diff --git a/neutron_tempest_plugin/api/admin/test_agent_management.py b/neutron_tempest_plugin/api/admin/test_agent_management.py
index f63e81b..399e428 100644
--- a/neutron_tempest_plugin/api/admin/test_agent_management.py
+++ b/neutron_tempest_plugin/api/admin/test_agent_management.py
@@ -38,9 +38,13 @@
         # Heartbeats must be excluded from comparison
         self.agent.pop('heartbeat_timestamp', None)
         self.agent.pop('configurations', None)
+        # Exclude alive as it can happen that when testclass'
+        # resource_setup executed the selected agent is not up
+        self.agent.pop('alive', None)
         for agent in agents:
             agent.pop('heartbeat_timestamp', None)
             agent.pop('configurations', None)
+            agent.pop('alive', None)
         self.assertIn(self.agent, agents)
 
     @decorators.idempotent_id('e335be47-b9a1-46fd-be30-0874c0b751e6')
diff --git a/neutron_tempest_plugin/api/test_security_groups.py b/neutron_tempest_plugin/api/test_security_groups.py
index 0970d83..d251f8c 100644
--- a/neutron_tempest_plugin/api/test_security_groups.py
+++ b/neutron_tempest_plugin/api/test_security_groups.py
@@ -143,6 +143,47 @@
             ' is: {}'.format(same_name_sg_number))
 
 
+class StatelessSecGroupTest(base.BaseAdminNetworkTest):
+
+    required_extensions = ['security-group', 'stateful-security-group']
+
+    @decorators.idempotent_id('0a6c1476-3d1a-11ec-b0ec-0800277ac3d9')
+    def test_stateless_security_group_update(self):
+        security_group = self.create_security_group(stateful=True)
+
+        # List security groups and verify if created group is there in response
+        security_groups = self.client.list_security_groups()['security_groups']
+        found = False
+        for sg in security_groups:
+            if sg['id'] == security_group['id']:
+                found = True
+                break
+        self.assertTrue(found)
+        self.assertTrue(sg['stateful'])
+
+        # Switch to stateless
+        updated_security_group = self.client.update_security_group(
+            security_group['id'], stateful=False)['security_group']
+
+        # Verify if security group is updated
+        self.assertFalse(updated_security_group['stateful'])
+
+        observed_security_group = self.client.show_security_group(
+            security_group['id'])['security_group']
+        self.assertFalse(observed_security_group['stateful'])
+
+        # Switch back to stateful
+        updated_security_group = self.client.update_security_group(
+            security_group['id'], stateful=True)['security_group']
+
+        # Verify if security group is stateful again
+        self.assertTrue(updated_security_group['stateful'])
+
+        observed_security_group = self.client.show_security_group(
+            security_group['id'])['security_group']
+        self.assertTrue(observed_security_group['stateful'])
+
+
 class BaseSecGroupQuota(base.BaseAdminNetworkTest):
 
     def _create_max_allowed_sg_amount(self):
diff --git a/neutron_tempest_plugin/scenario/admin/test_floatingip.py b/neutron_tempest_plugin/scenario/admin/test_floatingip.py
index a08acc3..d9abaf5 100644
--- a/neutron_tempest_plugin/scenario/admin/test_floatingip.py
+++ b/neutron_tempest_plugin/scenario/admin/test_floatingip.py
@@ -28,6 +28,14 @@
     credentials = ['primary', 'admin']
 
     @classmethod
+    def setup_clients(cls):
+        super(FloatingIpTestCasesAdmin, cls).setup_clients()
+        # admin_client set in BaseAdminNetworkTest but here we inherit from
+        # BaseNetworkTest
+        if not cls.admin_client:
+            cls.admin_client = cls.os_admin.network_client
+
+    @classmethod
     @utils.requires_ext(extension="router", service="network")
     def resource_setup(cls):
         super(FloatingIpTestCasesAdmin, cls).resource_setup()
@@ -75,7 +83,7 @@
             waiters.wait_for_server_status(
                 self.os_admin.servers_client, server['server']['id'],
                 const.SERVER_STATUS_ACTIVE)
-            port = self.client.list_ports(
+            port = self.admin_client.list_ports(
                 network_id=self.network['id'],
                 device_id=server['server']['id']
             )['ports'][0]
diff --git a/neutron_tempest_plugin/scenario/base.py b/neutron_tempest_plugin/scenario/base.py
index 8591c89..6674cb8 100644
--- a/neutron_tempest_plugin/scenario/base.py
+++ b/neutron_tempest_plugin/scenario/base.py
@@ -534,7 +534,7 @@
             return False
 
         try:
-            utils.wait_until_true(system_booted, sleep=5)
+            utils.wait_until_true(system_booted, timeout=90, sleep=5)
         except utils.WaitTimeout:
             LOG.debug("No correct output in console of server %s found. "
                       "Guest operating system status can't be checked.",
diff --git a/neutron_tempest_plugin/scenario/test_internal_dns.py b/neutron_tempest_plugin/scenario/test_internal_dns.py
index c0a2c04..692bb70 100644
--- a/neutron_tempest_plugin/scenario/test_internal_dns.py
+++ b/neutron_tempest_plugin/scenario/test_internal_dns.py
@@ -13,7 +13,9 @@
 #    License for the specific language governing permissions and limitations
 #    under the License.
 
+from oslo_log import log
 from tempest.common import utils
+from tempest.lib.common.utils import data_utils
 from tempest.lib import decorators
 
 from neutron_tempest_plugin.common import ssh
@@ -21,9 +23,63 @@
 from neutron_tempest_plugin.scenario import base
 
 CONF = config.CONF
+LOG = log.getLogger(__name__)
 
 
-class InternalDNSTest(base.BaseTempestTestCase):
+class InternalDNSBase(base.BaseTempestTestCase):
+    """Base class of useful resources and functionalities for test class."""
+
+    port_error_msg = ('Openstack command returned incorrect '
+                      'hostname value in port.')
+    ssh_error_msg = ('Remote shell command returned incorrect hostname value '
+                     "(command: 'hostname' OR 'cat /etc/hostname').")
+
+    @staticmethod
+    def _rand_name(name):
+        """'data_utils.rand_name' wrapper, show name related to test suite."""
+        return data_utils.rand_name(f'internal-dns-test-{name}')
+
+    @classmethod
+    def resource_setup(cls):
+        super(InternalDNSBase, cls).resource_setup()
+        cls.router = cls.create_router_by_client()
+        cls.keypair = cls.create_keypair(
+            name=cls._rand_name('shared-keypair'))
+        cls.secgroup = cls.create_security_group(
+            name=cls._rand_name('shared-secgroup'))
+        cls.security_groups.append(cls.secgroup)
+        cls.create_loginable_secgroup_rule(
+            secgroup_id=cls.secgroup['id'])
+        cls.vm_kwargs = {
+            'flavor_ref': CONF.compute.flavor_ref,
+            'image_ref': CONF.compute.image_ref,
+            'key_name': cls.keypair['name'],
+            'security_groups': [{'name': cls.secgroup['name']}]
+        }
+
+    def _create_ssh_client(self, ip_addr):
+        return ssh.Client(ip_addr,
+                          CONF.validation.image_ssh_user,
+                          pkey=self.keypair['private_key'])
+
+    def _validate_port_dns_details(self, checked_hostname, checked_port):
+        """Validates reused objects for correct dns values in tests."""
+        dns_details = checked_port['dns_assignment'][0]
+        self.assertEqual(checked_hostname, checked_port['dns_name'],
+                         self.port_error_msg)
+        self.assertEqual(checked_hostname, dns_details['hostname'],
+                         self.port_error_msg)
+        self.assertIn(checked_hostname, dns_details['fqdn'],
+                      self.port_error_msg)
+
+    def _validate_ssh_dns_details(self, checked_hostname, ssh_client):
+        """Validates correct dns values returned from ssh command in tests."""
+        ssh_output = ssh_client.get_hostname()
+        self.assertIn(checked_hostname, ssh_output, self.ssh_error_msg)
+
+
+class InternalDNSTest(InternalDNSBase):
+    """Tests internal DNS capabilities."""
     credentials = ['primary', 'admin']
 
