To disable both Nova security groups, in nova.conf: firewall_driver=nova.virt.firewall.NoopFirewallDriver To disable nova metadata service, you just remove it from nova-api.

In fact, if you don't add overlapping IPs in quantum networks, I.E. you configure the networks without overlapping subnets. It dones not matter if u are using Nova security groups and the Nova metadata service or not.

In grizzly, we have implemented metadata proxy in quantum in the overlapping env. But it needs to run L3 service. the pure L2 is in BP.

In fact, you can run nova as usual if you are controlling the IP allocation so that it has no overlapping space.

If u are using overlapping IPs, you can run quantum's metadata proxy and agent in middle it will help u fix the overlapping problem.