diff --git a/neutron_tempest_plugin/scenario/base.py b/neutron_tempest_plugin/scenario/base.py
index 021b3b7..72139de 100644
--- a/neutron_tempest_plugin/scenario/base.py
+++ b/neutron_tempest_plugin/scenario/base.py
@@ -285,7 +285,8 @@
         client.delete_interface(server_id, port_id=port_id)
 
     def setup_network_and_server(self, router=None, server_name=None,
-                                 network=None, **kwargs):
+                                 network=None, use_stateless_sg=False,
+                                 **kwargs):
         """Create network resources and a server.
 
         Creating a network, subnet, router, keypair, security group
@@ -296,8 +297,13 @@
         self.subnet = self.create_subnet(self.network)
         LOG.debug("Created subnet %s", self.subnet['id'])
 
+        sg_args = {
+            'name': data_utils.rand_name('secgroup')
+        }
+        if use_stateless_sg:
+            sg_args['stateful'] = False
         secgroup = self.os_primary.network_client.create_security_group(
-            name=data_utils.rand_name('secgroup'))
+            **sg_args)
         LOG.debug("Created security group %s",
                   secgroup['security_group']['name'])
         self.security_groups.append(secgroup['security_group'])
@@ -307,6 +313,9 @@
         self.keypair = self.create_keypair()
         self.create_loginable_secgroup_rule(
             secgroup_id=secgroup['security_group']['id'])
+        if use_stateless_sg:
+            self.create_ingress_metadata_secgroup_rule(
+                secgroup_id=secgroup['security_group']['id'])
 
         server_kwargs = {
             'flavor_ref': CONF.compute.flavor_ref,
diff --git a/neutron_tempest_plugin/scenario/test_portsecurity.py b/neutron_tempest_plugin/scenario/test_portsecurity.py
index c90db08..db0a056 100644
--- a/neutron_tempest_plugin/scenario/test_portsecurity.py
+++ b/neutron_tempest_plugin/scenario/test_portsecurity.py
@@ -11,7 +11,9 @@
 #    WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
 #    License for the specific language governing permissions and limitations
 #    under the License.
+import testtools
 
+from tempest.common import utils
 from tempest.lib import decorators
 
 from neutron_tempest_plugin import config
@@ -24,15 +26,14 @@
     credentials = ['primary', 'admin']
     required_extensions = ['port-security']
 
-    @decorators.idempotent_id('61ab176e-d48b-42b7-b38a-1ba571ecc033')
-    def test_port_security_removed_added(self):
+    def _test_port_security_removed_added(self, use_stateless_sg):
         """Test connection works after port security has been removed
 
         Initial test that vm is accessible. Then port security is removed,
         checked connectivity. Port security is added back and checked
         connectivity again.
         """
-        self.setup_network_and_server()
+        self.setup_network_and_server(use_stateless_sg=use_stateless_sg)
         self.check_connectivity(self.fip['floating_ip_address'],
                                 CONF.validation.image_ssh_user,
                                 self.keypair['private_key'])
@@ -51,3 +52,18 @@
         self.check_connectivity(self.fip['floating_ip_address'],
                                 CONF.validation.image_ssh_user,
                                 self.keypair['private_key'])
+
+    @decorators.idempotent_id('61ab176e-d48b-42b7-b38a-1ba571ecc033')
+    def test_port_security_removed_added_stateful_sg(self):
+        self._test_port_security_removed_added(use_stateless_sg=False)
+
+    @decorators.idempotent_id('2f4005e1-cee1-40e5-adbd-b3e3cf218065')
+    @testtools.skipUnless(
+        utils.is_extension_enabled('stateful-security-group', 'network'),
+        "'stateful-security-group' API extension not available")
+    @testtools.skipIf(
+        CONF.neutron_plugin_options.firewall_driver in ['openvswitch', 'None'],
+        "Firewall driver other than 'openvswitch' is required to use "
+        "stateless security groups.")
+    def test_port_security_removed_added_stateless_sg(self):
+        self._test_port_security_removed_added(use_stateless_sg=True)