     @utils.requires_ext(extension="dns-integration", service="network")
@@ -52,8 +108,6 @@
             security_groups=[
                 {'name': self.security_groups[-1]['name']}],
             name='leia')
-        self.wait_for_server_active(leia['server'])
-        self.wait_for_guest_os_ready(leia['server'])
 
         ssh_client = ssh.Client(
             self.fip['floating_ip_address'],
@@ -82,3 +136,49 @@
                                        servers=[self.server, leia])
         self.check_remote_connectivity(ssh_client, 'leia.openstackgate.local',
                                        servers=[self.server, leia])
+
+    @utils.requires_ext(extension="dns-integration", service="network")
+    @decorators.idempotent_id('db5e612f-f17f-4974-b5f1-9fe89f4a6fc9')
+    def test_create_and_update_port_with_dns_name(self):
+        """Test creation of port with correct internal dns-name (hostname)."""
+
+        # 1) Create resources: network, subnet, etc.
+        # 2) Create a port with wrong dns-name (not as VM name).
+        # 3) Verify that wrong port initial dns-name.
+        #    was queried from openstack API.
+        # 4) Update the port with correct dns-name (as VM name).
+        # 5) Boot a VM with corrected predefined port.
+        # 6) Verify that correct port dns-name
+        #    was queried from openstack API.
+        # 7) Validate hostname configured on VM is same as VM's name.
+
+        # NOTE: VM's hostname has to be the same as VM's name
+        #       when a VM is created, it is a known limitation.
+        #       Therefore VM's dns-name/hostname is checked to be as VM's name.
+
+        vm_correct_name = self._rand_name('vm')
+        vm_wrong_name = self._rand_name('bazinga')
+        # create resources
+        network = self.create_network(name=self._rand_name('network'))
+        subnet = self.create_subnet(network, name=self._rand_name('subnet'))
+        self.create_router_interface(self.router['id'], subnet['id'])
+        # create port with wrong dns-name (not as VM name)
+        dns_port = self.create_port(network,
+                                    dns_name=vm_wrong_name,
+                                    security_groups=[self.secgroup['id']],
+                                    name=self._rand_name('port'))
+        # validate dns port with wrong initial hostname from API
+        self._validate_port_dns_details(vm_wrong_name, dns_port)
+        # update port with correct dns-name (as VM name)
+        dns_port = self.update_port(dns_port, dns_name=vm_correct_name)
+        # create VM with correct predefined dns-name on port
+        vm_1 = self.create_server(name=vm_correct_name,
+                                  networks=[{'port': dns_port['id']}],
+                                  **self.vm_kwargs)
+        # validate dns port with correct changed hostname using API
+        self._validate_port_dns_details(vm_correct_name, dns_port)
+        # validate hostname configured on VM is same as VM's name.
+        vm_1['fip'] = self.create_floatingip(port=dns_port)
+        vm_1['ssh_client'] = self._create_ssh_client(
+            vm_1['fip']['floating_ip_address'])
+        self._validate_ssh_dns_details(vm_correct_name, vm_1['ssh_client'])
diff --git a/neutron_tempest_plugin/scenario/test_mac_learning.py b/neutron_tempest_plugin/scenario/test_mac_learning.py
index 736d46c..6cd894f 100644
--- a/neutron_tempest_plugin/scenario/test_mac_learning.py
+++ b/neutron_tempest_plugin/scenario/test_mac_learning.py
@@ -14,8 +14,10 @@
 #    under the License.
 
 from oslo_log import log
+from paramiko import ssh_exception as ssh_exc
 from tempest.lib.common.utils import data_utils
 from tempest.lib import decorators
+from tempest.lib import exceptions as lib_exc
 
 from neutron_tempest_plugin.common import ssh
 from neutron_tempest_plugin.common import utils
@@ -116,17 +118,22 @@
                                           pkey=self.keypair['private_key'])
         return server
 
-    def _check_cmd_installed_on_server(self, ssh_client, server_id, cmd):
+    def _check_cmd_installed_on_server(self, ssh_client, server, cmd):
         try:
             ssh_client.execute_script('which %s' % cmd)
+        except (lib_exc.SSHTimeout, ssh_exc.AuthenticationException) as ssh_e:
+            LOG.debug(ssh_e)
+            self._log_console_output([server])
+            self._log_local_network_status()
+            raise
         except exceptions.SSHScriptFailed:
             raise self.skipException(
-                "%s is not available on server %s" % (cmd, server_id))
+                "%s is not available on server %s" % (cmd, server['id']))
 
     def _prepare_sender(self, server, address):
         check_script = get_sender_script(self.sender_output_file, address,
                                          self.completed_message)
-        self._check_cmd_installed_on_server(server['ssh_client'], server['id'],
+        self._check_cmd_installed_on_server(server['ssh_client'], server,
                                             'tcpdump')
         server['ssh_client'].execute_script(
             'echo "%s" > %s' % (check_script, self.sender_script_file))
@@ -135,7 +142,7 @@
         check_script = get_receiver_script(
             result_file=self.output_file,
             packets_expected=n_packets)
-        self._check_cmd_installed_on_server(server['ssh_client'], server['id'],
+        self._check_cmd_installed_on_server(server['ssh_client'], server,
                                             'tcpdump')
         server['ssh_client'].execute_script(
             'echo "%s" > %s' % (check_script, self.receiver_script_file))
diff --git a/neutron_tempest_plugin/scenario/test_multicast.py b/neutron_tempest_plugin/scenario/test_multicast.py
index 726d1e0..acfb75c 100644
--- a/neutron_tempest_plugin/scenario/test_multicast.py
+++ b/neutron_tempest_plugin/scenario/test_multicast.py
@@ -16,8 +16,10 @@
 import netaddr
 from neutron_lib import constants
 from oslo_log import log
+from paramiko import ssh_exception as ssh_exc
 from tempest.lib.common.utils import data_utils
 from tempest.lib import decorators
+from tempest.lib import exceptions as lib_exc
 
 from neutron_tempest_plugin.common import ip
 from neutron_tempest_plugin.common import ssh
@@ -210,15 +212,20 @@
                                           self.username,
                                           pkey=self.keypair['private_key'])
         self._check_cmd_installed_on_server(server['ssh_client'],
-                                            server['id'], PYTHON3_BIN)
+                                            server, PYTHON3_BIN)
         return server
 
