls):
@@ -601,7 +577,7 @@
         for port in range(80, 84):
             with utils.StatefulConnection(
                     ssh_clients[0], ssh_clients[2], test_ip, port) as con:
-                con.test_connection(should_pass=False)
+                self._test_connection_and_log(con, should_pass=False)
 
         # add two remote-group rules with port-ranges
         rule_list = [{'protocol': constants.PROTO_NUM_TCP,
@@ -636,7 +612,7 @@
         for port in range(80, 84):
             with utils.StatefulConnection(
                     ssh_clients[0], ssh_clients[2], test_ip, port) as con:
-                con.test_connection()
+                self._test_connection_and_log(con)
 
         # list the tcp rule id by SG id and port-range
         sg_rule_id = self.os_primary.network_client.list_security_group_rules(
@@ -650,7 +626,7 @@
         for port in range(80, 82):
             with utils.StatefulConnection(
                     ssh_clients[0], ssh_clients[2], test_ip, port) as con:
-                con.test_connection(should_pass=False)
+                self._test_connection_and_log(con, should_pass=False)
 
     def _test_overlapping_sec_grp_rules(self):
         """Test security group rules with overlapping port ranges"""
@@ -714,11 +690,11 @@
         for _ in range(2):
             with utils.StatefulConnection(
                     client_ssh[0], srv_ssh, srv_ip, tcp_port) as con:
-                con.test_connection()
+                self._test_connection_and_log(con)
             for port in range(tcp_port, tcp_port + 3):
                 with utils.StatefulConnection(
                         client_ssh[1], srv_ssh, srv_ip, port) as con:
-                    con.test_connection()
+                    self._test_connection_and_log(con)
 
     def _test_remove_sec_grp_from_active_vm(self):
         """Tests the following:
@@ -906,23 +882,23 @@
                 vm_ssh[0], vm_ssh[1], srv_ip, 6666) as con:
             self.client.update_port(srv_port['id'],
                     security_groups=[ssh_sg['id'], sg['id']])
-            con.test_connection()
+            self._test_connection_and_log(con)
         with utils.StatefulConnection(
                 vm_ssh[0], vm_ssh[1], srv_ip, 6666) as con:
             self.client.update_port(
                     srv_port['id'], security_groups=[ssh_sg['id']])
-            con.test_connection(should_pass=False)
+            self._test_connection_and_log(con, should_pass=False)
         with utils.StatefulConnection(
                 vm_ssh[0], vm_ssh[1], srv_ip, 6666) as con:
             self.client.update_port(srv_port['id'],
                     security_groups=[ssh_sg['id'], sg['id']])
-            con.test_connection()
+            self._test_connection_and_log(con)
             self.client.update_port(srv_port['id'],
                     security_groups=[ssh_sg['id']])
-            con.test_connection(should_pass=False)
+            self._test_connection_and_log(con, should_pass=False)
             self.client.update_port(srv_port['id'],
                     security_groups=[ssh_sg['id'], sg['id']])
-            con.test_connection()
+            self._test_connection_and_log(con)
 
     @decorators.idempotent_id('4a724164-bbc0-4029-a844-644ece66c026')
     def test_connectivity_between_vms_using_different_sec_groups(self):
diff --git a/neutron_tempest_plugin/scenario/test_trunk.py b/neutron_tempest_plugin/scenario/test_trunk.py
index 2ba8f13..47b8415 100644
--- a/neutron_tempest_plugin/scenario/test_trunk.py
+++ b/neutron_tempest_plugin/scenario/test_trunk.py
@@ -193,7 +193,6 @@
         self._wait_for_port(port=vm.port)
         self._wait_for_port(port=vm.subport)
         self.check_connectivity(
-            host=vm.floating_ip['floating_ip_address'],
             ssh_client=vm.ssh_client,
             servers=[vm.server])
 
diff --git a/neutron_tempest_plugin/scenario/test_vlan_transparency.py b/neutron_tempest_plugin/scenario/test_vlan_transparency.py
index d9a529c..11f12e9 100644
--- a/neutron_tempest_plugin/scenario/test_vlan_transparency.py
+++ b/neutron_tempest_plugin/scenario/test_vlan_transparency.py
@@ -138,9 +138,7 @@
             ssh_clients.append(
                 self._create_ssh_client(floating_ip=floating_ips[i]))
 
-            self.check_connectivity(
-                host=floating_ips[i]['floating_ip_address'],
-                ssh_client=ssh_clients[i])
+            self.check_connectivity(ssh_client=ssh_clients[i])
             self._configure_vlan_transparent(port=self.vm_ports[-1],
                                              ssh_client=ssh_clients[i],
                                              vlan_tag=vlan_tag,
diff --git a/neutron_tempest_plugin/services/network/json/network_client.py b/neutron_tempest_plugin/services/network/json/network_client.py
index 1153a2a..289ef61 100644
--- a/neutron_tempest_plugin/services/network/json/network_client.py
+++ b/neutron_tempest_plugin/services/network/json/network_client.py
@@ -804,6 +804,14 @@
         body = jsonutils.loads(body)
         return service_client.ResponseBody(resp, body)
 
+    def validate_auto_allocated_topology_requirements(self, tenant_id=None):
+        uri = '%s/auto-allocated-topology/%s?fields=dry-run' % (
+            self.uri_prefix, tenant_id)
+        resp, body = self.get(uri)
+        self.expected_success(200, resp.status)
+        body = jsonutils.loads(body)
+        return service_client.ResponseBody(resp, body)
+
     def get_auto_allocated_topology(self, tenant_id=None):
         uri = '%s/auto-allocated-topology/%s' % (self.uri_prefix, tenant_id)
         resp, body = self.get(uri)
diff --git a/playbooks/plugin-ovn-scenario-pre-run.yaml b/playbooks/plugin-ovn-scenario-pre-run.yaml
new file mode 100644
index 0000000..925223e
--- /dev/null
+++ b/playbooks/plugin-ovn-scenario-pre-run.yaml
@@ -0,0 +1,3 @@
+- hosts: all
+  roles:
+    - docker-setup
diff --git a/requirements.txt b/requirements.txt
index 9423079..957f186 100644
--- a/requirements.txt
+++ b/requirements.txt
@@ -1,14 +1,10 @@
-# The order of packages is significant, because pip processes them in the order
-# of appearance. Changing the order has an impact on the overall integration
-# process, which may cause wedges in the gate later.
-
-pbr!=2.1.0,>=2.0.0 # Apache-2.0
+pbr>=3.0.0 # Apache-2.0
 neutron-lib>=1.25.0 # Apache-2.0
 oslo.config>=5.2.0 # Apache-2.0
 netaddr>=0.7.18 # BSD
 os-ken>=0.3.0 # Apache-2.0
 oslo.log>=3.36.0 # Apache-2.0
-oslo.serialization!=2.19.1,>=2.18.0 # Apache-2.0
+oslo.serialization>=2.20.0 # Apache-2.0
 oslo.utils>=3.33.0 # Apache-2.0
 packaging>=20.4  # Apache-2.0
 paramiko>=2.0.0 # LGPLv2.1+
@@ -16,5 +12,5 @@
 tenacity>=3.2.1 # Apache-2.0
 ddt>=1.0.1 # MIT
 testtools>=2.2.0 # MIT
-eventlet!=0.18.3,!=0.20.1,>=0.18.2 # MIT
+eventlet>=0.21.0 # MIT
 debtcollector>=1.2.0 # Apache-2.0
diff --git a/test-requirements.txt b/test-requirements.txt
index f5bac7c..0151f21 100644
--- a/test-requirements.txt
+++ b/test-requirements.txt
@@ -1,10 +1,6 @@
-# The order of packages is significant, because pip processes them in the order
-# of appearance. Changing the order has an impact on the overall integration
-# process, which may cause wedges in the gate later.
-
 hacking>=3.2.0,<3.3.0 # Apache-2.0
 
-coverage!=4.4,>=4.0 # Apache-2.0
+coverage>=4.4.1 # Apache-2.0
 flake8-import-order==0.12 # LGPLv3
 python-subunit>=1.0.0 # Apache-2.0/BSD
 oslotest>=3.2.0 # Apache-2.0
diff --git a/zuul.d/2023_1_jobs.yaml b/zuul.d/2023_1_jobs.yaml
index 6bf7027..32e2c4c 100644
--- a/zuul.d/2023_1_jobs.yaml
+++ b/zuul.d/2023_1_jobs.yaml
@@ -95,6 +95,7 @@
         - uplink-status-propagation
       devstack_localrc:
         NETWORK_API_EXTENSIONS: "{{ (network_api_extensions_common + network_api_extensions_openvswitch) | join(',') }}"
+        NEUTRON_DEPLOY_MOD_WSGI: false
       devstack_local_conf:
         test-config:
           $TEMPEST_CONFIG:
@@ -129,6 +130,7 @@
           (^neutron_tempest_plugin.scenario.test_security_groups.StatelessNetworkSecGroupTest.test_established_tcp_session_after_re_attachinging_sg)"
       devstack_localrc:
         NETWORK_API_EXTENSIONS: "{{ (network_api_extensions_common + network_api_extensions_openvswitch) | join(',') }}"
+        NEUTRON_DEPLOY_MOD_WSGI: false
       devstack_local_conf:
         test-config:
           $TEMPEST_CONFIG:
@@ -208,10 +210,6 @@
           (^neutron_tempest_plugin.scenario)|\
           (^tempest.api.compute.servers.test_attach_interfaces)|\
           (^tempest.api.compute.servers.test_multiple_create)"
-      # TODO(jlibosva): Remove the NetworkWritableMtuTest test from the list
-      # once east/west fragmentation is supported in core OVN
-      tempest_exclude_regex: "\
-          (^neutron_tempest_plugin.scenario.test_mtu.NetworkWritableMtuTest)"
       devstack_localrc:
         NETWORK_API_EXTENSIONS: "{{ (network_api_extensions_common + network_api_extensions_ovn) | join(',') }}"
       devstack_services:
@@ -238,6 +236,7 @@
         - dvr
       devstack_localrc:
         NETWORK_API_EXTENSIONS: "{{ (network_api_extensions_common + network_api_extensions_dvr) | join(',') }}"
+        NEUTRON_DEPLOY_MOD_WSGI: false
 
