diff --git a/magnum/conductor/template_definition.py b/magnum/conductor/template_definition.py
index d12b6c9ba9..3d485ae038 100644
--- a/magnum/conductor/template_definition.py
+++ b/magnum/conductor/template_definition.py
@@ -482,7 +482,7 @@ class K8sTemplateDefinition(BaseTemplateDefinition):
 
         extra_params['discovery_url'] = self.get_discovery_url(bay)
 
-        label_list = ['flannel_network_cidr', 'flannel_use_vxlan',
+        label_list = ['flannel_network_cidr', 'flannel_backend',
                       'flannel_network_subnetlen']
         for label in label_list:
             extra_params[label] = baymodel.labels.get(label)
@@ -597,7 +597,7 @@ class AtomicSwarmTemplateDefinition(BaseTemplateDefinition):
         extra_params['user_token'] = self._get_user_token(context, osc, bay)
         extra_params['magnum_url'] = osc.magnum_url()
 
-        label_list = ['flannel_network_cidr', 'flannel_use_vxlan',
+        label_list = ['flannel_network_cidr', 'flannel_backend',
                       'flannel_network_subnetlen']
 
         for label in label_list:
diff --git a/magnum/templates/kubernetes/README.md b/magnum/templates/kubernetes/README.md
index b8fa2d41be..9ab32e8888 100644
--- a/magnum/templates/kubernetes/README.md
+++ b/magnum/templates/kubernetes/README.md
@@ -26,11 +26,6 @@ work with Juno as well as soon as [#1402894][] is resolved.
 These templates will work with either CentOS Atomic Host or Fedora 21
 Atomic.
 
-You can enable the VXLAN backend for flannel by setting the
-"flannel_use_vxlan" parameter to "true", but I have run into kernel
-crashes using that backend with CentOS 7.  It seems to work fine with
-Fedora 21.
-
 You can enable docker registry v2 by setting the "registry_enabled"
 parameter to "true".
 
@@ -146,4 +141,3 @@ When submitting pull requests:
   stylistic/formatting/cleanup changes.
 
 [github repository]: https://github.com/larsks/heat-kubernetes/
-
diff --git a/magnum/templates/kubernetes/fragments/configure-flannel.sh b/magnum/templates/kubernetes/fragments/configure-flannel.sh
index caf6970fd6..3015648d44 100644
--- a/magnum/templates/kubernetes/fragments/configure-flannel.sh
+++ b/magnum/templates/kubernetes/fragments/configure-flannel.sh
@@ -5,28 +5,15 @@
 
 FLANNEL_JSON=/etc/sysconfig/flannel-network.json
 
-if [ "$FLANNEL_USE_VXLAN" == "true" ]; then
-    use_vxlan=1
-fi
-
 # Generate a flannel configuration that we will
 # store into etcd using curl.
 cat > $FLANNEL_JSON <<EOF
 {
   "Network": "$FLANNEL_NETWORK_CIDR",
-  "Subnetlen": $FLANNEL_NETWORK_SUBNETLEN
-EOF
-
-if [ "$use_vxlan" = 1 ]; then
-    cat >> $FLANNEL_JSON <<EOF
-  ,
+  "Subnetlen": $FLANNEL_NETWORK_SUBNETLEN,
   "Backend": {
-    "Type": "vxlan"
+    "Type": "$FLANNEL_BACKEND"
   }
-EOF
-fi
-
-cat >> $FLANNEL_JSON <<EOF
 }
 EOF
 
diff --git a/magnum/templates/kubernetes/fragments/write-heat-params-master.yaml b/magnum/templates/kubernetes/fragments/write-heat-params-master.yaml
index 76159f96fe..74675dd5c7 100644
--- a/magnum/templates/kubernetes/fragments/write-heat-params-master.yaml
+++ b/magnum/templates/kubernetes/fragments/write-heat-params-master.yaml
@@ -14,7 +14,7 @@ write_files:
       NETWORK_DRIVER="$NETWORK_DRIVER"
       FLANNEL_NETWORK_CIDR="$FLANNEL_NETWORK_CIDR"
       FLANNEL_NETWORK_SUBNETLEN="$FLANNEL_NETWORK_SUBNETLEN"
-      FLANNEL_USE_VXLAN="$FLANNEL_USE_VXLAN"
+      FLANNEL_BACKEND="$FLANNEL_BACKEND"
       PORTAL_NETWORK_CIDR="$PORTAL_NETWORK_CIDR"
       ETCD_DISCOVERY_URL="$ETCD_DISCOVERY_URL"
       USERNAME="$USERNAME"
diff --git a/magnum/templates/kubernetes/fragments/write-network-config-coreos.yaml b/magnum/templates/kubernetes/fragments/write-network-config-coreos.yaml
index cd780a6f6d..4c42b032ba 100644
--- a/magnum/templates/kubernetes/fragments/write-network-config-coreos.yaml
+++ b/magnum/templates/kubernetes/fragments/write-network-config-coreos.yaml
@@ -25,18 +25,13 @@ write_files:
           exit 0
       fi
 
