diff --git a/README.rst b/README.rst
index a5f8e8a..d51c7b5 100644
--- a/README.rst
+++ b/README.rst
@@ -695,14 +695,22 @@
           ...
           # also need to configure corresponding bridge_mappings on
           # compute and gateway nodes
+          flat_networks_default: '*' # '*' to allow arbitrary names or '' to disable
           physnets: # only listed physnets will be configured (overrides physnet1/2/3)
             external:
               mtu: 1500
+              types:
+                - flat # possible values - 'flat' or 'vlan'
             sriov_net:
               mtu: 9000 # Optional, defaults to 1500
               vlan_range: '100:200' # Optional
+              types:
+                - vlan
             ext_net2:
               mtu: 1500
+              types:
+                - flat
+                - vlan
           mechanism:
             ovs:
               driver: openvswitch
diff --git a/neutron/agents/_l2gw.sls b/neutron/agents/_l2gw.sls
index 53e048a..9f565a9 100644
--- a/neutron/agents/_l2gw.sls
+++ b/neutron/agents/_l2gw.sls
@@ -14,16 +14,24 @@
 
 {%- if not grains.get('noservices', False) %}
 
-# TODO: use service.masked state instead once salt get updated to 2017.7.0+
+{%- if grains['saltversioninfo'] < [2017, 7] %}
 service.mask:
   module.run:
   - m_name: neutron-l2gateway-agent
+{%- else %}
+l2gw_agent__service_mask:
+  service.masked:
+  - name: neutron-l2gateway-agent
+{%- endif %}
   - require_in:
     - pkg: l2gw_agent_packages
 
 neutron-l2gateway-agent:
   service.running:
   - enable: true
+{%- if grains['saltversioninfo'] >= [2017, 7] %}
+  - unmask: true
+{%- endif %}
   - watch:
     - file: /etc/neutron/l2gateway_agent.ini
     - file: /etc/neutron/neutron.conf
diff --git a/neutron/files/ocata/ml2_conf.ini b/neutron/files/ocata/ml2_conf.ini
index 6f2df28..c0fbbd3 100644
--- a/neutron/files/ocata/ml2_conf.ini
+++ b/neutron/files/ocata/ml2_conf.ini
@@ -210,7 +210,17 @@
 # default '*' to allow flat networks with arbitrary physical_network names. Use
 # an empty list to disable flat networks. (list value)
 #flat_networks = *
-flat_networks = *
+{%- set flat_nets = [] %}
+
+{%- for physnet, params in server.backend.get('physnets', {}).iteritems() %}
+{%- do flat_nets.append(physnet) if 'flat' in params.get('types', []) %}
+{%- endfor %}
+
+{%- if not flat_nets %}
+{%- do flat_nets.append(server.backend.get('flat_networks_default', '*')) %}
+{%- endif %}
+
+flat_networks = {{ ','.join(flat_nets) }}
 
 
 [ml2_type_geneve]
@@ -259,7 +269,7 @@
 {%- set network_vlan_ranges = [] %}
 
 {%- for physnet, params in server.backend.get('physnets', {}).iteritems() %}
-{%- do network_vlan_ranges.append([physnet, params.get('vlan_range')]|join(":") if params.get('vlan_range', False) else physnet) %}
+{%- do network_vlan_ranges.append([physnet, params.get('vlan_range')]|join(":") if params.get('vlan_range', False) else physnet) if 'vlan' in params.get('types', ['vlan']) %}
 {%- endfor %}
 
 {%- if not network_vlan_ranges %}
diff --git a/neutron/files/pike/ml2_conf.ini b/neutron/files/pike/ml2_conf.ini
index aaee0b0..d46a271 100644
--- a/neutron/files/pike/ml2_conf.ini
+++ b/neutron/files/pike/ml2_conf.ini
@@ -214,7 +214,17 @@
 # default '*' to allow flat networks with arbitrary physical_network names. Use
 # an empty list to disable flat networks. (list value)
 #flat_networks = *
-flat_networks = *
+{%- set flat_nets = [] %}
+
+{%- for physnet, params in server.backend.get('physnets', {}).iteritems() %}
+{%- do flat_nets.append(physnet) if 'flat' in params.get('types', []) %}
+{%- endfor %}
+
+{%- if not flat_nets %}
+{%- do flat_nets.append(server.backend.get('flat_networks_default', '*')) %}
+{%- endif %}
+
+flat_networks = {{ ','.join(flat_nets) }}
 