 - job:
     name: neutron-tempest-plugin-designate-scenario-2023-1
@@ -250,11 +249,17 @@
     name: neutron-tempest-plugin-sfc-2023-1
     parent: neutron-tempest-plugin-sfc
     override-checkout: stable/2023.1
+    vars:
+      devstack_localrc:
+        NEUTRON_DEPLOY_MOD_WSGI: false
 
 - job:
     name: neutron-tempest-plugin-bgpvpn-bagpipe-2023-1
     parent: neutron-tempest-plugin-bgpvpn-bagpipe
     override-checkout: stable/2023.1
+    vars:
+      devstack_localrc:
+        NEUTRON_DEPLOY_MOD_WSGI: false
 
 - job:
     name: neutron-tempest-plugin-dynamic-routing-2023-1
@@ -265,13 +270,22 @@
     name: neutron-tempest-plugin-fwaas-2023-1
     parent: neutron-tempest-plugin-fwaas
     override-checkout: stable/2023.1
+    vars:
+      devstack_localrc:
+        NEUTRON_DEPLOY_MOD_WSGI: false
 
 - job:
     name: neutron-tempest-plugin-vpnaas-2023-1
     parent: neutron-tempest-plugin-vpnaas
     override-checkout: stable/2023.1
+    vars:
+      devstack_localrc:
+        NEUTRON_DEPLOY_MOD_WSGI: false
 
 - job:
     name: neutron-tempest-plugin-tap-as-a-service-2023-1
     parent: neutron-tempest-plugin-tap-as-a-service
     override-checkout: stable/2023.1
+    vars:
+      devstack_localrc:
+        NEUTRON_DEPLOY_MOD_WSGI: false
diff --git a/zuul.d/2023_2_jobs.yaml b/zuul.d/2023_2_jobs.yaml
index 87092a9..7aa1642 100644
--- a/zuul.d/2023_2_jobs.yaml
+++ b/zuul.d/2023_2_jobs.yaml
@@ -95,6 +95,7 @@
         - uplink-status-propagation
       devstack_localrc:
         NETWORK_API_EXTENSIONS: "{{ (network_api_extensions_common + network_api_extensions_openvswitch) | join(',') }}"
+        NEUTRON_DEPLOY_MOD_WSGI: false
       devstack_local_conf:
         test-config:
           $TEMPEST_CONFIG:
@@ -124,6 +125,7 @@
           (^neutron_tempest_plugin.scenario.test_security_groups.StatelessNetworkSecGroupTest.test_established_tcp_session_after_re_attachinging_sg)"
       devstack_localrc:
         NETWORK_API_EXTENSIONS: "{{ (network_api_extensions_common + network_api_extensions_openvswitch) | join(',') }}"
+        NEUTRON_DEPLOY_MOD_WSGI: false
       devstack_local_conf:
         test-config:
           $TEMPEST_CONFIG:
@@ -203,10 +205,6 @@
           (^neutron_tempest_plugin.scenario)|\
           (^tempest.api.compute.servers.test_attach_interfaces)|\
           (^tempest.api.compute.servers.test_multiple_create)"
-      # TODO(jlibosva): Remove the NetworkWritableMtuTest test from the list
-      # once east/west fragmentation is supported in core OVN
-      tempest_exclude_regex: "\
-          (^neutron_tempest_plugin.scenario.test_mtu.NetworkWritableMtuTest)"
       devstack_localrc:
         NETWORK_API_EXTENSIONS: "{{ (network_api_extensions_common + network_api_extensions_ovn) | join(',') }}"
       devstack_services:
@@ -233,6 +231,7 @@
         - dvr
       devstack_localrc:
         NETWORK_API_EXTENSIONS: "{{ (network_api_extensions_common + network_api_extensions_dvr) | join(',') }}"
+        NEUTRON_DEPLOY_MOD_WSGI: false
 
 - job:
     name: neutron-tempest-plugin-designate-scenario-2023-2
@@ -245,11 +244,17 @@
     name: neutron-tempest-plugin-sfc-2023-2
     parent: neutron-tempest-plugin-sfc
     override-checkout: stable/2023.2
+    vars:
+      devstack_localrc:
+        NEUTRON_DEPLOY_MOD_WSGI: false
 
 - job:
     name: neutron-tempest-plugin-bgpvpn-bagpipe-2023-2
     parent: neutron-tempest-plugin-bgpvpn-bagpipe
     override-checkout: stable/2023.2
+    vars:
+      devstack_localrc:
+        NEUTRON_DEPLOY_MOD_WSGI: false
 
 - job:
     name: neutron-tempest-plugin-dynamic-routing-2023-2
@@ -260,13 +265,22 @@
     name: neutron-tempest-plugin-fwaas-2023-2
     parent: neutron-tempest-plugin-fwaas
     override-checkout: stable/2023.2
+    vars:
+      devstack_localrc:
+        NEUTRON_DEPLOY_MOD_WSGI: false
 
 - job:
     name: neutron-tempest-plugin-vpnaas-2023-2
     parent: neutron-tempest-plugin-vpnaas
     override-checkout: stable/2023.2
+    vars:
+      devstack_localrc:
+        NEUTRON_DEPLOY_MOD_WSGI: false
 
 - job:
     name: neutron-tempest-plugin-tap-as-a-service-2023-2
     parent: neutron-tempest-plugin-tap-as-a-service
     override-checkout: stable/2023.2
+    vars:
+      devstack_localrc:
+        NEUTRON_DEPLOY_MOD_WSGI: false
diff --git a/zuul.d/2024_1_jobs.yaml b/zuul.d/2024_1_jobs.yaml
index 022e439..86fbc52 100644
--- a/zuul.d/2024_1_jobs.yaml
+++ b/zuul.d/2024_1_jobs.yaml
@@ -97,6 +97,7 @@
         - uplink-status-propagation
       devstack_localrc:
         NETWORK_API_EXTENSIONS: "{{ (network_api_extensions_common + network_api_extensions_openvswitch) | join(',') }}"
+        NEUTRON_DEPLOY_MOD_WSGI: false
       devstack_local_conf:
         test-config:
           $TEMPEST_CONFIG:
@@ -126,6 +127,7 @@
           (^neutron_tempest_plugin.scenario.test_security_groups.StatelessNetworkSecGroupTest.test_established_tcp_session_after_re_attachinging_sg)"
       devstack_localrc:
         NETWORK_API_EXTENSIONS: "{{ (network_api_extensions_common + network_api_extensions_openvswitch) | join(',') }}"
+        NEUTRON_DEPLOY_MOD_WSGI: false
       devstack_local_conf:
         test-config:
           $TEMPEST_CONFIG:
@@ -205,10 +207,6 @@
           (^neutron_tempest_plugin.scenario)|\
           (^tempest.api.compute.servers.test_attach_interfaces)|\
           (^tempest.api.compute.servers.test_multiple_create)"
-      # TODO(jlibosva): Remove the NetworkWritableMtuTest test from the list
-      # once east/west fragmentation is supported in core OVN
-      tempest_exclude_regex: "\
-          (^neutron_tempest_plugin.scenario.test_mtu.NetworkWritableMtuTest)"
       devstack_localrc:
         NETWORK_API_EXTENSIONS: "{{ (network_api_extensions_common + network_api_extensions_ovn) | join(',') }}"
       devstack_local_conf:
@@ -232,6 +230,7 @@
         - dvr
       devstack_localrc:
         NETWORK_API_EXTENSIONS: "{{ (network_api_extensions_common + network_api_extensions_dvr) | join(',') }}"
+        NEUTRON_DEPLOY_MOD_WSGI: false
 
 - job:
     name: neutron-tempest-plugin-designate-scenario-2024-1
@@ -244,11 +243,17 @@
     name: neutron-tempest-plugin-sfc-2024-1
     parent: neutron-tempest-plugin-sfc
     override-checkout: stable/2024.1
+    vars:
+      devstack_localrc:
+        NEUTRON_DEPLOY_MOD_WSGI: false
 
 - job:
     name: neutron-tempest-plugin-bgpvpn-bagpipe-2024-1
     parent: neutron-tempest-plugin-bgpvpn-bagpipe
     override-checkout: stable/2024.1
+    vars:
+      devstack_localrc:
+        NEUTRON_DEPLOY_MOD_WSGI: false
 
 - job:
     name: neutron-tempest-plugin-dynamic-routing-2024-1
@@ -259,13 +264,22 @@
     name: neutron-tempest-plugin-fwaas-2024-1
     parent: neutron-tempest-plugin-fwaas
     override-checkout: stable/2024.1
+    vars:
+      devstack_localrc:
+        NEUTRON_DEPLOY_MOD_WSGI: false
 
 - job:
     name: neutron-tempest-plugin-vpnaas-2024-1
     parent: neutron-tempest-plugin-vpnaas
     override-checkout: stable/2024.1
+    vars:
+      devstack_localrc:
+        NEUTRON_DEPLOY_MOD_WSGI: false
 
 - job:
     name: neutron-tempest-plugin-tap-as-a-service-2024-1
     parent: neutron-tempest-plugin-tap-as-a-service
     override-checkout: stable/2024.1
+    vars:
+      devstack_localrc:
+        NEUTRON_DEPLOY_MOD_WSGI: false
diff --git a/zuul.d/base-nested-switch.yaml b/zuul.d/base-nested-switch.yaml
index 8533e07..f8fa799 100644
--- a/zuul.d/base-nested-switch.yaml
+++ b/zuul.d/base-nested-switch.yaml
@@ -34,9 +34,10 @@
         # NOTE(ykarel): seeing issues with host-passthrough mode
         # https://bugs.launchpad.net/neutron/+bug/2036603
         # LIBVIRT_CPU_MODE: host-passthrough
-        CIRROS_VERSION: 0.6.2
-        DEFAULT_IMAGE_NAME: cirros-0.6.2-x86_64-disk
-        DEFAULT_IMAGE_FILE_NAME: cirros-0.6.2-x86_64-disk.img
+        # TODO(ykarel): switch to 0.6.2+ once lp#2045549 is fixed
+        CIRROS_VERSION: 0.5.3
+        DEFAULT_IMAGE_NAME: cirros-0.5.3-x86_64-disk
+        DEFAULT_IMAGE_FILE_NAME: cirros-0.5.3-x86_64-disk.img
 
