diff --git a/README.rst b/README.rst
index 4f0cbbd..23072ae 100644
--- a/README.rst
+++ b/README.rst
@@ -89,6 +89,21 @@
       lbaas:
         enabled: disabled
 
+Enable CORS parameters
+
+.. code-block:: yaml
+
+    neutron:
+      server:
+        cors:
+          allowed_origin: https:localhost.local,http:localhost.local
+          expose_headers: X-Auth-Token,X-Openstack-Request-Id,X-Subject-Token
+          allow_methods: GET,PUT,POST,DELETE,PATCH
+          allow_headers: X-Auth-Token,X-Openstack-Request-Id,X-Subject-Token
+          allow_credentials: True
+          max_age: 86400
+
+
 Neutron VXLAN tenant networks with Network nodes
 ------------------------------------------------
 
diff --git a/neutron/files/mitaka/neutron-server.conf.Debian b/neutron/files/mitaka/neutron-server.conf.Debian
index e27b2bd..ae5cddc 100644
--- a/neutron/files/mitaka/neutron-server.conf.Debian
+++ b/neutron/files/mitaka/neutron-server.conf.Debian
@@ -650,23 +650,42 @@
 # Indicate whether this resource may be shared with the domain received in the
 # requests "origin" header. (list value)
 #allowed_origin = <None>
+{%- if server.cors.allowed_origin is defined %}
+allowed_origin = {{ server.cors.allowed_origin }}
+{%- endif %}
 
 # Indicate that the actual request can include user credentials (boolean value)
 #allow_credentials = true
+{%- if server.cors.allow_credentials is defined %}
+allow_credentials = {{ server.cors.allow_credentials }}
+{%- endif %}
 
 # Indicate which headers are safe to expose to the API. Defaults to HTTP Simple
 # Headers. (list value)
 #expose_headers = X-Auth-Token,X-Subject-Token,X-Service-Token,X-OpenStack-Request-ID,OpenStack-Volume-microversion
+{%- if server.cors.expose_headers is defined %}
+expose_headers = {{ server.cors.expose_headers }}
+{%- endif %}
 
 # Maximum cache age of CORS preflight requests. (integer value)
 #max_age = 3600
+{%- if server.cors.max_age is defined %}
+max_age = {{ server.cors.max_age }}
+{%- endif %}
 
 # Indicate which methods can be used during the actual request. (list value)
 #allow_methods = GET,PUT,POST,DELETE,PATCH
+{%- if server.cors.allow_methods is defined %}
+allow_methods = {{ server.cors.allow_methods }}
+{%- endif %}
 
 # Indicate which header field names may be used during the actual request.
 # (list value)
 #allow_headers = X-Auth-Token,X-Identity-Status,X-Roles,X-Service-Catalog,X-User-Id,X-Tenant-Id,X-OpenStack-Request-ID
+{%- if server.cors.allow_headers is defined %}
+allow_headers = {{ server.cors.allow_headers }}
+{%- endif %}
+
 
 
 [cors.subdomain]
diff --git a/neutron/files/newton/neutron-server.conf.Debian b/neutron/files/newton/neutron-server.conf.Debian
index ccc54f3..6a52ccb 100644
--- a/neutron/files/newton/neutron-server.conf.Debian
+++ b/neutron/files/newton/neutron-server.conf.Debian
@@ -660,23 +660,42 @@
 # Indicate whether this resource may be shared with the domain received in the
 # requests "origin" header. (list value)
 #allowed_origin = <None>
+{%- if server.cors.allowed_origin is defined %}
+allowed_origin = {{ server.cors.allowed_origin }}
+{%- endif %}
 
 # Indicate that the actual request can include user credentials (boolean value)
 #allow_credentials = true
+{%- if server.cors.allow_credentials is defined %}
+allow_credentials = {{ server.cors.allow_credentials }}
+{%- endif %}
 