-      backend_type=udp
-      if [ "$FLANNEL_USE_VXLAN" == "true" ]; then
-          backend_type=vxlan
-      fi
-
       FLANNEL_JSON=/etc/sysconfig/flannel-network.json
       cat > $FLANNEL_JSON <<EOF
       {
           "Network": "$FLANNEL_NETWORK_CIDR",
           "Subnetlen": $FLANNEL_NETWORK_SUBNETLEN,
           "Backend": {
-              "Type": "$backend_type"
+              "Type": "$FLANNEL_BACKEND"
           }
       }
       EOF
diff --git a/magnum/templates/kubernetes/fragments/write-network-config.sh b/magnum/templates/kubernetes/fragments/write-network-config.sh
index 3dcae192ca..1fcadcdedf 100644
--- a/magnum/templates/kubernetes/fragments/write-network-config.sh
+++ b/magnum/templates/kubernetes/fragments/write-network-config.sh
@@ -10,35 +10,19 @@ fi
 
 FLANNEL_JSON=/etc/sysconfig/flannel-network.json
 FLANNELD_CONFIG=/etc/sysconfig/flanneld
-FLANNEL_NETWORK_CIDR="$FLANNEL_NETWORK_CIDR"
-FLANNEL_NETWORK_SUBNETLEN="$FLANNEL_NETWORK_SUBNETLEN"
-FLANNEL_USE_VXLAN="$FLANNEL_USE_VXLAN"
 
 sed -i '
   /^FLANNEL_ETCD=/ s/=.*/="http:\/\/127.0.0.1:2379"/
 ' /etc/sysconfig/flanneld
 
-if [ "$FLANNEL_USE_VXLAN" == "true" ]; then
-    use_vxlan=1
-fi
-
 # Generate a flannel configuration that we will
 # store into etcd using curl.
 cat > $FLANNEL_JSON <<EOF
 {
   "Network": "$FLANNEL_NETWORK_CIDR",
-  "Subnetlen": $FLANNEL_NETWORK_SUBNETLEN
-EOF
-
-if [ "$use_vxlan" = 1 ]; then
-    cat >> $FLANNEL_JSON <<EOF
-  ,
+  "Subnetlen": $FLANNEL_NETWORK_SUBNETLEN,
   "Backend": {
-    "Type": "vxlan"
+    "Type": "$FLANNEL_BACKEND"
   }
-EOF
-fi
-
-cat >> $FLANNEL_JSON <<EOF
 }
 EOF
diff --git a/magnum/templates/kubernetes/kubecluster-coreos.yaml b/magnum/templates/kubernetes/kubecluster-coreos.yaml
index d79b630acc..350e2d4881 100644
--- a/magnum/templates/kubernetes/kubecluster-coreos.yaml
+++ b/magnum/templates/kubernetes/kubecluster-coreos.yaml
@@ -72,14 +72,13 @@ parameters:
     description: size of subnet assigned to each minion
     default: 24
 
-  flannel_use_vxlan:
+  flannel_backend:
     type: string
     description: >
-      if true use the vxlan backend, otherwise use the default
-      udp backend
-    default: "false"
+      specify the backend for flannel, default udp backend
+    default: "udp"
     constraints:
-      - allowed_values: ["true", "false"]
+      - allowed_values: ["udp", "vxlan", "host-gw"]
 