 # Base nested switch job for yoga and zed
 - job:
diff --git a/zuul.d/master_jobs.yaml b/zuul.d/master_jobs.yaml
index d47ff64..5518798 100644
--- a/zuul.d/master_jobs.yaml
+++ b/zuul.d/master_jobs.yaml
@@ -38,13 +38,6 @@
         # TODO(lucasagomes): Re-enable MOD_WSGI after
         # https://bugs.launchpad.net/neutron/+bug/1912359 is implemented
         NEUTRON_DEPLOY_MOD_WSGI: false
-        # TODO(ihrachys): remove OVN_BUILD_FROM_SOURCE once the OS packages
-        # include at least OVN v22.03.3.
-        OVN_BUILD_FROM_SOURCE: True
-        # TODO(ihrachys): switch back to a tagged version when it's released
-        # OVN_BRANCH: "v22.03.3"
-        OVN_BRANCH: "36e3ab9b47e93af0599a818e9d6b2930e49473f0"
-        OVS_BRANCH: "2410b95597fcec5f733caf77febdb46f4ffacd27"
       devstack_plugins:
         neutron: https://opendev.org/openstack/neutron.git
         neutron-tempest-plugin: https://opendev.org/openstack/neutron-tempest-plugin.git
@@ -98,6 +91,7 @@
         - port-resource-request
         - port-resource-request-groups
         - port-mac-address-regenerate
+        - port-trusted-vif
         - port-security
         - port-security-groups-filtering
         - project-id
@@ -148,6 +142,7 @@
         neutron-tag-ports-during-bulk-creation: true
         neutron-ndp-proxy: true
         neutron-subnet-external-network: true
+        neutron-port-trusted-vif: true
         br-ex-tcpdump: true
         br-int-flows: true
         # Cinder services
@@ -194,6 +189,7 @@
               image_is_advanced: true
               available_type_drivers: flat,geneve,vlan,gre,local,vxlan
               provider_net_base_segm_id: 1
+              snat_rules_apply_to_nested_networks: true
     irrelevant-files:
       - ^\.pylintrc$
       - ^(test-|)requirements.txt$
@@ -218,14 +214,24 @@
       - ^roles/.*functional.*$
       - ^playbooks/.*functional.*$
       - ^vagrant/.*$
-      - ^zuul.d/(?!(project)).*\.yaml
+      # Ignore everything except for zuul.d/project.yaml
+      - ^zuul.d/2023_1_jobs.yaml
+      - ^zuul.d/2023_2_jobs.yaml
+      - ^zuul.d/2024_1_jobs.yaml
+      - ^zuul.d/base-nested-switch.yaml
+      - ^zuul.d/master_jobs.yaml
+      - ^zuul.d/victoria_jobs.yaml
+      - ^zuul.d/wallaby_jobs.yaml
+      - ^zuul.d/xena_jobs.yaml
+      - ^zuul.d/yoga_jobs.yaml
+      - ^zuul.d/zed_jobs.yaml
 
 - job:
     name: neutron-tempest-plugin-openvswitch
     parent: neutron-tempest-plugin-base-nested-switch
     timeout: 10000
     vars:
-      configure_swap_size: 2048
+      configure_swap_size: 3072
       devstack_services:
         # Disable OVN services
         br-ex-tcpdump: false
@@ -254,6 +260,7 @@
         Q_ML2_TENANT_NETWORK_TYPE: vxlan
         Q_ML2_PLUGIN_MECHANISM_DRIVERS: openvswitch
         NETWORK_API_EXTENSIONS: "{{ (network_api_extensions_common + network_api_extensions_openvswitch) | join(',') }}"
+        NEUTRON_DEPLOY_MOD_WSGI: true
       devstack_local_conf:
         post-config:
           $NEUTRON_CONF:
@@ -274,6 +281,7 @@
             neutron_plugin_options:
               available_type_drivers: flat,vlan,local,vxlan
               firewall_driver: openvswitch
+              snat_rules_apply_to_nested_networks: true
     irrelevant-files:
       - ^\.pylintrc$
       - ^(test-|)requirements.txt$
@@ -314,14 +322,24 @@
       - ^playbooks/.*functional.*$
       - ^playbooks/.*linuxbridge.*$
       - ^vagrant/.*$
-      - ^zuul.d/(?!(project)).*\.yaml
+      # Ignore everything except for zuul.d/project.yaml
+      - ^zuul.d/2023_1_jobs.yaml
+      - ^zuul.d/2023_2_jobs.yaml
+      - ^zuul.d/2024_1_jobs.yaml
+      - ^zuul.d/base-nested-switch.yaml
+      - ^zuul.d/master_jobs.yaml
+      - ^zuul.d/victoria_jobs.yaml
+      - ^zuul.d/wallaby_jobs.yaml
+      - ^zuul.d/xena_jobs.yaml
+      - ^zuul.d/yoga_jobs.yaml
+      - ^zuul.d/zed_jobs.yaml
 
 - job:
     name: neutron-tempest-plugin-openvswitch-iptables_hybrid
     parent: neutron-tempest-plugin-base-nested-switch
     timeout: 10000
     vars:
-      configure_swap_size: 2048
+      configure_swap_size: 3072
       devstack_services:
         # Disable OVN services
         br-ex-tcpdump: false
@@ -357,6 +375,7 @@
         Q_ML2_TENANT_NETWORK_TYPE: vxlan
         Q_ML2_PLUGIN_MECHANISM_DRIVERS: openvswitch
         NETWORK_API_EXTENSIONS: "{{ (network_api_extensions_common + network_api_extensions_openvswitch) | join(',') }}"
+        NEUTRON_DEPLOY_MOD_WSGI: true
       devstack_local_conf:
         post-config:
           $NEUTRON_CONF:
@@ -378,6 +397,7 @@
             neutron_plugin_options:
               available_type_drivers: flat,vlan,local,vxlan
               firewall_driver: iptables_hybrid
+              snat_rules_apply_to_nested_networks: true
     irrelevant-files:
       - ^\.pylintrc$
       - ^(test-|)requirements.txt$
@@ -419,24 +439,25 @@
       - ^playbooks/.*functional.*$
       - ^playbooks/.*linuxbridge.*$
       - ^vagrant/.*$
-      - ^zuul.d/(?!(project)).*\.yaml
+      # Ignore everything except for zuul.d/project.yaml
+      - ^zuul.d/2023_1_jobs.yaml
+      - ^zuul.d/2023_2_jobs.yaml
+      - ^zuul.d/2024_1_jobs.yaml
+      - ^zuul.d/base-nested-switch.yaml
+      - ^zuul.d/master_jobs.yaml
+      - ^zuul.d/victoria_jobs.yaml
+      - ^zuul.d/wallaby_jobs.yaml
+      - ^zuul.d/xena_jobs.yaml
+      - ^zuul.d/yoga_jobs.yaml
+      - ^zuul.d/zed_jobs.yaml
 
 - job:
-    name: neutron-tempest-plugin-openvswitch-enforce-scope-old-defaults
-    parent: neutron-tempest-plugin-openvswitch
+    name: neutron-tempest-plugin-ovn-enforce-scope-old-defaults
+    parent: neutron-tempest-plugin-ovn
     vars:
       devstack_localrc:
         NEUTRON_ENFORCE_SCOPE: false
 
-
-# TODO(slaweq): remove that job's definition as soon as new job
-# "neutron-tempest-plugin-openvswitch-iptables_hybrid" will be used in the
-# neutron repo as a parent for a
-# "neutron-ovs-tempest-plugin-scenario-iptables_hybrid-nftables" job
-- job:
-    name: neutron-tempest-plugin-scenario-openvswitch-iptables_hybrid
-    parent: neutron-tempest-plugin-openvswitch-iptables_hybrid
-
 - job:
     name: neutron-tempest-plugin-openvswitch-distributed-dhcp
     parent: neutron-tempest-plugin-openvswitch
@@ -479,7 +500,7 @@
       - zuul: openstack/neutron
     pre-run: playbooks/linuxbridge-scenario-pre-run.yaml
     vars:
-      configure_swap_size: 2048
+      configure_swap_size: 3072
       devstack_services:
         # Disable OVN services
         br-ex-tcpdump: false
@@ -543,6 +564,7 @@
               available_type_drivers: flat,vlan,local,vxlan
               q_agent: linuxbridge
               firewall_driver: iptables
+              snat_rules_apply_to_nested_networks: true
     irrelevant-files:
       - ^\.pylintrc$
       - ^(test-|)requirements.txt$
@@ -584,26 +606,27 @@
       - ^playbooks/.*dynamic-routing.*$
       - ^playbooks/.*functional.*$
       - ^vagrant/.*$
-      - ^zuul.d/(?!(project)).*\.yaml
-
-# TODO(slaweq): remove that job's definition as soon as new job
-# "neutron-tempest-plugin-linuxbridge" will be used in the neutron repo as
-# a parent for a "neutron-linuxbridge-tempest-plugin-scenario-nftables" job
-- job:
-    name: neutron-tempest-plugin-scenario-linuxbridge
-    parent: neutron-tempest-plugin-linuxbridge
+      # Ignore everything except for zuul.d/project.yaml
+      - ^zuul.d/2023_1_jobs.yaml
+      - ^zuul.d/2023_2_jobs.yaml
+      - ^zuul.d/2024_1_jobs.yaml
+      - ^zuul.d/base-nested-switch.yaml
+      - ^zuul.d/master_jobs.yaml
+      - ^zuul.d/victoria_jobs.yaml
+      - ^zuul.d/wallaby_jobs.yaml
+      - ^zuul.d/xena_jobs.yaml
+      - ^zuul.d/yoga_jobs.yaml
+      - ^zuul.d/zed_jobs.yaml
 