 # Indicate which headers are safe to expose to the API. Defaults to HTTP Simple
 # Headers. (list value)
 #expose_headers = X-Auth-Token,X-Subject-Token,X-Service-Token,X-OpenStack-Request-ID,OpenStack-Volume-microversion
+{%- if server.cors.expose_headers is defined %}
+expose_headers = {{ server.cors.expose_headers }}
+{%- endif %}
 
 # Maximum cache age of CORS preflight requests. (integer value)
 #max_age = 3600
+{%- if server.cors.max_age is defined %}
+max_age = {{ server.cors.max_age }}
+{%- endif %}
 
 # Indicate which methods can be used during the actual request. (list value)
 #allow_methods = GET,PUT,POST,DELETE,PATCH
+{%- if server.cors.allow_methods is defined %}
+allow_methods = {{ server.cors.allow_methods }}
+{%- endif %}
 
 # Indicate which header field names may be used during the actual request.
 # (list value)
 #allow_headers = X-Auth-Token,X-Identity-Status,X-Roles,X-Service-Catalog,X-User-Id,X-Tenant-Id,X-OpenStack-Request-ID
+{%- if server.cors.allow_headers is defined %}
+allow_headers = {{ server.cors.allow_headers }}
+{%- endif %}
+
 
 
 [cors.subdomain]
diff --git a/neutron/files/ocata/neutron-server.conf.Debian b/neutron/files/ocata/neutron-server.conf.Debian
index 8bbe2a2..2d57411 100644
--- a/neutron/files/ocata/neutron-server.conf.Debian
+++ b/neutron/files/ocata/neutron-server.conf.Debian
@@ -734,24 +734,41 @@
 # requests "origin" header. Format: "<protocol>://<host>[:<port>]", no trailing
 # slash. Example: https://horizon.example.com (list value)
 #allowed_origin = <None>
+{%- if server.cors.allowed_origin is defined %}
+allowed_origin = {{ server.cors.allowed_origin }}
+{%- endif %}
 
 # Indicate that the actual request can include user credentials (boolean value)
 #allow_credentials = true
+{%- if server.cors.allow_credentials is defined %}
+allow_credentials = {{ server.cors.allow_credentials }}
+{%- endif %}
 
 # Indicate which headers are safe to expose to the API. Defaults to HTTP Simple
 # Headers. (list value)
 #expose_headers = X-Auth-Token,X-Subject-Token,X-Service-Token,X-OpenStack-Request-ID,OpenStack-Volume-microversion
+{%- if server.cors.expose_headers is defined %}
+expose_headers = {{ server.cors.expose_headers }}
+{%- endif %}
 
 # Maximum cache age of CORS preflight requests. (integer value)
 #max_age = 3600
+{%- if server.cors.max_age is defined %}
+max_age = {{ server.cors.max_age }}
+{%- endif %}
 
 # Indicate which methods can be used during the actual request. (list value)
 #allow_methods = GET,PUT,POST,DELETE,PATCH
+{%- if server.cors.allow_methods is defined %}
+allow_methods = {{ server.cors.allow_methods }}
+{%- endif %}
 
 # Indicate which header field names may be used during the actual request.
 # (list value)
 #allow_headers = X-Auth-Token,X-Identity-Status,X-Roles,X-Service-Catalog,X-User-Id,X-Tenant-Id,X-OpenStack-Request-ID
-
+{%- if server.cors.allow_headers is defined %}
+allow_headers = {{ server.cors.allow_headers }}
+{%- endif %}
 
 [cors.subdomain]
 
diff --git a/neutron/map.jinja b/neutron/map.jinja
index 27382b4..f670fb0 100644
--- a/neutron/map.jinja
+++ b/neutron/map.jinja
@@ -38,6 +38,7 @@
         'services': ['neutron-server'],
         'notification': False,
         'dpdk': false,
+        'cors': {},
         'audit': {
           'enabled': false
         }
@@ -48,6 +49,7 @@
         'services': ['neutron-server'],
         'notification': False,
         'dpdk': false,
+        'cors': {},
         'audit': {
           'enabled': false
         }