diff --git a/neutron/extensions/securitygroup.py b/neutron/extensions/securitygroup.py
index 5f004af48..5ebb9de69 100644
--- a/neutron/extensions/securitygroup.py
+++ b/neutron/extensions/securitygroup.py
@@ -116,7 +116,7 @@ def convert_protocol(value):
     try:
         val = int(value)
         if val >= 0 and val <= 255:
-            return val
+            return value
         raise SecurityGroupRuleInvalidProtocol(
             protocol=value, values=sg_supported_protocols)
     except (ValueError, TypeError):
diff --git a/neutron/tests/unit/test_extension_security_group.py b/neutron/tests/unit/test_extension_security_group.py
index 4a38f6da2..efd7e3edb 100644
--- a/neutron/tests/unit/test_extension_security_group.py
+++ b/neutron/tests/unit/test_extension_security_group.py
@@ -1427,5 +1427,15 @@ class TestConvertIPPrefixToCIDR(base.BaseTestCase):
             self.assertEqual(ext_sg.convert_ip_prefix_to_cidr(addr), addr)
 
 
+class TestConvertProtocol(base.BaseTestCase):
+    def test_convert_numeric_protocol(self):
+        assert(isinstance(ext_sg.convert_protocol('2'), str))
+
+    def test_convert_bad_protocol(self):
+        for val in ['bad', '256', '-1']:
+            self.assertRaises(ext_sg.SecurityGroupRuleInvalidProtocol,
+                              ext_sg.convert_protocol, val)
+
+
 class TestSecurityGroupsXML(TestSecurityGroups):
     fmt = 'xml'