 - job:
     name: neutron-tempest-plugin-ovn
     parent: neutron-tempest-plugin-base-nested-switch
     timeout: 10800
+    pre-run: playbooks/plugin-ovn-scenario-pre-run.yaml
     vars:
       network_api_extensions_ovn:
         - vlan-transparent
-      # TODO(jlibosva): Remove the NetworkWritableMtuTest test from the list
-      # once east/west fragmentation is supported in core OVN
-      tempest_exclude_regex: "\
-          (^neutron_tempest_plugin.scenario.test_mtu.NetworkWritableMtuTest)"
+        - external-gateway-multihoming
       devstack_localrc:
         Q_AGENT: ovn
         OVN_AGENT_EXTENSIONS: 'metadata'
@@ -617,14 +640,6 @@
         OVN_DBS_LOG_LEVEL: dbg
         ENABLE_TLS: True
         OVN_IGMP_SNOOPING_ENABLE: True
-        # TODO(ihrachys): remove OVN_BUILD_FROM_SOURCE once the OS packages
-        # include at least OVN v22.03.3.
-        OVN_BUILD_FROM_SOURCE: True
-        # TODO(ihrachys): switch back to a tagged version when it's released
-        # OVN_BRANCH: "v22.03.3"
-        OVN_BRANCH: "36e3ab9b47e93af0599a818e9d6b2930e49473f0"
-        OVS_BRANCH: "2410b95597fcec5f733caf77febdb46f4ffacd27"
-        OVS_SYSCONFDIR: "/usr/local/etc/openvswitch"
       devstack_services:
         br-ex-tcpdump: true
         br-int-flows: true
@@ -661,6 +676,8 @@
           /$NEUTRON_CORE_PLUGIN_CONF:
             ml2:
               type_drivers: local,flat,vlan,geneve
+            ml2_type_vlan:
+              network_vlan_ranges: foo:1:10,public
         test-config:
           $TEMPEST_CONFIG:
             network-feature-enabled:
@@ -669,9 +686,12 @@
               available_type_drivers: local,flat,vlan,geneve
               is_igmp_snooping_enabled: True
               firewall_driver: ovn
+              snat_rules_apply_to_nested_networks: false
       zuul_copy_output:
         '{{ devstack_base_dir }}/data/ovs': 'logs'
         '{{ devstack_base_dir }}/data/ovn': 'logs'
+        '{{ devstack_log_dir }}/ovn-controller.log': 'logs'
+        '{{ devstack_log_dir }}/ovn-northd.log': 'logs'
         '{{ devstack_log_dir }}/ovsdb-server-nb.log': 'logs'
         '{{ devstack_log_dir }}/ovsdb-server-sb.log': 'logs'
         '/var/log/ovn': 'logs'
@@ -722,7 +742,17 @@
       - ^playbooks/.*functional.*$
       - ^playbooks/.*linuxbridge.*$
       - ^vagrant/.*$
-      - ^zuul.d/(?!(project)).*\.yaml
+      # Ignore everything except for zuul.d/project.yaml
+      - ^zuul.d/2023_1_jobs.yaml
+      - ^zuul.d/2023_2_jobs.yaml
+      - ^zuul.d/2024_1_jobs.yaml
+      - ^zuul.d/base-nested-switch.yaml
+      - ^zuul.d/master_jobs.yaml
+      - ^zuul.d/victoria_jobs.yaml
+      - ^zuul.d/wallaby_jobs.yaml
+      - ^zuul.d/xena_jobs.yaml
+      - ^zuul.d/yoga_jobs.yaml
+      - ^zuul.d/zed_jobs.yaml
 
 # TODO(slaweq): remove that job's definition as soon as new job
 # "neutron-tempest-plugin-ovn" will be used in the neutron-lib repo as
@@ -732,6 +762,22 @@
     parent: neutron-tempest-plugin-ovn
 
 - job:
+    name: neutron-tempest-plugin-api-ovs-wsgi
+    parent: neutron-tempest-plugin-openvswitch
+    voting: false
+    vars:
+      devstack_localrc:
+        NEUTRON_DEPLOY_MOD_WSGI: true
+
+- job:
+    name: neutron-tempest-plugin-api-ovn-wsgi
+    parent: neutron-tempest-plugin-ovn
+    voting: false
+    vars:
+      devstack_localrc:
+        NEUTRON_DEPLOY_MOD_WSGI: true
+
+- job:
     name: neutron-tempest-plugin-dvr-multinode-scenario
     parent: tempest-multinode-full
     description: |
@@ -772,6 +818,7 @@
         Q_AGENT: openvswitch
         Q_ML2_TENANT_NETWORK_TYPE: vxlan
         Q_ML2_PLUGIN_MECHANISM_DRIVERS: openvswitch
+        NEUTRON_DEPLOY_MOD_WSGI: true
       devstack_plugins:
         neutron: https://opendev.org/openstack/neutron.git
         neutron-tempest-plugin: https://opendev.org/openstack/neutron-tempest-plugin.git
@@ -862,6 +909,7 @@
               available_type_drivers: flat,geneve,vlan,gre,local,vxlan
               l3_agent_mode: dvr_snat
               firewall_driver: openvswitch
+              snat_rules_apply_to_nested_networks: true
     group-vars:
       subnode:
         devstack_services:
@@ -952,7 +1000,17 @@
       - ^playbooks/.*functional.*$
       - ^playbooks/.*linuxbridge.*$
       - ^vagrant/.*$
-      - ^zuul.d/(?!(project)).*\.yaml
+      # Ignore everything except for zuul.d/project.yaml
+      - ^zuul.d/2023_1_jobs.yaml
+      - ^zuul.d/2023_2_jobs.yaml
+      - ^zuul.d/2024_1_jobs.yaml
+      - ^zuul.d/base-nested-switch.yaml
+      - ^zuul.d/master_jobs.yaml
+      - ^zuul.d/victoria_jobs.yaml
+      - ^zuul.d/wallaby_jobs.yaml
+      - ^zuul.d/xena_jobs.yaml
+      - ^zuul.d/yoga_jobs.yaml
+      - ^zuul.d/zed_jobs.yaml
 
 - job:
     name: neutron-tempest-plugin-designate-scenario
@@ -1001,7 +1059,7 @@
       - ^neutron/privileged/.*$
       - ^neutron/plugins/ml2/drivers/.*$
       - ^neutron/scheduler/.*$
-      - ^neutron/services/(?!externaldns).*$
+      - ^neutron/services/.*$
       - ^neutron_tempest_plugin/api/test_.*$
       - ^neutron_tempest_plugin/(bgpvpn|fwaas|neutron_dynamic_routing|sfc|tap_as_a_service|vpnaas).*$
       - ^neutron_tempest_plugin/services/bgp/.*$
@@ -1012,7 +1070,40 @@
       - ^playbooks/.*functional.*$
       - ^playbooks/.*linuxbridge.*$
       - ^vagrant/.*$
-      - ^zuul.d/(?!(project)).*\.yaml
+      # Ignore everything except for neutron/services/externaldns/
+      - ^neutron/services/auto_allocate/.*$
+      - ^neutron/services/conntrack_helper/.*$
+      - ^neutron/services/firewall/.*$
+      - ^neutron/services/flavors/.*$
+      - ^neutron/services/l3_router/.*$
+      - ^neutron/services/local_ip/.*$
+      - ^neutron/services/logapi/.*$
+      - ^neutron/services/loki/.*$
+      - ^neutron/services/metering/.*$
+      - ^neutron/services/ndp_proxy/.*$
+      - ^neutron/services/network_ip_availability/.*$
+      - ^neutron/services/network_segment_range/.*$
+      - ^neutron/services/ovn_l3/.*$
+      - ^neutron/services/placement_report/.*$
+      - ^neutron/services/portforwarding/.*$
+      - ^neutron/services/qos/.*$
+      - ^neutron/services/rbac/.*$
+      - ^neutron/services/revisions/.*$
+      - ^neutron/services/segments/.*$
+      - ^neutron/services/tag/.*$
+      - ^neutron/services/timestamp/.*$
+      - ^neutron/services/trunk/.*$
+      # Ignore everything except for zuul.d/project.yaml
+      - ^zuul.d/2023_1_jobs.yaml
+      - ^zuul.d/2023_2_jobs.yaml
+      - ^zuul.d/2024_1_jobs.yaml
+      - ^zuul.d/base-nested-switch.yaml
+      - ^zuul.d/master_jobs.yaml
+      - ^zuul.d/victoria_jobs.yaml
+      - ^zuul.d/wallaby_jobs.yaml
+      - ^zuul.d/xena_jobs.yaml
+      - ^zuul.d/yoga_jobs.yaml
+      - ^zuul.d/zed_jobs.yaml
 
 - job:
     name: neutron-tempest-plugin-sfc
@@ -1056,6 +1147,7 @@
         Q_ML2_TENANT_NETWORK_TYPE: vxlan
         Q_ML2_PLUGIN_MECHANISM_DRIVERS: openvswitch
         NETWORK_API_EXTENSIONS: "{{ (network_api_extensions_common + network_api_extensions_sfc) | join(',') }}"
+        NEUTRON_DEPLOY_MOD_WSGI: true
       # TODO(bcafarel): tests still fail from time to time in parallel
       # https://bugs.launchpad.net/neutron/+bug/1851500
       # https://bugs.launchpad.net/networking-sfc/+bug/1660366
@@ -1088,7 +1180,17 @@
       - ^playbooks/.*functional.*$
       - ^playbooks/.*linuxbridge.*$
       - ^vagrant/.*$
-      - ^zuul.d/(?!(project)).*\.yaml
+      # Ignore everything except for zuul.d/project.yaml
+      - ^zuul.d/2023_1_jobs.yaml
+      - ^zuul.d/2023_2_jobs.yaml
+      - ^zuul.d/2024_1_jobs.yaml
+      - ^zuul.d/base-nested-switch.yaml
+      - ^zuul.d/master_jobs.yaml
+      - ^zuul.d/victoria_jobs.yaml
+      - ^zuul.d/wallaby_jobs.yaml
+      - ^zuul.d/xena_jobs.yaml
+      - ^zuul.d/yoga_jobs.yaml
+      - ^zuul.d/zed_jobs.yaml
 