-    def _check_cmd_installed_on_server(self, ssh_client, server_id, cmd):
+    def _check_cmd_installed_on_server(self, ssh_client, server, cmd):
         try:
             ssh_client.execute_script('which %s' % cmd)
+        except (lib_exc.SSHTimeout, ssh_exc.AuthenticationException) as ssh_e:
+            LOG.debug(ssh_e)
+            self._log_console_output([server])
+            self._log_local_network_status()
+            raise
         except exceptions.SSHScriptFailed:
             raise self.skipException(
-                "%s is not available on server %s" % (cmd, server_id))
+                "%s is not available on server %s" % (cmd, server['id']))
 
     def _prepare_sender(self, server, mcast_address):
         check_script = get_sender_script(
@@ -237,7 +244,7 @@
             server['fip']['floating_ip_address'],
             self.username,
             pkey=self.keypair['private_key'])
-        self._check_cmd_installed_on_server(ssh_client, server['id'],
+        self._check_cmd_installed_on_server(ssh_client, server,
                                             PYTHON3_BIN)
         server['ssh_client'].execute_script(
             'echo "%s" > /tmp/multicast_traffic_receiver.py' % check_script)
@@ -253,7 +260,7 @@
         check_script = get_unregistered_script(
             interface=port_iface, group=mcast_address,
             result_file=self.unregistered_output_file)
-        self._check_cmd_installed_on_server(ssh_client, server['id'],
+        self._check_cmd_installed_on_server(ssh_client, server,
                                             'tcpdump')
         server['ssh_client'].execute_script(
             'echo "%s" > /tmp/unregistered_traffic_receiver.sh' % check_script)
diff --git a/neutron_tempest_plugin/scenario/test_ports.py b/neutron_tempest_plugin/scenario/test_ports.py
index fb2d2b0..c661d39 100644
--- a/neutron_tempest_plugin/scenario/test_ports.py
+++ b/neutron_tempest_plugin/scenario/test_ports.py
@@ -107,8 +107,8 @@
                 if port is not None:
                     break
             except Exception as e:
-                LOG.warn('Failed to create Port, using Fixed_IP:{}, '
-                         'the Error was:{}'.format(ip, e))
+                LOG.warning('Failed to create Port, using Fixed_IP:{}, '
+                            'the Error was:{}'.format(ip, e))
         fip, server = self._create_instance_with_port(port)
         self.check_connectivity(fip[0]['floating_ip_address'],
                                 CONF.validation.image_ssh_user,
diff --git a/neutron_tempest_plugin/scenario/test_security_groups.py b/neutron_tempest_plugin/scenario/test_security_groups.py
index 40aa66a..f47ce44 100644
--- a/neutron_tempest_plugin/scenario/test_security_groups.py
+++ b/neutron_tempest_plugin/scenario/test_security_groups.py
@@ -71,10 +71,14 @@
     @classmethod
     def setup_credentials(cls):
         super(NetworkSecGroupTest, cls).setup_credentials()
-        cls.project_id = cls.os_primary.credentials.tenant_id
         cls.network_client = cls.os_admin.network_client
 
     @classmethod
+    def setup_clients(cls):
+        super(NetworkSecGroupTest, cls).setup_clients()
+        cls.project_id = cls.os_primary.credentials.tenant_id
+
+    @classmethod
     def resource_setup(cls):
         super(NetworkSecGroupTest, cls).resource_setup()
         # setup basic topology for servers we can log into it
diff --git a/neutron_tempest_plugin/scenario/test_trunk.py b/neutron_tempest_plugin/scenario/test_trunk.py
index b86c019..b994775 100644
--- a/neutron_tempest_plugin/scenario/test_trunk.py
+++ b/neutron_tempest_plugin/scenario/test_trunk.py
@@ -114,11 +114,6 @@
                 vlan_tag=segmentation_id,
                 vlan_subnet=vlan_subnet)
 
-        for server in server_list:
-            self.check_connectivity(
-                host=vm.floating_ip['floating_ip_address'],
-                ssh_client=vm.ssh_client)
-
         return server_list
 
     def _check_servers_remote_connectivity(self, vms=None,
@@ -197,6 +192,10 @@
         self._wait_for_trunk(trunk=vm.trunk)
         self._wait_for_port(port=vm.port)
         self._wait_for_port(port=vm.subport)
+        self.check_connectivity(
+            host=vm.floating_ip['floating_ip_address'],
+            ssh_client=vm.ssh_client,
+            servers=[vm.server])
 
         ip_command = ip.IPCommand(ssh_client=vm.ssh_client)
         for address in ip_command.list_addresses(port=vm.port):
diff --git a/zuul.d/base-nested-switch.yaml b/zuul.d/base-nested-switch.yaml
new file mode 100644
index 0000000..69e841f
--- /dev/null
+++ b/zuul.d/base-nested-switch.yaml
@@ -0,0 +1,32 @@
+- nodeset:
+    name: neutron-nested-virt-ubuntu-focal
+    nodes:
+      - name: controller
+        label: nested-virt-ubuntu-focal
+    groups:
+      - name: tempest
+        nodes:
+          - controller
+
+# Base nested switch job for non EM releases
+- job:
+    name: neutron-tempest-plugin-scenario-nested-switch
+    parent: neutron-tempest-plugin-scenario
+    abstract: true
+    branches: ^(?!stable/(queens|rocky|stein|train|ussuri)).*$
+    # Comment nodeset and vars to switch back to non nested nodes
+    nodeset: neutron-nested-virt-ubuntu-focal
+    vars:
+      devstack_localrc:
+        LIBVIRT_TYPE: kvm
+        LIBVIRT_CPU_MODE: host-passthrough
+        CIRROS_VERSION: 0.5.1
+        DEFAULT_IMAGE_NAME: cirros-0.5.1-x86_64-disk
+        DEFAULT_IMAGE_FILE_NAME: cirros-0.5.1-x86_64-disk.img
+
+# Base nested switch job for EM releases
+- job:
+    name: neutron-tempest-plugin-scenario-nested-switch
+    parent: neutron-tempest-plugin-scenario
+    abstract: true
+    branches: ^(stable/(queens|rocky|stein|train|ussuri)).*$
diff --git a/zuul.d/base.yaml b/zuul.d/base.yaml
index 12408ea..bd2ae09 100644
--- a/zuul.d/base.yaml
+++ b/zuul.d/base.yaml
@@ -17,6 +17,8 @@
         USE_PYTHON3: true
         NETWORK_API_EXTENSIONS: "{{ (network_api_extensions_common + network_api_extensions_tempest) | join(',') }}"
         CIRROS_VERSION: 0.5.1
+        DEFAULT_IMAGE_NAME: cirros-0.5.1-x86_64-uec
+        DEFAULT_IMAGE_FILE_NAME: cirros-0.5.1-x86_64-uec.tar.gz
         BUILD_TIMEOUT: 784
       devstack_plugins:
         neutron: https://opendev.org/openstack/neutron.git
@@ -83,14 +85,22 @@
               provider_net_base_segm_id: 1
     irrelevant-files:
       - ^(test-|)requirements.txt$
+      - lower-constraints.txt
       - ^releasenotes/.*$
       - ^doc/.*$
+      - ^.*\.conf\.sample$
       - ^setup.cfg$
       - ^.*\.rst$
       - ^neutron/locale/.*$
       - ^neutron/tests/unit/.*$
+      - ^neutron/tests/fullstack/.*
+      - ^neutron/tests/functional/.*
       - ^tools/.*$
       - ^tox.ini$
+      - ^rally-jobs/.*$
+      - ^vagrant/.*$
+      - ^zuul.d/(queens|rocky|stein|train|ussuri)_jobs.yaml$
+      - ^zuul.d/base-nested-switch.yaml$
 
