OpenStack Heat Template Composition

In my experience Openstack tenant instances that source or receive traffic from/to IPs not tied to a neutron net/port are denied by the default port security. This is the case of traffic from/to VS in LTM. To work around this I usually disable port security when creating the network:

client_data_network: type: OS::Neutron::Net properties: name: client_data_network port_security_enabled: False

or the more safe approach of using allowed_address_pairs with the port and declaring all the VS IP addresses that I'm planning to use.