 - job:
     name: neutron-tempest-plugin-bgpvpn-bagpipe
@@ -1125,6 +1227,7 @@
         BAGPIPE_DATAPLANE_DRIVER_IPVPN: "ovs"
         BAGPIPE_BGP_PEERS: "-"
         NETWORK_API_EXTENSIONS: "{{ (network_api_extensions_common + network_api_extensions_bgpvpn) | join(',') }}"
+        NEUTRON_DEPLOY_MOD_WSGI: true
       devstack_plugins:
         networking-bgpvpn: https://git.openstack.org/openstack/networking-bgpvpn
         networking-bagpipe: https://git.openstack.org/openstack/networking-bagpipe
@@ -1156,7 +1259,17 @@
       - ^playbooks/.*functional.*$
       - ^playbooks/.*linuxbridge.*$
       - ^vagrant/.*$
-      - ^zuul.d/(?!(project)).*\.yaml
+      # Ignore everything except for zuul.d/project.yaml
+      - ^zuul.d/2023_1_jobs.yaml
+      - ^zuul.d/2023_2_jobs.yaml
+      - ^zuul.d/2024_1_jobs.yaml
+      - ^zuul.d/base-nested-switch.yaml
+      - ^zuul.d/master_jobs.yaml
+      - ^zuul.d/victoria_jobs.yaml
+      - ^zuul.d/wallaby_jobs.yaml
+      - ^zuul.d/xena_jobs.yaml
+      - ^zuul.d/yoga_jobs.yaml
+      - ^zuul.d/zed_jobs.yaml
 
 - job:
     name: neutron-tempest-plugin-dynamic-routing
@@ -1210,14 +1323,23 @@
       - ^playbooks/.*functional.*$
       - ^playbooks/.*linuxbridge.*$
       - ^vagrant/.*$
-      - ^zuul.d/(?!(project)).*\.yaml
+      # Ignore everything except for zuul.d/project.yaml
+      - ^zuul.d/2023_1_jobs.yaml
+      - ^zuul.d/2023_2_jobs.yaml
+      - ^zuul.d/2024_1_jobs.yaml
+      - ^zuul.d/base-nested-switch.yaml
+      - ^zuul.d/master_jobs.yaml
+      - ^zuul.d/victoria_jobs.yaml
+      - ^zuul.d/wallaby_jobs.yaml
+      - ^zuul.d/xena_jobs.yaml
+      - ^zuul.d/yoga_jobs.yaml
+      - ^zuul.d/zed_jobs.yaml
 
 - job:
     name: neutron-tempest-plugin-fwaas
     parent: neutron-tempest-plugin-base
     timeout: 10800
     required-projects:
-      - openstack/devstack-gate
       - openstack/neutron-fwaas
       - openstack/neutron
       - openstack/neutron-tempest-plugin
@@ -1235,6 +1357,7 @@
         Q_AGENT: openvswitch
         Q_ML2_TENANT_NETWORK_TYPE: vxlan
         Q_ML2_PLUGIN_MECHANISM_DRIVERS: openvswitch
+        NEUTRON_DEPLOY_MOD_WSGI: true
       devstack_services:
         # Disable OVN services
         br-ex-tcpdump: false
@@ -1276,7 +1399,17 @@
       - ^playbooks/.*functional.*$
       - ^playbooks/.*linuxbridge.*$
       - ^vagrant/.*$
-      - ^zuul.d/(?!(project)).*\.yaml
+      # Ignore everything except for zuul.d/project.yaml
+      - ^zuul.d/2023_1_jobs.yaml
+      - ^zuul.d/2023_2_jobs.yaml
+      - ^zuul.d/2024_1_jobs.yaml
+      - ^zuul.d/base-nested-switch.yaml
+      - ^zuul.d/master_jobs.yaml
+      - ^zuul.d/victoria_jobs.yaml
+      - ^zuul.d/wallaby_jobs.yaml
+      - ^zuul.d/xena_jobs.yaml
+      - ^zuul.d/yoga_jobs.yaml
+      - ^zuul.d/zed_jobs.yaml
 
 - job:
     name: neutron-tempest-plugin-vpnaas
@@ -1302,6 +1435,7 @@
         Q_AGENT: openvswitch
         Q_ML2_TENANT_NETWORK_TYPE: vxlan
         Q_ML2_PLUGIN_MECHANISM_DRIVERS: openvswitch
+        NEUTRON_DEPLOY_MOD_WSGI: true
       devstack_services:
         # Disable OVN services
         br-ex-tcpdump: false
@@ -1345,7 +1479,17 @@
       - ^playbooks/.*functional.*$
       - ^playbooks/.*linuxbridge.*$
       - ^vagrant/.*$
-      - ^zuul.d/(?!(project)).*\.yaml
+      # Ignore everything except for zuul.d/project.yaml
+      - ^zuul.d/2023_1_jobs.yaml
+      - ^zuul.d/2023_2_jobs.yaml
+      - ^zuul.d/2024_1_jobs.yaml
+      - ^zuul.d/base-nested-switch.yaml
+      - ^zuul.d/master_jobs.yaml
+      - ^zuul.d/victoria_jobs.yaml
+      - ^zuul.d/wallaby_jobs.yaml
+      - ^zuul.d/xena_jobs.yaml
+      - ^zuul.d/yoga_jobs.yaml
+      - ^zuul.d/zed_jobs.yaml
 
 - job:
     name: neutron-tempest-plugin-vpnaas-ovn
@@ -1405,7 +1549,17 @@
       - ^playbooks/.*functional.*$
       - ^playbooks/.*linuxbridge.*$
       - ^vagrant/.*$
-      - ^zuul.d/(?!(project)).*\.yaml
+      # Ignore everything except for zuul.d/project.yaml
+      - ^zuul.d/2023_1_jobs.yaml
+      - ^zuul.d/2023_2_jobs.yaml
+      - ^zuul.d/2024_1_jobs.yaml
+      - ^zuul.d/base-nested-switch.yaml
+      - ^zuul.d/master_jobs.yaml
+      - ^zuul.d/victoria_jobs.yaml
+      - ^zuul.d/wallaby_jobs.yaml
+      - ^zuul.d/xena_jobs.yaml
+      - ^zuul.d/yoga_jobs.yaml
+      - ^zuul.d/zed_jobs.yaml
 
 - job:
     name: neutron-tempest-plugin-tap-as-a-service
@@ -1415,7 +1569,6 @@
     roles:
       - zuul: openstack/devstack
     required-projects:
-      - openstack/devstack-gate
       - openstack/neutron
       - openstack/neutron-tempest-plugin
       - openstack/tap-as-a-service
@@ -1433,6 +1586,7 @@
         Q_AGENT: openvswitch
         Q_ML2_TENANT_NETWORK_TYPE: vxlan,vlan
         Q_ML2_PLUGIN_MECHANISM_DRIVERS: openvswitch
+        NEUTRON_DEPLOY_MOD_WSGI: true
       devstack_local_conf:
         post-config:
           /$NEUTRON_CORE_PLUGIN_CONF:
@@ -1515,4 +1669,14 @@
       - ^playbooks/.*functional.*$
       - ^playbooks/.*linuxbridge.*$
       - ^vagrant/.*$
-      - ^zuul.d/(?!(project)).*\.yaml
+      # Ignore everything except for zuul.d/project.yaml
+      - ^zuul.d/2023_1_jobs.yaml
+      - ^zuul.d/2023_2_jobs.yaml
+      - ^zuul.d/2024_1_jobs.yaml
+      - ^zuul.d/base-nested-switch.yaml
+      - ^zuul.d/master_jobs.yaml
+      - ^zuul.d/victoria_jobs.yaml
+      - ^zuul.d/wallaby_jobs.yaml
+      - ^zuul.d/xena_jobs.yaml
+      - ^zuul.d/yoga_jobs.yaml
+      - ^zuul.d/zed_jobs.yaml
diff --git a/zuul.d/project.yaml b/zuul.d/project.yaml
index 35a3e7f..033bf09 100644
--- a/zuul.d/project.yaml
+++ b/zuul.d/project.yaml
@@ -4,15 +4,18 @@
       jobs:
         - neutron-tempest-plugin-openvswitch
         - neutron-tempest-plugin-openvswitch-iptables_hybrid
-        - neutron-tempest-plugin-openvswitch-enforce-scope-old-defaults
+        - neutron-tempest-plugin-ovn-enforce-scope-old-defaults
         - neutron-tempest-plugin-ovn
-        - neutron-tempest-plugin-designate-scenario
+        - neutron-tempest-plugin-designate-scenario:
+            # TODO(slaweq) make job voting again once bug
+            # https://bugs.launchpad.net/designate/+bug/2072627 will be fixed
+            voting: false
     gate:
       jobs:
         - neutron-tempest-plugin-openvswitch
         - neutron-tempest-plugin-ovn
         - neutron-tempest-plugin-openvswitch-iptables_hybrid
-        - neutron-tempest-plugin-openvswitch-enforce-scope-old-defaults
+        - neutron-tempest-plugin-ovn-enforce-scope-old-defaults
     #TODO(slaweq): Move neutron-tempest-plugin-dvr-multinode-scenario out of
     #              the experimental queue when it will be more stable
     experimental:
@@ -21,6 +24,8 @@
         - neutron-tempest-plugin-dvr-multinode-scenario
         - neutron-tempest-plugin-openvswitch-distributed-dhcp
         - neutron-tempest-plugin-openvswitch-iptables_hybrid-distributed-dhcp
+        - neutron-tempest-plugin-api-ovs-wsgi
+        - neutron-tempest-plugin-api-ovn-wsgi
 