 - job:
     name: neutron-tempest-plugin-scenario
@@ -109,7 +119,6 @@
           (^tempest.api.compute.servers.test_multiple_create)"
       devstack_localrc:
         PHYSICAL_NETWORK: default
-        CIRROS_VERSION: 0.5.1
         IMAGE_URLS: https://cloud-images.ubuntu.com/minimal/releases/focal/release/ubuntu-20.04-minimal-cloudimg-amd64.img
         ADVANCED_IMAGE_NAME: ubuntu-20.04-minimal-cloudimg-amd64
         ADVANCED_INSTANCE_TYPE: ntp_image_256M
diff --git a/zuul.d/master_jobs.yaml b/zuul.d/master_jobs.yaml
index b167689..90ba9a4 100644
--- a/zuul.d/master_jobs.yaml
+++ b/zuul.d/master_jobs.yaml
@@ -74,6 +74,7 @@
         - standard-attr-segment
         - standard-attr-tag
         - standard-attr-timestamp
+        - stateful-security-group
         - subnet_allocation
         - subnet-dns-publish-fixed-ip
         - subnet-service-types
@@ -110,23 +111,31 @@
               local_output_log_base: /tmp/test_log.log
     irrelevant-files:
       - ^(test-|)requirements.txt$
+      - lower-constraints.txt
       - ^releasenotes/.*$
       - ^doc/.*$
       - ^setup.cfg$
       - ^.*\.rst$
+      - ^.*\.conf\.sample$
       - ^neutron/locale/.*$
       - ^neutron/tests/unit/.*$
+      - ^neutron/tests/fullstack/.*
+      - ^neutron/tests/functional/.*
       - ^tools/.*$
       - ^tox.ini$
       - ^neutron/agent/.*$
       - ^neutron/privileged/.*$
       - ^neutron_lib/tests/unit/.*$
       - ^neutron_tempest_plugin/scenario/.*$
+      - ^rally-jobs/.*$
+      - ^vagrant/.*$
+      - ^zuul.d/(queens|rocky|stein|train|ussuri)_jobs.yaml$
+      - ^zuul.d/base-nested-switch.yaml$
 
 
 - job:
     name: neutron-tempest-plugin-scenario-openvswitch
-    parent: neutron-tempest-plugin-scenario
+    parent: neutron-tempest-plugin-scenario-nested-switch
     timeout: 10000
     vars:
       devstack_services:
@@ -175,12 +184,16 @@
               firewall_driver: openvswitch
     irrelevant-files: &openvswitch-scenario-irrelevant-files
       - ^(test-|)requirements.txt$
+      - lower-constraints.txt
       - ^releasenotes/.*$
       - ^doc/.*$
       - ^setup.cfg$
       - ^.*\.rst$
+      - ^.*\.conf\.sample$
       - ^neutron/locale/.*$
       - ^neutron/tests/unit/.*$
+      - ^neutron/tests/fullstack/.*
+      - ^neutron/tests/functional/.*
       - ^tools/.*$
       - ^tox.ini$
       - ^neutron/agent/ovn/.*$
@@ -189,10 +202,16 @@
       - ^neutron/plugins/ml2/drivers/macvtap/.*$
       - ^neutron/plugins/ml2/drivers/mech_sriov/.*$
       - ^neutron/plugins/ml2/drivers/ovn/.*$
+      - ^neutron_tempest_plugin/(bgpvpn|fwaas|neutron_dynamic_routing|sfc|tap_as_a_service|vpnaas).*$
+      - ^neutron_tempest_plugin/services/bgp/.*$
+      - ^rally-jobs/.*$
+      - ^vagrant/.*$
+      - ^zuul.d/(queens|rocky|stein|train|ussuri)_jobs.yaml$
+      - ^zuul.d/base-nested-switch.yaml$
 
 - job:
     name: neutron-tempest-plugin-scenario-openvswitch-iptables_hybrid
-    parent: neutron-tempest-plugin-scenario
+    parent: neutron-tempest-plugin-scenario-nested-switch
     timeout: 10000
     vars:
       devstack_services:
@@ -250,12 +269,16 @@
               firewall_driver: iptables_hybrid
     irrelevant-files:
       - ^(test-|)requirements.txt$
+      - lower-constraints.txt
       - ^releasenotes/.*$
       - ^doc/.*$
       - ^setup.cfg$
       - ^.*\.rst$
+      - ^.*\.conf\.sample$
       - ^neutron/locale/.*$
       - ^neutron/tests/unit/.*$
+      - ^neutron/tests/fullstack/.*
+      - ^neutron/tests/functional/.*
       - ^tools/.*$
       - ^tox.ini$
       - ^neutron/agent/linux/openvswitch_firewall/.*$
@@ -265,6 +288,12 @@
       - ^neutron/plugins/ml2/drivers/macvtap/.*$
       - ^neutron/plugins/ml2/drivers/mech_sriov/.*$
       - ^neutron/plugins/ml2/drivers/ovn/.*$
+      - ^neutron_tempest_plugin/(bgpvpn|fwaas|neutron_dynamic_routing|sfc|tap_as_a_service|vpnaas).*$
+      - ^neutron_tempest_plugin/services/bgp/.*$
+      - ^rally-jobs/.*$
+      - ^vagrant/.*$
+      - ^zuul.d/(queens|rocky|stein|train|ussuri)_jobs.yaml$
+      - ^zuul.d/base-nested-switch.yaml$
 
 - job:
     name: neutron-tempest-plugin-scenario-openvswitch-distributed-dhcp
@@ -296,7 +325,7 @@
 
 - job:
     name: neutron-tempest-plugin-scenario-linuxbridge
-    parent: neutron-tempest-plugin-scenario
+    parent: neutron-tempest-plugin-scenario-nested-switch
     timeout: 10000
     roles:
       - zuul: openstack/neutron
@@ -361,12 +390,16 @@
               firewall_driver: iptables
     irrelevant-files:
       - ^(test-|)requirements.txt$
+      - lower-constraints.txt
       - ^releasenotes/.*$
       - ^doc/.*$
       - ^setup.cfg$
       - ^.*\.rst$
+      - ^.*\.conf\.sample$
       - ^neutron/locale/.*$
       - ^neutron/tests/unit/.*$
+      - ^neutron/tests/fullstack/.*
+      - ^neutron/tests/functional/.*
       - ^tools/.*$
       - ^tox.ini$
       - ^neutron/agent/linux/openvswitch_firewall/.*$
@@ -376,10 +409,16 @@
       - ^neutron/plugins/ml2/drivers/macvtap/.*$
       - ^neutron/plugins/ml2/drivers/mech_sriov/.*$
       - ^neutron/plugins/ml2/drivers/ovn/.*$
+      - ^neutron_tempest_plugin/(bgpvpn|fwaas|neutron_dynamic_routing|sfc|tap_as_a_service|vpnaas).*$
+      - ^neutron_tempest_plugin/services/bgp/.*$
+      - ^rally-jobs/.*$
+      - ^vagrant/.*$
+      - ^zuul.d/(queens|rocky|stein|train|ussuri)_jobs.yaml$
+      - ^zuul.d/base-nested-switch.yaml$
 