   kube_allow_priv:
     type: string
@@ -208,7 +207,7 @@ resources:
           kube_allow_priv: {get_param: kube_allow_priv}
           flannel_network_cidr: {get_param: flannel_network_cidr}
           flannel_network_subnetlen: {get_param: flannel_network_subnetlen}
-          flannel_use_vxlan: {get_param: flannel_use_vxlan}
+          flannel_backend: {get_param: flannel_backend}
           portal_network_cidr: {get_param: portal_network_cidr}
           fixed_network: {get_resource: fixed_network}
           fixed_subnet: {get_resource: fixed_subnet}
@@ -240,6 +239,7 @@ resources:
           minion_flavor: {get_param: minion_flavor}
           fixed_network: {get_resource: fixed_network}
           fixed_subnet: {get_resource: fixed_subnet}
+          flannel_network_cidr: {get_param: flannel_network_cidr}
           kube_master_ip: {"Fn::Select": [0, {get_attr: [kube_master, kube_master_ip]}]}
           external_network: {get_param: external_network}
           kube_allow_priv: {get_param: kube_allow_priv}
diff --git a/magnum/templates/kubernetes/kubecluster-fedora-ironic.yaml b/magnum/templates/kubernetes/kubecluster-fedora-ironic.yaml
index 01051b5842..33e5875685 100644
--- a/magnum/templates/kubernetes/kubecluster-fedora-ironic.yaml
+++ b/magnum/templates/kubernetes/kubecluster-fedora-ironic.yaml
@@ -54,14 +54,13 @@ parameters:
     description: size of subnet assigned to each minion
     default: 24
 
-  flannel_use_vxlan:
+  flannel_backend:
     type: string
     description: >
-      if true use the vxlan backend, otherwise use the default
-      udp backend
-    default: "false"
+      specify the backend for flannel, default udp backend
+    default: "udp"
     constraints:
-      - allowed_values: ["true", "false"]
+      - allowed_values: ["udp", "vxlan", "host-gw"]
 
   kube_allow_priv:
     type: string
@@ -161,7 +160,7 @@ resources:
           wait_condition_timeout: {get_param: wait_condition_timeout}
           flannel_network_cidr: {get_param: flannel_network_cidr}
           flannel_network_subnetlen: {get_param: flannel_network_subnetlen}
-          flannel_use_vxlan: {get_param: flannel_use_vxlan}
+          flannel_backend: {get_param: flannel_backend}
           portal_network_cidr: {get_param: portal_network_cidr}
           fixed_network: {get_resource: fixed_network}
           auth_url: {get_param: auth_url}
diff --git a/magnum/templates/kubernetes/kubecluster.yaml b/magnum/templates/kubernetes/kubecluster.yaml
index edf2a090eb..83c3356738 100644
--- a/magnum/templates/kubernetes/kubecluster.yaml
+++ b/magnum/templates/kubernetes/kubecluster.yaml
@@ -71,14 +71,13 @@ parameters:
     description: size of subnet assigned to each minion
     default: 24
 
-  flannel_use_vxlan:
+  flannel_backend:
     type: string
     description: >
-      if true use the vxlan backend, otherwise use the default
-      udp backend
-    default: "false"
+      specify the backend for flannel, default udp backend
+    default: "udp"
     constraints:
-      - allowed_values: ["true", "false"]
+      - allowed_values: ["udp", "vxlan", "host-gw"]
 
   kube_allow_priv:
     type: string
@@ -436,7 +435,7 @@ resources:
           network_driver: {get_param: network_driver}
           flannel_network_cidr: {get_param: flannel_network_cidr}
           flannel_network_subnetlen: {get_param: flannel_network_subnetlen}
-          flannel_use_vxlan: {get_param: flannel_use_vxlan}
+          flannel_backend: {get_param: flannel_backend}
           portal_network_cidr: {get_param: portal_network_cidr}
           discovery_url: {get_param: discovery_url}
           user_token: {get_param: user_token}
@@ -486,6 +485,7 @@ resources:
           fixed_network: {get_resource: fixed_network}
           fixed_subnet: {get_resource: fixed_subnet}
           network_driver: {get_param: network_driver}
+          flannel_network_cidr: {get_param: flannel_network_cidr}
           kube_master_ip: {get_attr: [api_pool, vip, address]}
           etcd_server_ip: {get_attr: [etcd_pool, vip, address]}
           external_network: {get_param: external_network}
diff --git a/magnum/templates/kubernetes/kubemaster-coreos.yaml b/magnum/templates/kubernetes/kubemaster-coreos.yaml
index caa5a109dc..aea71d84d9 100644
--- a/magnum/templates/kubernetes/kubemaster-coreos.yaml
+++ b/magnum/templates/kubernetes/kubemaster-coreos.yaml
@@ -59,14 +59,13 @@ parameters:
     description: size of subnet assigned to each master
     default: 24
 