 
 - project-template:
@@ -177,7 +182,6 @@
     templates:
       - build-openstack-docs-pti
       - neutron-tempest-plugin-jobs
-      - neutron-tempest-plugin-jobs-zed
       - neutron-tempest-plugin-jobs-2023-1
       - neutron-tempest-plugin-jobs-2023-2
       - neutron-tempest-plugin-jobs-2024-1
@@ -187,33 +191,27 @@
     check:
       jobs:
         - neutron-tempest-plugin-sfc
-        - neutron-tempest-plugin-sfc-zed
         - neutron-tempest-plugin-sfc-2023-1
         - neutron-tempest-plugin-sfc-2023-2
         - neutron-tempest-plugin-sfc-2024-1
         - neutron-tempest-plugin-bgpvpn-bagpipe
-        - neutron-tempest-plugin-bgpvpn-bagpipe-zed
         - neutron-tempest-plugin-bgpvpn-bagpipe-2023-1
         - neutron-tempest-plugin-bgpvpn-bagpipe-2023-2
         - neutron-tempest-plugin-bgpvpn-bagpipe-2024-1
         - neutron-tempest-plugin-dynamic-routing
-        - neutron-tempest-plugin-dynamic-routing-zed
         - neutron-tempest-plugin-dynamic-routing-2023-1
         - neutron-tempest-plugin-dynamic-routing-2023-2
         - neutron-tempest-plugin-dynamic-routing-2024-1
         - neutron-tempest-plugin-fwaas
-        - neutron-tempest-plugin-fwaas-zed
         - neutron-tempest-plugin-fwaas-2023-1
         - neutron-tempest-plugin-fwaas-2023-2
         - neutron-tempest-plugin-fwaas-2024-1
         - neutron-tempest-plugin-vpnaas
         - neutron-tempest-plugin-vpnaas-ovn
-        - neutron-tempest-plugin-vpnaas-zed
         - neutron-tempest-plugin-vpnaas-2023-1
         - neutron-tempest-plugin-vpnaas-2023-2
         - neutron-tempest-plugin-vpnaas-2024-1
         - neutron-tempest-plugin-tap-as-a-service
-        - neutron-tempest-plugin-tap-as-a-service-zed
         - neutron-tempest-plugin-tap-as-a-service-2023-1
         - neutron-tempest-plugin-tap-as-a-service-2023-2
         - neutron-tempest-plugin-tap-as-a-service-2024-1
diff --git a/zuul.d/victoria_jobs.yaml b/zuul.d/victoria_jobs.yaml
index 7e2549f..291e01d 100644
--- a/zuul.d/victoria_jobs.yaml
+++ b/zuul.d/victoria_jobs.yaml
@@ -2,7 +2,7 @@
     name: neutron-tempest-plugin-api-victoria
     parent: neutron-tempest-plugin-base
     nodeset: openstack-single-node-focal
-    override-checkout: stable/victoria
+    override-checkout: unmaintained/victoria
     required-projects: &required-projects-victoria
       - openstack/neutron
       - name: openstack/neutron-tempest-plugin
@@ -134,7 +134,7 @@
 - job:
     name: neutron-tempest-plugin-scenario-openvswitch-victoria
     parent: neutron-tempest-plugin-openvswitch
-    override-checkout: stable/victoria
+    override-checkout: unmaintained/victoria
     required-projects: *required-projects-victoria
     vars:
       tempest_test_regex: "\
@@ -151,6 +151,7 @@
         ADVANCED_INSTANCE_TYPE: ds512M
         ADVANCED_INSTANCE_USER: ubuntu
         CUSTOMIZE_IMAGE: false
+        NEUTRON_DEPLOY_MOD_WSGI: false
       devstack_local_conf:
         test-config:
           $TEMPEST_CONFIG:
@@ -162,7 +163,7 @@
 - job:
     name: neutron-tempest-plugin-scenario-openvswitch-iptables_hybrid-victoria
     parent: neutron-tempest-plugin-openvswitch-iptables_hybrid
-    override-checkout: stable/victoria
+    override-checkout: unmaintained/victoria
     required-projects: *required-projects-victoria
     vars:
       tempest_test_regex: "\
@@ -183,6 +184,7 @@
         ADVANCED_INSTANCE_TYPE: ds512M
         ADVANCED_INSTANCE_USER: ubuntu
         CUSTOMIZE_IMAGE: false
+        NEUTRON_DEPLOY_MOD_WSGI: false
       devstack_local_conf:
         test-config:
           $TEMPEST_CONFIG:
@@ -194,7 +196,7 @@
 - job:
     name: neutron-tempest-plugin-scenario-linuxbridge-victoria
     parent: neutron-tempest-plugin-linuxbridge
-    override-checkout: stable/victoria
+    override-checkout: unmaintained/victoria
     required-projects: *required-projects-victoria
     vars:
       tempest_test_regex: "\
@@ -222,7 +224,7 @@
 - job:
     name: neutron-tempest-plugin-scenario-ovn-victoria
     parent: neutron-tempest-plugin-ovn
-    override-checkout: stable/victoria
+    override-checkout: unmaintained/victoria
     required-projects: *required-projects-victoria
     vars:
       tempest_test_regex: "\
@@ -253,15 +255,17 @@
     name: neutron-tempest-plugin-dvr-multinode-scenario-victoria
     parent: neutron-tempest-plugin-dvr-multinode-scenario
     nodeset: openstack-two-node-focal
-    override-checkout: stable/victoria
+    override-checkout: unmaintained/victoria
     required-projects: *required-projects-victoria
     vars:
       network_api_extensions_common: *api_extensions
+      devstack_localrc:
+        NEUTRON_DEPLOY_MOD_WSGI: false
 
 - job:
     name: neutron-tempest-plugin-designate-scenario-victoria
     parent: neutron-tempest-plugin-designate-scenario
-    override-checkout: stable/victoria
+    override-checkout: unmaintained/victoria
     required-projects:
       - openstack/neutron
       - name: openstack/neutron-tempest-plugin
@@ -278,30 +282,35 @@
         ADVANCED_INSTANCE_TYPE: ds512M
         ADVANCED_INSTANCE_USER: ubuntu
         CUSTOMIZE_IMAGE: false
+        NEUTRON_DEPLOY_MOD_WSGI: false
 
 - job:
     name: neutron-tempest-plugin-sfc-victoria
     parent: neutron-tempest-plugin-sfc
     nodeset: openstack-single-node-focal
-    override-checkout: stable/victoria
+    override-checkout: unmaintained/victoria
     required-projects: *required-projects-victoria
     vars:
       network_api_extensions_common: *api_extensions
+      devstack_localrc:
+        NEUTRON_DEPLOY_MOD_WSGI: false
 
 - job:
     name: neutron-tempest-plugin-bgpvpn-bagpipe-victoria
     parent: neutron-tempest-plugin-bgpvpn-bagpipe
     nodeset: openstack-single-node-focal
-    override-checkout: stable/victoria
+    override-checkout: unmaintained/victoria
     required-projects: *required-projects-victoria
     vars:
       network_api_extensions: *api_extensions
+      devstack_localrc:
+        NEUTRON_DEPLOY_MOD_WSGI: false
 
 - job:
     name: neutron-tempest-plugin-dynamic-routing-victoria
     parent: neutron-tempest-plugin-dynamic-routing
     nodeset: openstack-single-node-focal
-    override-checkout: stable/victoria
+    override-checkout: unmaintained/victoria
     required-projects: *required-projects-victoria
     vars:
       network_api_extensions_common: *api_extensions
@@ -310,7 +319,9 @@
     name: neutron-tempest-plugin-vpnaas-victoria
     parent: neutron-tempest-plugin-vpnaas
     nodeset: openstack-single-node-focal
-    override-checkout: stable/victoria
+    override-checkout: unmaintained/victoria
     required-projects: *required-projects-victoria
     vars:
       network_api_extensions_common: *api_extensions
+      devstack_localrc:
+        NEUTRON_DEPLOY_MOD_WSGI: false
diff --git a/zuul.d/wallaby_jobs.yaml b/zuul.d/wallaby_jobs.yaml
index 8a771b8..7df6876 100644
--- a/zuul.d/wallaby_jobs.yaml
+++ b/zuul.d/wallaby_jobs.yaml
@@ -2,7 +2,7 @@
     name: neutron-tempest-plugin-api-wallaby
     parent: neutron-tempest-plugin-base
     nodeset: openstack-single-node-focal
-    override-checkout: stable/wallaby
+    override-checkout: unmaintained/wallaby
     required-projects: &required-projects-wallaby
       - openstack/neutron
       - name: openstack/neutron-tempest-plugin
@@ -98,7 +98,7 @@
 - job:
     name: neutron-tempest-plugin-scenario-openvswitch-wallaby
     parent: neutron-tempest-plugin-openvswitch
-    override-checkout: stable/wallaby
+    override-checkout: unmaintained/wallaby
     required-projects: *required-projects-wallaby
     vars:
       tempest_test_regex: "\
@@ -109,6 +109,7 @@
       network_available_features: *available_features
       devstack_localrc:
         NETWORK_API_EXTENSIONS: "{{ network_api_extensions | join(',') }}"
+        NEUTRON_DEPLOY_MOD_WSGI: false
       devstack_local_conf:
         test-config:
           $TEMPEST_CONFIG:
@@ -118,7 +119,7 @@
 - job:
     name: neutron-tempest-plugin-scenario-openvswitch-iptables_hybrid-wallaby
     parent: neutron-tempest-plugin-openvswitch-iptables_hybrid
-    override-checkout: stable/wallaby
+    override-checkout: unmaintained/wallaby
     required-projects: *required-projects-wallaby
     vars:
       tempest_test_regex: "\
@@ -136,6 +137,7 @@
           (^neutron_tempest_plugin.scenario.test_security_groups.NetworkSecGroupTest.test_established_tcp_session_after_re_attachinging_sg)"
       devstack_localrc:
         NETWORK_API_EXTENSIONS: "{{ network_api_extensions | join(',') }}"
+        NEUTRON_DEPLOY_MOD_WSGI: false
       devstack_local_conf:
         test-config:
           $TEMPEST_CONFIG:
@@ -145,7 +147,7 @@
 - job:
     name: neutron-tempest-plugin-scenario-linuxbridge-wallaby
     parent: neutron-tempest-plugin-linuxbridge
-    override-checkout: stable/wallaby
+    override-checkout: unmaintained/wallaby
     required-projects: *required-projects-wallaby
     vars:
       tempest_test_regex: "\
@@ -165,7 +167,7 @@
 - job:
     name: neutron-tempest-plugin-scenario-ovn-wallaby
     parent: neutron-tempest-plugin-ovn
-    override-checkout: stable/wallaby
+    override-checkout: unmaintained/wallaby
     required-projects: *required-projects-wallaby
     vars:
       tempest_test_regex: "\
@@ -190,15 +192,17 @@
     name: neutron-tempest-plugin-dvr-multinode-scenario-wallaby
     parent: neutron-tempest-plugin-dvr-multinode-scenario
     nodeset: openstack-two-node-focal
-    override-checkout: stable/wallaby
+    override-checkout: unmaintained/wallaby
     required-projects: *required-projects-wallaby
     vars:
       network_api_extensions_common: *api_extensions
+      devstack_localrc:
+        NEUTRON_DEPLOY_MOD_WSGI: false
 