 - job:
     name: neutron-tempest-plugin-scenario-ovn
-    parent: neutron-tempest-plugin-scenario
+    parent: neutron-tempest-plugin-scenario-nested-switch
     timeout: 10800
     vars:
       network_api_extensions: *api_extensions
@@ -472,12 +511,16 @@
         '{{ devstack_log_dir }}/ovsdb-server-sb.log': 'logs'
     irrelevant-files:
       - ^(test-|)requirements.txt$
+      - lower-constraints.txt
       - ^releasenotes/.*$
       - ^doc/.*$
       - ^setup.cfg$
       - ^.*\.rst$
+      - ^.*\.conf\.sample$
       - ^neutron/locale/.*$
       - ^neutron/tests/unit/.*$
+      - ^neutron/tests/fullstack/.*
+      - ^neutron/tests/functional/.*
       - ^tools/.*$
       - ^tox.ini$
       - ^neutron/agent/dhcp/.*$
@@ -496,6 +539,12 @@
       - ^neutron/plugins/ml2/drivers/macvtap/.*$
       - ^neutron/plugins/ml2/drivers/mech_sriov/.*$
       - ^neutron/scheduler/.*$
+      - ^neutron_tempest_plugin/(bgpvpn|fwaas|neutron_dynamic_routing|sfc|tap_as_a_service|vpnaas).*$
+      - ^neutron_tempest_plugin/services/bgp/.*$
+      - ^rally-jobs/.*$
+      - ^vagrant/.*$
+      - ^zuul.d/(queens|rocky|stein|train|ussuri)_jobs.yaml$
+      - ^zuul.d/base-nested-switch.yaml$
 
 - job:
     name: neutron-tempest-plugin-dvr-multinode-scenario
@@ -526,6 +575,8 @@
         NETWORK_API_EXTENSIONS: "{{ (network_api_extensions_common + network_api_extensions_dvr) | join(',') }}"
         PHYSICAL_NETWORK: default
         CIRROS_VERSION: 0.5.1
+        DEFAULT_IMAGE_NAME: cirros-0.5.1-x86_64-uec
+        DEFAULT_IMAGE_FILE_NAME: cirros-0.5.1-x86_64-uec.tar.gz
         IMAGE_URLS: https://cloud-images.ubuntu.com/minimal/releases/focal/release/ubuntu-20.04-minimal-cloudimg-amd64.img
         ADVANCED_IMAGE_NAME: ubuntu-20.04-minimal-cloudimg-amd64
         ADVANCED_INSTANCE_TYPE: ntp_image_256M
@@ -686,7 +737,7 @@
 
 - job:
     name: neutron-tempest-plugin-designate-scenario
-    parent: neutron-tempest-plugin-scenario
+    parent: neutron-tempest-plugin-scenario-nested-switch
     description: Neutron designate integration scenario
     required-projects:
       - openstack/designate
@@ -712,12 +763,16 @@
       tempest_test_regex: ^neutron_tempest_plugin\.scenario\.test_dns_integration
     irrelevant-files:
       - ^(test-|)requirements.txt$
+      - lower-constraints.txt
       - ^releasenotes/.*$
       - ^doc/.*$
       - ^setup.cfg$
       - ^.*\.rst$
+      - ^.*\.conf\.sample$
       - ^neutron/locale/.*$
       - ^neutron/tests/unit/.*$
+      - ^neutron/tests/fullstack/.*
+      - ^neutron/tests/functional/.*
       - ^tools/.*$
       - ^tox.ini$
       - ^neutron/agent/.*$
@@ -726,6 +781,12 @@
       - ^neutron/plugins/ml2/drivers/.*$
       - ^neutron/scheduler/.*$
       - ^neutron/services/(?!externaldns).*$
+      - ^neutron_tempest_plugin/(bgpvpn|fwaas|neutron_dynamic_routing|sfc|tap_as_a_service|vpnaas).*$
+      - ^neutron_tempest_plugin/services/bgp/.*$
+      - ^rally-jobs/.*$
+      - ^vagrant/.*$
+      - ^zuul.d/(queens|rocky|stein|train|ussuri)_jobs.yaml$
+      - ^zuul.d/base-nested-switch.yaml$
 
 - job:
     name: neutron-tempest-plugin-sfc
@@ -769,6 +830,26 @@
       # https://bugs.launchpad.net/neutron/+bug/1851500
       # https://bugs.launchpad.net/networking-sfc/+bug/1660366
       tempest_concurrency: 1
+    irrelevant-files:
+      - ^(test-|)requirements.txt$
+      - lower-constraints.txt
+      - ^releasenotes/.*$
+      - ^doc/.*$
+      - ^.*\.conf\.sample$
+      - ^setup.cfg$
+      - ^.*\.rst$
+      - ^neutron/locale/.*$
+      - ^neutron/tests/unit/.*$
+      - ^neutron/tests/fullstack/.*
+      - ^neutron/tests/functional/.*
+      - ^neutron_tempest_plugin/(bgpvpn|fwaas|neutron_dynamic_routing|tap_as_a_service|vpnaas).*$
+      - ^neutron_tempest_plugin/services/bgp/.*$
+      - ^tools/.*$
+      - ^tox.ini$
+      - ^rally-jobs/.*$
+      - ^vagrant/.*$
+      - ^zuul.d/(queens|rocky|stein|train|ussuri)_jobs.yaml$
+      - ^zuul.d/base-nested-switch.yaml$
 
 - job:
     name: neutron-tempest-plugin-bgpvpn-bagpipe
@@ -808,6 +889,26 @@
       devstack_plugins:
         networking-bgpvpn: https://git.openstack.org/openstack/networking-bgpvpn
         networking-bagpipe: https://git.openstack.org/openstack/networking-bagpipe
+    irrelevant-files:
+      - ^(test-|)requirements.txt$
+      - lower-constraints.txt
+      - ^releasenotes/.*$
+      - ^doc/.*$
+      - ^.*\.conf\.sample$
+      - ^setup.cfg$
+      - ^.*\.rst$
+      - ^neutron/locale/.*$
+      - ^neutron/tests/unit/.*$
+      - ^neutron/tests/fullstack/.*
+      - ^neutron/tests/functional/.*
+      - ^neutron_tempest_plugin/(fwaas|neutron_dynamic_routing|sfc|tap_as_a_service|vpnaas).*$
+      - ^neutron_tempest_plugin/services/bgp/.*$
+      - ^tools/.*$
+      - ^tox.ini$
+      - ^rally-jobs/.*$
+      - ^vagrant/.*$
+      - ^zuul.d/(queens|rocky|stein|train|ussuri)_jobs.yaml$
+      - ^zuul.d/base-nested-switch.yaml$
 
 - job:
     name: neutron-tempest-plugin-dynamic-routing
@@ -853,6 +954,25 @@
         neutron-dr-agent: true
       tempest_concurrency: 1
       tempest_test_regex: ^neutron_tempest_plugin\.neutron_dynamic_routing
+    irrelevant-files:
+      - ^(test-|)requirements.txt$
+      - lower-constraints.txt
+      - ^releasenotes/.*$
+      - ^doc/.*$
+      - ^.*\.conf\.sample$
+      - ^setup.cfg$
+      - ^.*\.rst$
+      - ^neutron/locale/.*$
+      - ^neutron/tests/unit/.*$
+      - ^neutron/tests/fullstack/.*
+      - ^neutron/tests/functional/.*
+      - ^neutron_tempest_plugin/(bgpvpn|fwaas|sfc|tap_as_a_service|vpnaas).*$
+      - ^tools/.*$
+      - ^tox.ini$
+      - ^rally-jobs/.*$
+      - ^vagrant/.*$
+      - ^zuul.d/(queens|rocky|stein|train|ussuri)_jobs.yaml$
+      - ^zuul.d/base-nested-switch.yaml$
 