-  flannel_use_vxlan:
+  flannel_backend:
     type: string
     description: >
-      if true use the vxlan backend, otherwise use the default
-      udp backend
-    default: "false"
+      specify the backend for flannel, default udp backend
+    default: "udp"
     constraints:
-      - allowed_values: ["true", "false"]
+      - allowed_values: ["udp", "vxlan", "host-gw"]
 
   fixed_network:
     type: string
@@ -166,7 +165,7 @@ resources:
             "$KUBE_ALLOW_PRIV": {get_param: kube_allow_priv}
             "$FLANNEL_NETWORK_CIDR": {get_param: flannel_network_cidr}
             "$FLANNEL_NETWORK_SUBNETLEN": {get_param: flannel_network_subnetlen}
-            "$FLANNEL_USE_VXLAN": {get_param: flannel_use_vxlan}
+            "$FLANNEL_BACKEND": {get_param: flannel_backend}
             "$PORTAL_NETWORK_CIDR": {get_param: portal_network_cidr}
             "$CLUSTER_SUBNET": {get_param: fixed_subnet}
             "$ETCD_DISCOVERY_URL": {get_param: discovery_url}
@@ -324,6 +323,8 @@ resources:
         - {get_resource: secgroup_kubernetes}
       fixed_ips:
         - subnet: {get_param: fixed_subnet}
+      allowed_address_pairs:
+        - ip_address: {get_param: flannel_network_cidr}
       replacement_policy: AUTO
 
   kube_master_floating:
diff --git a/magnum/templates/kubernetes/kubemaster-fedora-ironic.yaml b/magnum/templates/kubernetes/kubemaster-fedora-ironic.yaml
index ff2f5f62ec..421d39fddc 100644
--- a/magnum/templates/kubernetes/kubemaster-fedora-ironic.yaml
+++ b/magnum/templates/kubernetes/kubemaster-fedora-ironic.yaml
@@ -45,14 +45,13 @@ parameters:
     description: size of subnet assigned to each minion
     default: 24
 
-  flannel_use_vxlan:
+  flannel_backend:
     type: string
     description: >
-      if true use the vxlan backend, otherwise use the default
-      udp backend
-    default: "false"
+      specify the backend for flannel, default udp backend
+    default: "udp"
     constraints:
-      - allowed_values: ["true", "false"]
+      - allowed_values: ["udp", "vxlan", "host-gw"]
 
   kube_allow_priv:
     type: string
@@ -147,7 +146,7 @@ resources:
             "$KUBE_ALLOW_PRIV": {get_param: kube_allow_priv}
             "$FLANNEL_NETWORK_CIDR": {get_param: flannel_network_cidr}
             "$FLANNEL_NETWORK_SUBNETLEN": {get_param: flannel_network_subnetlen}
-            "$FLANNEL_USE_VXLAN": {get_param: flannel_use_vxlan}
+            "$FLANNEL_BACKEND": {get_param: flannel_backend}
             "$PORTAL_NETWORK_CIDR": {get_param: portal_network_cidr}
             "$AUTH_URL": {get_param: auth_url}
             "$USERNAME": {get_param: username}
diff --git a/magnum/templates/kubernetes/kubemaster.yaml b/magnum/templates/kubernetes/kubemaster.yaml
index 94cb3ab8a0..439a28da14 100644
--- a/magnum/templates/kubernetes/kubemaster.yaml
+++ b/magnum/templates/kubernetes/kubemaster.yaml
@@ -56,14 +56,13 @@ parameters:
     description: size of subnet assigned to each master
     default: 24
 
-  flannel_use_vxlan:
+  flannel_backend:
     type: string
     description: >
-      if true use the vxlan backend, otherwise use the default
-      udp backend
-    default: "false"
+      specify the backend for flannel, default udp backend
+    default: "udp"
     constraints:
-      - allowed_values: ["true", "false"]
+      - allowed_values: ["udp", "vxlan", "host-gw"]
 