 - job:
     name: neutron-tempest-plugin-designate-scenario-wallaby
     parent: neutron-tempest-plugin-designate-scenario
-    override-checkout: stable/wallaby
+    override-checkout: unmaintained/wallaby
     required-projects:
       - openstack/neutron
       - name: openstack/neutron-tempest-plugin
@@ -213,25 +217,29 @@
     name: neutron-tempest-plugin-sfc-wallaby
     parent: neutron-tempest-plugin-sfc
     nodeset: openstack-single-node-focal
-    override-checkout: stable/wallaby
+    override-checkout: unmaintained/wallaby
     required-projects: *required-projects-wallaby
     vars:
       network_api_extensions_common: *api_extensions
+      devstack_localrc:
+        NEUTRON_DEPLOY_MOD_WSGI: false
 
 - job:
     name: neutron-tempest-plugin-bgpvpn-bagpipe-wallaby
     parent: neutron-tempest-plugin-bgpvpn-bagpipe
     nodeset: openstack-single-node-focal
-    override-checkout: stable/wallaby
+    override-checkout: unmaintained/wallaby
     required-projects: *required-projects-wallaby
     vars:
       network_api_extensions: *api_extensions
+      devstack_localrc:
+        NEUTRON_DEPLOY_MOD_WSGI: false
 
 - job:
     name: neutron-tempest-plugin-dynamic-routing-wallaby
     parent: neutron-tempest-plugin-dynamic-routing
     nodeset: openstack-single-node-focal
-    override-checkout: stable/wallaby
+    override-checkout: unmaintained/wallaby
     required-projects: *required-projects-wallaby
     vars:
       network_api_extensions_common: *api_extensions
@@ -240,7 +248,9 @@
     name: neutron-tempest-plugin-vpnaas-wallaby
     parent: neutron-tempest-plugin-vpnaas
     nodeset: openstack-single-node-focal
-    override-checkout: stable/wallaby
+    override-checkout: unmaintained/wallaby
     required-projects: *required-projects-wallaby
     vars:
       network_api_extensions_common: *api_extensions
+      devstack_localrc:
+        NEUTRON_DEPLOY_MOD_WSGI: false
diff --git a/zuul.d/xena_jobs.yaml b/zuul.d/xena_jobs.yaml
index 9f8e960..e1e13c4 100644
--- a/zuul.d/xena_jobs.yaml
+++ b/zuul.d/xena_jobs.yaml
@@ -2,7 +2,7 @@
     name: neutron-tempest-plugin-api-xena
     parent: neutron-tempest-plugin-base
     nodeset: openstack-single-node-focal
-    override-checkout: stable/xena
+    override-checkout: unmaintained/xena
     required-projects: &required-projects-xena
       - openstack/neutron
       - name: openstack/neutron-tempest-plugin
@@ -100,7 +100,7 @@
 - job:
     name: neutron-tempest-plugin-scenario-openvswitch-xena
     parent: neutron-tempest-plugin-openvswitch
-    override-checkout: stable/xena
+    override-checkout: unmaintained/xena
     required-projects: *required-projects-xena
     vars:
       tempest_test_regex: "\
@@ -111,6 +111,7 @@
       network_available_features: *available_features
       devstack_localrc:
         NETWORK_API_EXTENSIONS: "{{ network_api_extensions | join(',') }}"
+        NEUTRON_DEPLOY_MOD_WSGI: false
       devstack_local_conf:
         test-config:
           $TEMPEST_CONFIG:
@@ -120,7 +121,7 @@
 - job:
     name: neutron-tempest-plugin-scenario-openvswitch-iptables_hybrid-xena
     parent: neutron-tempest-plugin-openvswitch-iptables_hybrid
-    override-checkout: stable/xena
+    override-checkout: unmaintained/xena
     required-projects: *required-projects-xena
     vars:
       tempest_test_regex: "\
@@ -131,6 +132,7 @@
       network_available_features: *available_features
       devstack_localrc:
         NETWORK_API_EXTENSIONS: "{{ network_api_extensions | join(',') }}"
+        NEUTRON_DEPLOY_MOD_WSGI: false
       devstack_local_conf:
         test-config:
           $TEMPEST_CONFIG:
@@ -140,7 +142,7 @@
 - job:
     name: neutron-tempest-plugin-scenario-linuxbridge-xena
     parent: neutron-tempest-plugin-linuxbridge
-    override-checkout: stable/xena
+    override-checkout: unmaintained/xena
     required-projects: *required-projects-xena
     vars:
       tempest_test_regex: "\
@@ -160,7 +162,7 @@
 - job:
     name: neutron-tempest-plugin-scenario-ovn-xena
     parent: neutron-tempest-plugin-ovn
-    override-checkout: stable/xena
+    override-checkout: unmaintained/xena
     required-projects: *required-projects-xena
     vars:
       tempest_test_regex: "\
@@ -183,15 +185,17 @@
     name: neutron-tempest-plugin-dvr-multinode-scenario-xena
     parent: neutron-tempest-plugin-dvr-multinode-scenario
     nodeset: openstack-two-node-focal
-    override-checkout: stable/xena
+    override-checkout: unmaintained/xena
     required-projects: *required-projects-xena
     vars:
       network_api_extensions_common: *api_extensions
+      devstack_localrc:
+        NEUTRON_DEPLOY_MOD_WSGI: false
 
 - job:
     name: neutron-tempest-plugin-designate-scenario-xena
     parent: neutron-tempest-plugin-designate-scenario
-    override-checkout: stable/xena
+    override-checkout: unmaintained/xena
     required-projects: *required-projects-xena
     vars:
       network_api_extensions_common: *api_extensions
@@ -200,25 +204,29 @@
     name: neutron-tempest-plugin-sfc-xena
     parent: neutron-tempest-plugin-sfc
     nodeset: openstack-single-node-focal
-    override-checkout: stable/xena
+    override-checkout: unmaintained/xena
     required-projects: *required-projects-xena
     vars:
       network_api_extensions_common: *api_extensions
+      devstack_localrc:
+        NEUTRON_DEPLOY_MOD_WSGI: false
 
 - job:
     name: neutron-tempest-plugin-bgpvpn-bagpipe-xena
     parent: neutron-tempest-plugin-bgpvpn-bagpipe
     nodeset: openstack-single-node-focal
-    override-checkout: stable/xena
+    override-checkout: unmaintained/xena
     required-projects: *required-projects-xena
     vars:
       network_api_extensions: *api_extensions
+      devstack_localrc:
+        NEUTRON_DEPLOY_MOD_WSGI: false
 
 - job:
     name: neutron-tempest-plugin-dynamic-routing-xena
     parent: neutron-tempest-plugin-dynamic-routing
     nodeset: openstack-single-node-focal
-    override-checkout: stable/xena
+    override-checkout: unmaintained/xena
     required-projects: *required-projects-xena
     vars:
       network_api_extensions_common: *api_extensions
@@ -227,6 +235,7 @@
         Q_AGENT: openvswitch
         Q_ML2_TENANT_NETWORK_TYPE: vxlan
         Q_ML2_PLUGIN_MECHANISM_DRIVERS: openvswitch
+        NEUTRON_DEPLOY_MOD_WSGI: false
       devstack_services:
         # Disable OVN services
         br-ex-tcpdump: false
@@ -249,16 +258,20 @@
     name: neutron-tempest-plugin-vpnaas-xena
     parent: neutron-tempest-plugin-vpnaas
     nodeset: openstack-single-node-focal
-    override-checkout: stable/xena
+    override-checkout: unmaintained/xena
     required-projects: *required-projects-xena
     vars:
       network_api_extensions_common: *api_extensions
+      devstack_localrc:
+        NEUTRON_DEPLOY_MOD_WSGI: false
 