 - job:
     name: neutron-tempest-plugin-vpnaas
@@ -892,6 +1012,26 @@
         q-meta: true
         q-metering: true
         q-l3: true
+    irrelevant-files:
+      - ^(test-|)requirements.txt$
+      - lower-constraints.txt
+      - ^releasenotes/.*$
+      - ^doc/.*$
+      - ^.*\.conf\.sample$
+      - ^setup.cfg$
+      - ^.*\.rst$
+      - ^neutron/locale/.*$
+      - ^neutron/tests/unit/.*$
+      - ^neutron/tests/fullstack/.*
+      - ^neutron/tests/functional/.*
+      - ^neutron_tempest_plugin/(bgpvpn|fwaas|neutron_dynamic_routing|sfc|tap_as_a_service).*$
+      - ^neutron_tempest_plugin/services/bgp/.*$
+      - ^tools/.*$
+      - ^tox.ini$
+      - ^rally-jobs/.*$
+      - ^vagrant/.*$
+      - ^zuul.d/(queens|rocky|stein|train|ussuri)_jobs.yaml$
+      - ^zuul.d/base-nested-switch.yaml$
 
 - job:
     name: neutron-tempest-plugin-tap-as-a-service
@@ -975,10 +1115,23 @@
         taas_openvswitch_agent: true
         tempest: true
         dstat: true
-    irrelevant-files: &tempest-irrelevant-files
+    irrelevant-files:
       - ^(test-|)requirements.txt$
+      - lower-constraints.txt
       - ^releasenotes/.*$
       - ^doc/.*$
+      - ^.*\.conf\.sample$
+      - ^setup.cfg$
       - ^.*\.rst$
+      - ^neutron/locale/.*$
+      - ^neutron/tests/unit/.*$
+      - ^neutron/tests/fullstack/.*
+      - ^neutron/tests/functional/.*
+      - ^neutron_tempest_plugin/(bgpvpn|fwaas|neutron_dynamic_routing|sfc|vpnaas).*$
+      - ^neutron_tempest_plugin/services/bgp/.*$
       - ^tools/.*$
       - ^tox.ini$
+      - ^rally-jobs/.*$
+      - ^vagrant/.*$
+      - ^zuul.d/(queens|rocky|stein|train|ussuri)_jobs.yaml$
+      - ^zuul.d/base-nested-switch.yaml$
diff --git a/zuul.d/project.yaml b/zuul.d/project.yaml
index f65d517..caf83da 100644
--- a/zuul.d/project.yaml
+++ b/zuul.d/project.yaml
@@ -158,12 +158,33 @@
         - neutron-tempest-plugin-dvr-multinode-scenario-wallaby
 
 
+- project-template:
+    name: neutron-tempest-plugin-jobs-xena
+    check:
+      jobs:
+        - neutron-tempest-plugin-api-xena
+        - neutron-tempest-plugin-scenario-linuxbridge-xena
+        - neutron-tempest-plugin-scenario-openvswitch-xena
+        - neutron-tempest-plugin-scenario-openvswitch-iptables_hybrid-xena
+        - neutron-tempest-plugin-scenario-ovn-xena
+        - neutron-tempest-plugin-designate-scenario-xena
+    gate:
+      jobs:
+        - neutron-tempest-plugin-api-xena
+    #TODO(slaweq): Move neutron-tempest-plugin-dvr-multinode-scenario out of
+    #              the experimental queue when it will be more stable
+    experimental:
+      jobs:
+        - neutron-tempest-plugin-dvr-multinode-scenario-xena
+
+
 - project:
     templates:
       - build-openstack-docs-pti
       - neutron-tempest-plugin-jobs
       - neutron-tempest-plugin-jobs-victoria
       - neutron-tempest-plugin-jobs-wallaby
+      - neutron-tempest-plugin-jobs-xena
       - check-requirements
       - tempest-plugin-jobs
       - release-notes-jobs-python3
@@ -172,16 +193,21 @@
         - neutron-tempest-plugin-sfc
         - neutron-tempest-plugin-sfc-victoria
         - neutron-tempest-plugin-sfc-wallaby
+        - neutron-tempest-plugin-sfc-xena
         - neutron-tempest-plugin-bgpvpn-bagpipe
         - neutron-tempest-plugin-bgpvpn-bagpipe-victoria
         - neutron-tempest-plugin-bgpvpn-bagpipe-wallaby
+        - neutron-tempest-plugin-bgpvpn-bagpipe-xena
         - neutron-tempest-plugin-dynamic-routing
         - neutron-tempest-plugin-dynamic-routing-victoria
         - neutron-tempest-plugin-dynamic-routing-wallaby
+        - neutron-tempest-plugin-dynamic-routing-xena
         - neutron-tempest-plugin-vpnaas
         - neutron-tempest-plugin-vpnaas-victoria
         - neutron-tempest-plugin-vpnaas-wallaby
+        - neutron-tempest-plugin-vpnaas-xena
         - neutron-tempest-plugin-tap-as-a-service
+        - neutron-tempest-plugin-tap-as-a-service-xena
 
     gate:
       jobs:
diff --git a/zuul.d/queens_jobs.yaml b/zuul.d/queens_jobs.yaml
index a8fbec0..214df60 100644
--- a/zuul.d/queens_jobs.yaml
+++ b/zuul.d/queens_jobs.yaml
@@ -86,6 +86,8 @@
         NEUTRON_DEPLOY_MOD_WSGI: false
         USE_PYTHON3: false
         CIRROS_VERSION: 0.3.5
+        DEFAULT_IMAGE_NAME: cirros-0.3.5-x86_64-uec
+        DEFAULT_IMAGE_FILE_NAME: cirros-0.3.5-x86_64-uec.tar.gz
         NETWORK_API_EXTENSIONS: "{{ (network_api_extensions_common + network_api_extensions_tempest) | join(',') }}"
         TEMPEST_PLUGINS: /opt/stack/neutron-tempest-plugin
         Q_AGENT: openvswitch
@@ -139,6 +141,8 @@
       devstack_localrc:
         USE_PYTHON3: false
         CIRROS_VERSION: 0.3.5
+        DEFAULT_IMAGE_NAME: cirros-0.3.5-x86_64-uec
+        DEFAULT_IMAGE_FILE_NAME: cirros-0.3.5-x86_64-uec.tar.gz
         NETWORK_API_EXTENSIONS: "{{ network_api_extensions | join(',') }}"
         TEMPEST_PLUGINS: /opt/stack/neutron-tempest-plugin
         # NOTE(slaweq) some tests are not running fine with ubuntu minimal on
@@ -173,6 +177,8 @@
       devstack_localrc:
         USE_PYTHON3: false
         CIRROS_VERSION: 0.3.5
+        DEFAULT_IMAGE_NAME: cirros-0.3.5-x86_64-uec
+        DEFAULT_IMAGE_FILE_NAME: cirros-0.3.5-x86_64-uec.tar.gz
         Q_AGENT: linuxbridge
         NETWORK_API_EXTENSIONS: "{{ network_api_extensions | join(',') }}"
         TEMPEST_PLUGINS: /opt/stack/neutron-tempest-plugin
@@ -232,6 +238,8 @@
       devstack_localrc:
         USE_PYTHON3: false
         CIRROS_VERSION: 0.3.5
+        DEFAULT_IMAGE_NAME: cirros-0.3.5-x86_64-uec
+        DEFAULT_IMAGE_FILE_NAME: cirros-0.3.5-x86_64-uec.tar.gz
         TEMPEST_PLUGINS: /opt/stack/neutron-tempest-plugin
 