   discovery_url:
     type: string
@@ -214,7 +213,7 @@ resources:
             "$NETWORK_DRIVER": {get_param: network_driver}
             "$FLANNEL_NETWORK_CIDR": {get_param: flannel_network_cidr}
             "$FLANNEL_NETWORK_SUBNETLEN": {get_param: flannel_network_subnetlen}
-            "$FLANNEL_USE_VXLAN": {get_param: flannel_use_vxlan}
+            "$FLANNEL_BACKEND": {get_param: flannel_backend}
             "$PORTAL_NETWORK_CIDR": {get_param: portal_network_cidr}
             "$ETCD_DISCOVERY_URL": {get_param: discovery_url}
             "$AUTH_URL": {get_param: auth_url}
@@ -399,6 +398,8 @@ resources:
         - {get_param: secgroup_kube_master_id}
       fixed_ips:
         - subnet: {get_param: fixed_subnet}
+      allowed_address_pairs:
+        - ip_address: {get_param: flannel_network_cidr}
       replacement_policy: AUTO
 
   kube_master_floating:
diff --git a/magnum/templates/kubernetes/kubeminion-coreos.yaml b/magnum/templates/kubernetes/kubeminion-coreos.yaml
index b5e7d5ea9b..239dc511b0 100644
--- a/magnum/templates/kubernetes/kubeminion-coreos.yaml
+++ b/magnum/templates/kubernetes/kubeminion-coreos.yaml
@@ -67,6 +67,9 @@ parameters:
   fixed_subnet:
     type: string
     description: Subnet from which to allocate fixed addresses.
+  flannel_network_cidr:
+    type: string
+    description: network range for flannel overlay network
 
 resources:
 
@@ -196,6 +199,8 @@ resources:
         - get_resource: secgroup_all_open
       fixed_ips:
         - subnet: {get_param: fixed_subnet}
+      allowed_address_pairs:
+        - ip_address: {get_param: flannel_network_cidr}
       replacement_policy: AUTO
 
   kube_minion_floating:
diff --git a/magnum/templates/kubernetes/kubeminion.yaml b/magnum/templates/kubernetes/kubeminion.yaml
index ca6f98e0fd..6d7ac42426 100644
--- a/magnum/templates/kubernetes/kubeminion.yaml
+++ b/magnum/templates/kubernetes/kubeminion.yaml
@@ -81,6 +81,9 @@ parameters:
   network_driver:
     type: string
     description: network driver to use for instantiating container networks
+  flannel_network_cidr:
+    type: string
+    description: network range for flannel overlay network
   wait_condition_timeout:
     type: number
     description : >
@@ -389,6 +392,8 @@ resources:
         - get_param: secgroup_kube_minion_id
       fixed_ips:
         - subnet: {get_param: fixed_subnet}
+      allowed_address_pairs:
+        - ip_address: {get_param: flannel_network_cidr}
       replacement_policy: AUTO
 
   kube_minion_floating:
diff --git a/magnum/templates/swarm/fragments/write-heat-params.yaml b/magnum/templates/swarm/fragments/write-heat-params.yaml
index 873c9c09fb..b02f591b45 100644
--- a/magnum/templates/swarm/fragments/write-heat-params.yaml
+++ b/magnum/templates/swarm/fragments/write-heat-params.yaml
@@ -20,7 +20,7 @@ write_files:
       NETWORK_DRIVER="$NETWORK_DRIVER"
       FLANNEL_NETWORK_CIDR="$FLANNEL_NETWORK_CIDR"
       FLANNEL_NETWORK_SUBNETLEN="$FLANNEL_NETWORK_SUBNETLEN"
-      FLANNEL_USE_VXLAN="$FLANNEL_USE_VXLAN"
+      FLANNEL_BACKEND="$FLANNEL_BACKEND"
       ETCD_SERVER_IP="$ETCD_SERVER_IP"
       API_IP_ADDRESS="$API_IP_ADDRESS"
       SWARM_VERSION="$SWARM_VERSION"
diff --git a/magnum/templates/swarm/fragments/write-network-config.sh b/magnum/templates/swarm/fragments/write-network-config.sh
index e6e2d0cb72..37670b72b8 100644
--- a/magnum/templates/swarm/fragments/write-network-config.sh
+++ b/magnum/templates/swarm/fragments/write-network-config.sh
@@ -7,31 +7,16 @@ if [ "$NETWORK_DRIVER" != "flannel" ]; then
 fi
 
 FLANNEL_JSON=/etc/sysconfig/flannel-network.json
-FLANNEL_NETWORK_CIDR="$FLANNEL_NETWORK_CIDR"
-FLANNEL_NETWORK_SUBNETLEN="$FLANNEL_NETWORK_SUBNETLEN"
-FLANNEL_USE_VXLAN="$FLANNEL_USE_VXLAN"
-
-if [ "$FLANNEL_USE_VXLAN" == "true" ]; then
-    use_vxlan=1
-fi
 