 
 [ml2_type_geneve]
@@ -262,7 +272,7 @@
 {%- set network_vlan_ranges = [] %}
 
 {%- for physnet, params in server.backend.get('physnets', {}).iteritems() %}
-{%- do network_vlan_ranges.append([physnet, params.get('vlan_range')]|join(":") if params.get('vlan_range', False) else physnet) %}
+{%- do network_vlan_ranges.append([physnet, params.get('vlan_range')]|join(":") if params.get('vlan_range', False) else physnet) if 'vlan' in params.get('types', ['vlan']) %}
 {%- endfor %}
 
 {%- if not network_vlan_ranges %}
diff --git a/neutron/files/queens/ml2_conf.ini b/neutron/files/queens/ml2_conf.ini
index d6cefbe..9bc6906 100644
--- a/neutron/files/queens/ml2_conf.ini
+++ b/neutron/files/queens/ml2_conf.ini
@@ -120,7 +120,17 @@
 # default '*' to allow flat networks with arbitrary physical_network names. Use
 # an empty list to disable flat networks. (list value)
 #flat_networks = *
-flat_networks = *
+{%- set flat_nets = [] %}
+
+{%- for physnet, params in server.backend.get('physnets', {}).iteritems() %}
+{%- do flat_nets.append(physnet) if 'flat' in params.get('types', []) %}
+{%- endfor %}
+
+{%- if not flat_nets %}
+{%- do flat_nets.append(server.backend.get('flat_networks_default', '*')) %}
+{%- endif %}
+
+flat_networks = {{ ','.join(flat_nets) }}
 
 
 [ml2_type_geneve]
@@ -169,7 +179,7 @@
 {%- set network_vlan_ranges = [] %}
 
 {%- for physnet, params in server.backend.get('physnets', {}).iteritems() %}
-{%- do network_vlan_ranges.append([physnet, params.get('vlan_range')]|join(":") if params.get('vlan_range', False) else physnet) %}
+{%- do network_vlan_ranges.append([physnet, params.get('vlan_range')]|join(":") if params.get('vlan_range', False) else physnet) if 'vlan' in params.get('types', ['vlan']) %}
 {%- endfor %}
 
 {%- if not network_vlan_ranges %}
diff --git a/neutron/meta/fluentd.yml b/neutron/meta/fluentd.yml
index 5a5ca1d..39adee7 100644
--- a/neutron/meta/fluentd.yml
+++ b/neutron/meta/fluentd.yml
@@ -39,8 +39,8 @@
             emit_invalid_record_to_error: false
             parser:
               type: regexp
-              # Parse openstack http stats: https://regex101.com/r/Tf0XUK/3/
-              format: '\"(?<http_method>GET|POST|OPTIONS|DELETE|PUT|HEAD|TRACE|CONNECT|PATCH)\s(?<http_url>\S+)\s(?<http_version>[.\/\dHTFSP]+)\"(\sstatus:|)\s(?<http_status>\d{3})(\slen:|)\s(?<http_response_size>\d+)(\stime:|)\s(?<http_response_time>\d+\.\d+)'
+              # Parse openstack http stats: https://regex101.com/r/nuVmvy/1
+              format: '\"(?<http_method>GET|POST|OPTIONS|DELETE|PUT|HEAD|TRACE|CONNECT|PATCH)\s(?<http_url>\S+)\s(?<http_version>[.\/\dHTFSP]+)\"(\sstatus:|)\s(?<http_status>\d{3})(\s+len:|)\s(?<http_response_size>\d+)(\stime:|)\s(?<http_response_time>\d+\.\d+)'
               types: http_response_time:float
         match:
           unify_tag:
@@ -107,4 +107,4 @@
                 value: neutron
               - name: host
                 value: ${Hostname}
-{% endif %}
\ No newline at end of file
+{% endif %}
diff --git a/tests/pillar/control_single.sls b/tests/pillar/control_single.sls
index 79894f7..f6fb4e2 100644
--- a/tests/pillar/control_single.sls
+++ b/tests/pillar/control_single.sls
@@ -17,14 +17,22 @@
       password: password
       token: token
       tenant: admin
+      flat_networks_default: '*' # any allowed, default
       physnets:
         external:
           mtu: 1500
+          types:
+            - flat
         sriov_net:
           mtu: 9000 # Optional, defaults to 1500
           vlan_range: '100:200' # Optional
+          types:
+            - vlan
         ext_net2:
           mtu: 1500
+          types:
+            - flat
+            - vlan
     fwaas: false
     dns_domain: novalocal
     tunnel_type: vxlan