 - job:
@@ -256,5 +264,7 @@
       devstack_localrc:
         USE_PYTHON3: false
         CIRROS_VERSION: 0.3.5
+        DEFAULT_IMAGE_NAME: cirros-0.3.5-x86_64-uec
+        DEFAULT_IMAGE_FILE_NAME: cirros-0.3.5-x86_64-uec.tar.gz
         TEMPEST_PLUGINS: '"/opt/stack/designate-tempest-plugin /opt/stack/neutron-tempest-plugin"'
         ADVANCED_INSTANCE_TYPE: ds512M
diff --git a/zuul.d/rocky_jobs.yaml b/zuul.d/rocky_jobs.yaml
index 4043535..9915575 100644
--- a/zuul.d/rocky_jobs.yaml
+++ b/zuul.d/rocky_jobs.yaml
@@ -200,9 +200,21 @@
             neutron_plugin_options:
               available_type_drivers: flat,vlan,local,vxlan
               firewall_driver: openvswitch
-      tempest_black_regex: "\
+      # NOTE(bcafarel): filtering out unstable tests or tests with known
+      # issues in the used pinned version for this EM branch
+      tempest_black_regex: &rocky_tempest_exclude "\
+          (^neutron_tempest_plugin.scenario.admin.test_floatingip.FloatingIpTestCasesAdmin.test_two_vms_fips)|\
+          (^neutron_tempest_plugin.scenario.test_floatingip.FloatingIPQosTest.test_qos)|\
+          (^neutron_tempest_plugin.scenario.test_internal_dns.InternalDNSTest.test_dns_domain_and_name)|\
           (^neutron_tempest_plugin.scenario.test_port_forwardings.PortForwardingTestJSON.test_port_forwarding_to_2_servers)|\
-          (^neutron_tempest_plugin.scenario.test_security_groups.NetworkSecGroupTest.test_multiple_ports_portrange_remote)"
+          (^neutron_tempest_plugin.scenario.test_ports.PortsTest.test_previously_used_port)|\
+          (^neutron_tempest_plugin.scenario.test_security_groups.NetworkSecGroupTest.test_ip_prefix)|\
+          (^neutron_tempest_plugin.scenario.test_security_groups.NetworkSecGroupTest.test_multiple_ports_portrange_remote)|\
+          (^neutron_tempest_plugin.scenario.test_security_groups.NetworkSecGroupTest.test_multiple_ports_secgroup_inheritance)|\
+          (^neutron_tempest_plugin.scenario.test_security_groups.NetworkSecGroupTest.test_remote_group)|\
+          (^neutron_tempest_plugin.scenario.test_trunk.TrunkTest.test_subport_connectivity)|\
+          (^tempest.api.compute.servers.test_attach_interfaces.AttachInterfacesTestJSON.test_reassign_port_between_servers)|\
+          (^tempest.api.compute.servers.test_attach_interfaces.AttachInterfacesUnderV243Test.test_add_remove_fixed_ip)"
     branches:
       - stable/rocky
     irrelevant-files: &openvswitch-scenario-irrelevant-files
@@ -213,6 +225,8 @@
       - ^.*\.rst$
       - ^neutron/locale/.*$
       - ^neutron/tests/unit/.*$
+      - ^neutron/tests/fullstack/.*
+      - ^neutron/tests/functional/.*
       - ^tools/.*$
       - ^tox.ini$
       - ^neutron/agent/windows/.*$
@@ -306,13 +320,7 @@
             neutron_plugin_options:
               available_type_drivers: flat,vlan,local,vxlan
               firewall_driver: iptables_hybrid
-      # TODO(bcafarel): remove trunks subport_connectivity test from blacklist
-      # when bug https://bugs.launchpad.net/neutron/+bug/1838760 will be fixed
-      # NOTE(bcafarel): other are newer tests, unstable on rocky branch
-      tempest_black_regex: "\
-          (^neutron_tempest_plugin.scenario.test_trunk.TrunkTest.test_subport_connectivity)|\
-          (^neutron_tempest_plugin.scenario.test_port_forwardings.PortForwardingTestJSON.test_port_forwarding_to_2_servers)|\
-          (^neutron_tempest_plugin.scenario.test_security_groups.NetworkSecGroupTest.test_multiple_ports_portrange_remote)"
+      tempest_black_regex: *rocky_tempest_exclude
     branches:
       - stable/rocky
     irrelevant-files: &iptables_hybrid_irrelevant_files
@@ -323,6 +331,8 @@
       - ^.*\.rst$
       - ^neutron/locale/.*$
       - ^neutron/tests/unit/.*$
+      - ^neutron/tests/fullstack/.*
+      - ^neutron/tests/functional/.*
       - ^tools/.*$
       - ^tox.ini$
       - ^neutron/agent/linux/openvswitch_firewall/.*$
@@ -400,10 +410,7 @@
             neutron_plugin_options:
               available_type_drivers: flat,vlan,local,vxlan
               q_agent: None
-      # NOTE(bcafarel): newer tests, unstable on rocky branch
-      tempest_black_regex: "\
-          (^neutron_tempest_plugin.scenario.test_port_forwardings.PortForwardingTestJSON.test_port_forwarding_to_2_servers)|\
-          (^neutron_tempest_plugin.scenario.test_security_groups.NetworkSecGroupTest.test_multiple_ports_portrange_remote)"
+      tempest_black_regex: *rocky_tempest_exclude
     branches:
       - stable/rocky
 
@@ -457,6 +464,8 @@
         NETWORK_API_EXTENSIONS: "{{ (network_api_extensions_common + network_api_extensions_dvr) | join(',') }}"
         PHYSICAL_NETWORK: default
         CIRROS_VERSION: 0.5.1
+        DEFAULT_IMAGE_NAME: cirros-0.5.1-x86_64-uec
+        DEFAULT_IMAGE_FILE_NAME: cirros-0.5.1-x86_64-uec.tar.gz
         IMAGE_URLS: https://cloud-images.ubuntu.com/releases/bionic/release/ubuntu-18.04-server-cloudimg-amd64.img
         ADVANCED_IMAGE_NAME: ubuntu-18.04-server-cloudimg-amd64
         ADVANCED_INSTANCE_TYPE: ds512M
@@ -543,10 +552,7 @@
               l3_agent_mode: dvr_snat
               firewall_driver: openvswitch
       branch_override: stable/rocky
-      # NOTE(bcafarel): newer tests, unstable on rocky branch
-      tempest_black_regex: "\
-          (^neutron_tempest_plugin.scenario.test_port_forwardings.PortForwardingTestJSON.test_port_forwarding_to_2_servers)|\
-          (^neutron_tempest_plugin.scenario.test_security_groups.NetworkSecGroupTest.test_multiple_ports_portrange_remote)"
+      tempest_black_regex: *rocky_tempest_exclude
     branches:
       - stable/rocky
     group-vars: &multinode_scenario_group_vars_rocky
@@ -634,6 +640,9 @@
         USE_PYTHON3: false
         TEMPEST_PLUGINS: '"/opt/stack/designate-tempest-plugin /opt/stack/neutron-tempest-plugin"'
         ADVANCED_INSTANCE_TYPE: ds512M
+      # NOTE(bcafarel): filtering out unstable tests or tests with known
+      # issues in the used pinned version for this EM branch
+      tempest_black_regex: "(^neutron_tempest_plugin.scenario.test_dns_integration.DNSIntegrationAdminTests.test_port_on_special_network)"
     branches:
       - stable/rocky
 