 - job:
     name: neutron-tempest-plugin-tap-as-a-service-xena
     parent: neutron-tempest-plugin-tap-as-a-service
     nodeset: openstack-single-node-focal
-    override-checkout: stable/xena
+    override-checkout: unmaintained/xena
     required-projects: *required-projects-xena
     vars:
       network_api_extensions_common: *api_extensions
+      devstack_localrc:
+        NEUTRON_DEPLOY_MOD_WSGI: false
diff --git a/zuul.d/yoga_jobs.yaml b/zuul.d/yoga_jobs.yaml
index 76cac3e..6e0ddcd 100644
--- a/zuul.d/yoga_jobs.yaml
+++ b/zuul.d/yoga_jobs.yaml
@@ -6,9 +6,7 @@
     required-projects: &required-projects-yoga
       - openstack/neutron
       - name: openstack/neutron-tempest-plugin
-        # Move to 2.6.0 once released
-        # https://review.opendev.org/c/openstack/releases/+/908369
-        override-checkout: 2.5.0
+        override-checkout: 2.6.0
       - openstack/tempest
     vars:
       tempest_concurrency: 4
@@ -116,6 +114,7 @@
       network_available_features: *available_features
       devstack_localrc:
         NETWORK_API_EXTENSIONS: "{{ (network_api_extensions + network_api_extensions_openvswitch) | join(',') }}"
+        NEUTRON_DEPLOY_MOD_WSGI: false
       devstack_local_conf:
         test-config:
           $TEMPEST_CONFIG:
@@ -137,6 +136,7 @@
       network_available_features: *available_features
       devstack_localrc:
         NETWORK_API_EXTENSIONS: "{{ (network_api_extensions + network_api_extensions_openvswitch) | join(',') }}"
+        NEUTRON_DEPLOY_MOD_WSGI: false
       devstack_local_conf:
         test-config:
           $TEMPEST_CONFIG:
@@ -197,6 +197,8 @@
     required-projects: *required-projects-yoga
     vars:
       network_api_extensions_common: *api_extensions
+      devstack_localrc:
+        NEUTRON_DEPLOY_MOD_WSGI: false
 
 - job:
     name: neutron-tempest-plugin-designate-scenario-yoga
@@ -215,6 +217,8 @@
     required-projects: *required-projects-yoga
     vars:
       network_api_extensions_common: *api_extensions
+      devstack_localrc:
+        NEUTRON_DEPLOY_MOD_WSGI: false
 
 - job:
     name: neutron-tempest-plugin-bgpvpn-bagpipe-yoga
@@ -224,6 +228,8 @@
     required-projects: *required-projects-yoga
     vars:
       network_api_extensions: *api_extensions
+      devstack_localrc:
+        NEUTRON_DEPLOY_MOD_WSGI: false
 
 - job:
     name: neutron-tempest-plugin-dynamic-routing-yoga
@@ -238,6 +244,7 @@
         Q_AGENT: openvswitch
         Q_ML2_TENANT_NETWORK_TYPE: vxlan
         Q_ML2_PLUGIN_MECHANISM_DRIVERS: openvswitch
+        NEUTRON_DEPLOY_MOD_WSGI: false
       devstack_services:
         # Disable OVN services
         br-ex-tcpdump: false
@@ -264,6 +271,8 @@
     required-projects: *required-projects-yoga
     vars:
       network_api_extensions_common: *api_extensions
+      devstack_localrc:
+        NEUTRON_DEPLOY_MOD_WSGI: false
 
 - job:
     name: neutron-tempest-plugin-tap-as-a-service-yoga
@@ -273,3 +282,5 @@
     required-projects: *required-projects-yoga
     vars:
       network_api_extensions_common: *api_extensions
+      devstack_localrc:
+        NEUTRON_DEPLOY_MOD_WSGI: false
diff --git a/zuul.d/zed_jobs.yaml b/zuul.d/zed_jobs.yaml
index 7d8b2e1..54e9af5 100644
--- a/zuul.d/zed_jobs.yaml
+++ b/zuul.d/zed_jobs.yaml
@@ -1,8 +1,13 @@
 - job:
     name: neutron-tempest-plugin-openvswitch-zed
     parent: neutron-tempest-plugin-openvswitch
-    override-checkout: stable/zed
+    override-checkout: unmaintained/zed
     nodeset: neutron-nested-virt-ubuntu-focal
+    required-projects: &required-projects-zed
+      - openstack/neutron
+      - name: openstack/neutron-tempest-plugin
+        override-checkout: zed-last
+      - openstack/tempest
     vars:
       network_api_extensions_openvswitch:
         - local_ip
@@ -97,6 +102,7 @@
         - ipv6_metadata
       devstack_localrc:
         NETWORK_API_EXTENSIONS: "{{ (network_api_extensions_common + network_api_extensions_openvswitch) | join(',') }}"
+        NEUTRON_DEPLOY_MOD_WSGI: false
       devstack_local_conf:
         test-config:
           $TEMPEST_CONFIG:
@@ -106,7 +112,8 @@
 - job:
     name: neutron-tempest-plugin-openvswitch-iptables_hybrid-zed
     parent: neutron-tempest-plugin-openvswitch-iptables_hybrid
-    override-checkout: stable/zed
+    override-checkout: unmaintained/zed
+    required-projects: *required-projects-zed
     nodeset: neutron-nested-virt-ubuntu-focal
     vars:
       network_api_extensions_common: *api_extensions
@@ -131,6 +138,7 @@
       network_available_features: *available_features
       devstack_localrc:
         NETWORK_API_EXTENSIONS: "{{ (network_api_extensions_common + network_api_extensions_openvswitch) | join(',') }}"
+        NEUTRON_DEPLOY_MOD_WSGI: false
       devstack_local_conf:
         test-config:
           $TEMPEST_CONFIG:
@@ -140,7 +148,8 @@
 - job:
     name: neutron-tempest-plugin-linuxbridge-zed
     parent: neutron-tempest-plugin-linuxbridge
-    override-checkout: stable/zed
+    override-checkout: unmaintained/zed
+    required-projects: *required-projects-zed
     nodeset: neutron-nested-virt-ubuntu-focal
     vars:
       network_api_extensions_common: *api_extensions
@@ -168,7 +177,8 @@
 - job:
     name: neutron-tempest-plugin-ovn-zed
     parent: neutron-tempest-plugin-ovn
-    override-checkout: stable/zed
+    override-checkout: unmaintained/zed
+    required-projects: *required-projects-zed
     nodeset: neutron-nested-virt-ubuntu-focal
     vars:
       tempest_test_regex: "\
@@ -176,8 +186,6 @@
           (^neutron_tempest_plugin.scenario)|\
           (^tempest.api.compute.servers.test_attach_interfaces)|\
           (^tempest.api.compute.servers.test_multiple_create)"
-      tempest_exclude_regex: "\
-          (^neutron_tempest_plugin.scenario.test_mtu.NetworkWritableMtuTest)"
       network_api_extensions: *api_extensions
       network_api_extensions_ovn:
         - vlan-transparent
@@ -196,14 +204,18 @@
     name: neutron-tempest-plugin-dvr-multinode-scenario-zed
     parent: neutron-tempest-plugin-dvr-multinode-scenario
     nodeset: openstack-two-node-focal
-    override-checkout: stable/zed
+    override-checkout: unmaintained/zed
+    required-projects: *required-projects-zed
     vars:
       network_api_extensions_common: *api_extensions
+      devstack_localrc:
+        NEUTRON_DEPLOY_MOD_WSGI: false
 
 - job:
     name: neutron-tempest-plugin-designate-scenario-zed
     parent: neutron-tempest-plugin-designate-scenario
-    override-checkout: stable/zed
+    override-checkout: unmaintained/zed
+    required-projects: *required-projects-zed
     nodeset: neutron-nested-virt-ubuntu-focal
     vars:
       network_api_extensions_common: *api_extensions
@@ -212,23 +224,30 @@
     name: neutron-tempest-plugin-sfc-zed
     parent: neutron-tempest-plugin-sfc
     nodeset: openstack-single-node-focal
-    override-checkout: stable/zed
+    override-checkout: unmaintained/zed
+    required-projects: *required-projects-zed
     vars:
       network_api_extensions_common: *api_extensions
+      devstack_localrc:
+        NEUTRON_DEPLOY_MOD_WSGI: false
 
 - job:
     name: neutron-tempest-plugin-bgpvpn-bagpipe-zed
     parent: neutron-tempest-plugin-bgpvpn-bagpipe
     nodeset: openstack-single-node-focal
-    override-checkout: stable/zed
+    override-checkout: unmaintained/zed
+    required-projects: *required-projects-zed
     vars:
       network_api_extensions: *api_extensions
+      devstack_localrc:
+        NEUTRON_DEPLOY_MOD_WSGI: false
 
 - job:
     name: neutron-tempest-plugin-dynamic-routing-zed
     parent: neutron-tempest-plugin-dynamic-routing
     nodeset: openstack-single-node-focal
-    override-checkout: stable/zed
+    override-checkout: unmaintained/zed
+    required-projects: *required-projects-zed
     vars:
       network_api_extensions_common: *api_extensions
       devstack_localrc:
@@ -258,22 +277,31 @@
     name: neutron-tempest-plugin-fwaas-zed
     parent: neutron-tempest-plugin-fwaas
     nodeset: openstack-single-node-focal
-    override-checkout: stable/zed
+    override-checkout: unmaintained/zed
+    required-projects: *required-projects-zed
     vars:
       network_api_extensions_common: *api_extensions
+      devstack_localrc:
+        NEUTRON_DEPLOY_MOD_WSGI: false
 
 - job:
     name: neutron-tempest-plugin-vpnaas-zed
     parent: neutron-tempest-plugin-vpnaas
     nodeset: openstack-single-node-focal
-    override-checkout: stable/zed
+    override-checkout: unmaintained/zed
+    required-projects: *required-projects-zed
     vars:
       network_api_extensions_common: *api_extensions
+      devstack_localrc:
+        NEUTRON_DEPLOY_MOD_WSGI: false
 
 - job:
     name: neutron-tempest-plugin-tap-as-a-service-zed
     parent: neutron-tempest-plugin-tap-as-a-service
     nodeset: openstack-single-node-focal
-    override-checkout: stable/zed
+    override-checkout: unmaintained/zed
+    required-projects: *required-projects-zed
     vars:
       network_api_extensions_common: *api_extensions
+      devstack_localrc:
+        NEUTRON_DEPLOY_MOD_WSGI: false