diff --git a/tempest/api/network/test_networks.py b/tempest/api/network/test_networks.py
index dd81a09..b9086cc 100644
--- a/tempest/api/network/test_networks.py
+++ b/tempest/api/network/test_networks.py
@@ -12,6 +12,7 @@
 #    WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
 #    License for the specific language governing permissions and limitations
 #    under the License.
+import itertools
 
 import netaddr
 import testtools
@@ -42,6 +43,7 @@
         network update
         subnet update
         delete a network also deletes its subnets
+        list external networks
 
         All subnet tests are run once with ipv4 and once with ipv6.
 
@@ -345,6 +347,28 @@
             enable_dhcp=True,
             **self.subnet_dict(['gateway', 'host_routes', 'dns_nameservers']))
 
+    @test.attr(type='smoke')
+    def test_external_network_visibility(self):
+        """Verifies user can see external networks but not subnets."""
+        _, body = self.client.list_networks(**{'router:external': True})
+        networks = [network['id'] for network in body['networks']]
+        self.assertNotEmpty(networks, "No external networks found")
+
+        nonexternal = [net for net in body['networks'] if
+                       not net['router:external']]
+        self.assertEmpty(nonexternal, "Found non-external networks"
+                                      " in filtered list (%s)." % nonexternal)
+        self.assertIn(CONF.network.public_network_id, networks)
+
+        subnets_iter = (network['subnets'] for network in body['networks'])
+        # subnets_iter is a list (iterator) of lists. This flattens it to a
+        # list of UUIDs
+        public_subnets_iter = itertools.chain(*subnets_iter)
+        _, body = self.client.list_subnets()
+        subnets = [sub['id'] for sub in body['subnets']
+                   if sub['id'] in public_subnets_iter]
+        self.assertEmpty(subnets, "Public subnets visible")
+
 
 class NetworksTestXML(NetworksTestJSON):
     _interface = 'xml'