diff --git a/zuul.d/stein_jobs.yaml b/zuul.d/stein_jobs.yaml
index f505a90..b229296 100644
--- a/zuul.d/stein_jobs.yaml
+++ b/zuul.d/stein_jobs.yaml
@@ -233,6 +233,8 @@
       - ^.*\.rst$
       - ^neutron/locale/.*$
       - ^neutron/tests/unit/.*$
+      - ^neutron/tests/fullstack/.*
+      - ^neutron/tests/functional/.*
       - ^tools/.*$
       - ^tox.ini$
       - ^neutron/agent/linux/openvswitch_firewall/.*$
@@ -323,6 +325,8 @@
       - ^.*\.rst$
       - ^neutron/locale/.*$
       - ^neutron/tests/unit/.*$
+      - ^neutron/tests/fullstack/.*
+      - ^neutron/tests/functional/.*
       - ^tools/.*$
       - ^tox.ini$
       - ^neutron/agent/linux/openvswitch_firewall/.*$
diff --git a/zuul.d/xena_jobs.yaml b/zuul.d/xena_jobs.yaml
new file mode 100644
index 0000000..7f6534d
--- /dev/null
+++ b/zuul.d/xena_jobs.yaml
@@ -0,0 +1,208 @@
+- job:
+    name: neutron-tempest-plugin-api-xena
+    parent: neutron-tempest-plugin-api
+    override-checkout: stable/xena
+    vars:
+      # TODO(slaweq): find a way to put this list of extensions in
+      # neutron repository and keep it different per branch,
+      # then it could be removed from here
+      network_api_extensions_common: &api_extensions
+        - address-group
+        - address-scope
+        - agent
+        - allowed-address-pairs
+        - auto-allocated-topology
+        - availability_zone
+        - binding
+        - default-subnetpools
+        - dhcp_agent_scheduler
+        - dns-domain-ports
+        - dns-integration
+        - dns-integration-domain-keywords
+        - empty-string-filtering
+        - expose-port-forwarding-in-fip
+        - expose-l3-conntrack-helper
+        - ext-gw-mode
+        - external-net
+        - extra_dhcp_opt
+        - extraroute
+        - extraroute-atomic
+        - filter-validation
+        - fip-port-details
+        - flavors
+        - floating-ip-port-forwarding
+        - floatingip-pools
+        - ip-substring-filtering
+        - l3-conntrack-helper
+        - l3-flavors
+        - l3-ha
+        - l3_agent_scheduler
+        - logging
+        - metering
+        - multi-provider
+        - net-mtu
+        - net-mtu-writable
+        - network-ip-availability
+        - network_availability_zone
+        - network-segment-range
+        - pagination
+        - port-resource-request
+        - port-mac-address-regenerate
+        - port-security
+        - port-security-groups-filtering
+        - project-id
+        - provider
+        - qos
+        - qos-bw-minimum-ingress
+        - qos-fip
+        - quotas
+        - quota_details
+        - rbac-address-group
+        - rbac-address-scope
+        - rbac-policies
+        - rbac-security-groups
+        - rbac-subnetpool
+        - router
+        - router-admin-state-down-before-update
+        - router_availability_zone
+        - security-group
+        - security-groups-remote-address-group
+        - segment
+        - service-type
+        - sorting
+        - standard-attr-description
+        - standard-attr-revisions
+        - standard-attr-segment
+        - standard-attr-tag
+        - standard-attr-timestamp
+        - subnet_allocation
+        - subnet-dns-publish-fixed-ip
+        - subnet-service-types
+        - subnetpool-prefix-ops
+        - tag-ports-during-bulk-creation
+        - trunk
+        - trunk-details
+        - uplink-status-propagation
+      network_api_extensions_tempest:
+        - dvr
+      network_available_features: &available_features
+        - ipv6_metadata
+
+- job:
+    name: neutron-tempest-plugin-scenario-openvswitch-xena
+    parent: neutron-tempest-plugin-scenario-openvswitch
+    override-checkout: stable/xena
+    vars:
+      branch_override: stable/xena
+      network_api_extensions: *api_extensions
+      network_available_features: *available_features
+      devstack_localrc:
+        NETWORK_API_EXTENSIONS: "{{ network_api_extensions | join(',') }}"
+      devstack_local_conf:
+        test-config:
+          $TEMPEST_CONFIG:
+            network-feature-enabled:
+              available_features: "{{ network_available_features | join(',') }}"
+
+- job:
+    name: neutron-tempest-plugin-scenario-openvswitch-iptables_hybrid-xena
+    parent: neutron-tempest-plugin-scenario-openvswitch-iptables_hybrid
+    override-checkout: stable-xena
+    vars:
+      branch_override: stable-xena
+      network_api_extensions: *api_extensions
+      network_available_features: *available_features
+      devstack_localrc:
+        NETWORK_API_EXTENSIONS: "{{ network_api_extensions | join(',') }}"
+      devstack_local_conf:
+        test-config:
+          $TEMPEST_CONFIG:
+            network-feature-enabled:
+              available_features: "{{ network_available_features | join(',') }}"
+
+- job:
+    name: neutron-tempest-plugin-scenario-linuxbridge-xena
+    parent: neutron-tempest-plugin-scenario-linuxbridge
+    override-checkout: stable/xena
+    vars:
+      branch_override: stable/xena
+      network_api_extensions: *api_extensions
+      network_available_features: *available_features
+      devstack_localrc:
+        NETWORK_API_EXTENSIONS: "{{ network_api_extensions | join(',') }}"
+      devstack_local_conf:
+        test-config:
+          $TEMPEST_CONFIG:
+            network-feature-enabled:
+              available_features: "{{ network_available_features | join(',') }}"
+
+- job:
+    name: neutron-tempest-plugin-scenario-ovn-xena
+    parent: neutron-tempest-plugin-scenario-ovn
+    override-checkout: stable/xena
+    vars:
+      branch_override: stable/xena
+      network_api_extensions: *api_extensions
+      devstack_localrc:
+        NETWORK_API_EXTENSIONS: "{{ network_api_extensions | join(',') }}"
+      devstack_local_conf:
+        test-config:
+          $TEMPEST_CONFIG:
+            network-feature-enabled:
+              available_features: ""
+
+- job:
+    name: neutron-tempest-plugin-dvr-multinode-scenario-xena
+    parent: neutron-tempest-plugin-dvr-multinode-scenario
+    override-checkout: stable/xena
+    vars:
+      network_api_extensions_common: *api_extensions
+      branch_override: stable/xena
+
+- job:
+    name: neutron-tempest-plugin-designate-scenario-xena
+    parent: neutron-tempest-plugin-designate-scenario
+    override-checkout: stable/xena
+    vars:
+      branch_override: stable/xena
+      network_api_extensions_common: *api_extensions
+
+- job:
+    name: neutron-tempest-plugin-sfc-xena
+    parent: neutron-tempest-plugin-sfc
+    override-checkout: stable/xena
+    vars:
+      branch_override: stable/xena
+      network_api_extensions_common: *api_extensions
+
+- job:
+    name: neutron-tempest-plugin-bgpvpn-bagpipe-xena
+    parent: neutron-tempest-plugin-bgpvpn-bagpipe
+    override-checkout: stable/xena
+    vars:
+      branch_override: stable/xena
+      network_api_extensions: *api_extensions
+
+- job:
+    name: neutron-tempest-plugin-dynamic-routing-xena
+    parent: neutron-tempest-plugin-dynamic-routing
+    override-checkout: stable/xena
+    vars:
+      branch_override: stable/xena
+      network_api_extensions_common: *api_extensions
+
+- job:
+    name: neutron-tempest-plugin-vpnaas-xena
+    parent: neutron-tempest-plugin-vpnaas
+    override-checkout: stable/xena
+    vars:
+      branch_override: stable/xena
+      network_api_extensions_common: *api_extensions
+
+- job:
+    name: neutron-tempest-plugin-tap-as-a-service-xena
+    parent: neutron-tempest-plugin-tap-as-a-service
+    override-checkout: stable/xena
+    vars:
+      branch_override: stable/xena
+      network_api_extensions_common: *api_extensions