 # Generate a flannel configuration that we will
 # store into etcd using curl.
 cat > $FLANNEL_JSON <<EOF
 {
   "Network": "$FLANNEL_NETWORK_CIDR",
-  "Subnetlen": $FLANNEL_NETWORK_SUBNETLEN
-EOF
-
-if [ "$use_vxlan" = 1 ]; then
-cat >> $FLANNEL_JSON <<EOF
-  ,
+  "Subnetlen": $FLANNEL_NETWORK_SUBNETLEN,
   "Backend": {
-    "Type": "vxlan"
+    "Type": "$FLANNEL_BACKEND"
   }
-EOF
-fi
-
-cat >> $FLANNEL_JSON <<EOF
 }
 EOF
+
diff --git a/magnum/templates/swarm/swarmcluster.yaml b/magnum/templates/swarm/swarmcluster.yaml
index 262e934879..9274a57cca 100644
--- a/magnum/templates/swarm/swarmcluster.yaml
+++ b/magnum/templates/swarm/swarmcluster.yaml
@@ -110,14 +110,13 @@ parameters:
     description: size of subnet assigned to each master
     default: 24
 
-  flannel_use_vxlan:
+  flannel_backend:
     type: string
     description: >
-      if true use the vxlan backend, otherwise use the default
-      udp backend
-    default: "false"
+      specify the backend for flannel, default udp backend
+    default: "udp"
     constraints:
-      - allowed_values: ["true", "false"]
+      - allowed_values: ["udp", "vxlan", "host-gw"]
 
   docker_volume_size:
     type: number
@@ -318,7 +317,7 @@ resources:
           network_driver: {get_param: network_driver}
           flannel_network_cidr: {get_param: flannel_network_cidr}
           flannel_network_subnetlen: {get_param: flannel_network_subnetlen}
-          flannel_use_vxlan: {get_param: flannel_use_vxlan}
+          flannel_backend: {get_param: flannel_backend}
           swarm_port: {get_param: swarm_port}
           api_pool_id: {get_resource: api_pool}
           etcd_pool_id: {get_resource: etcd_pool}
@@ -352,6 +351,7 @@ resources:
           magnum_url: {get_param: magnum_url}
           tls_disabled: {get_param: tls_disabled}
           secgroup_swarm_node_id: {get_resource: secgroup_manager}
+          flannel_network_cidr: {get_param: flannel_network_cidr}
           network_driver: {get_param: network_driver}
           etcd_server_ip: {get_attr: [etcd_pool, vip, address]}
           api_ip_address: {get_attr: [api_pool_floating, floating_ip_address]}
diff --git a/magnum/templates/swarm/swarmmaster.yaml b/magnum/templates/swarm/swarmmaster.yaml
index 61a6c617b3..e5bba58090 100644
--- a/magnum/templates/swarm/swarmmaster.yaml
+++ b/magnum/templates/swarm/swarmmaster.yaml
@@ -88,13 +88,12 @@ parameters:
     type: string
     description: size of subnet assigned to each master
 
-  flannel_use_vxlan:
+  flannel_backend:
     type: string
     description: >
-      if true use the vxlan backend, otherwise use the default
-      udp backend
+      specify the backend for flannel, default udp backend
     constraints:
-      - allowed_values: ["true", "false"]
+      - allowed_values: ["udp", "vxlan", "host-gw"]
 
   swarm_version:
     type: string
@@ -175,7 +174,7 @@ resources:
             "$NETWORK_DRIVER": {get_param: network_driver}
             "$FLANNEL_NETWORK_CIDR": {get_param: flannel_network_cidr}
             "$FLANNEL_NETWORK_SUBNETLEN": {get_param: flannel_network_subnetlen}
-            "$FLANNEL_USE_VXLAN": {get_param: flannel_use_vxlan}
+            "$FLANNEL_BACKEND": {get_param: flannel_backend}
             "$ETCD_SERVER_IP": {get_param: etcd_server_ip}
             "$API_IP_ADDRESS": {get_param: api_ip_address}
             "$SWARM_VERSION": {get_param: swarm_version}
@@ -343,6 +342,8 @@ resources:
       fixed_ips:
         - subnet_id:
             get_param: fixed_subnet_id
+      allowed_address_pairs:
+        - ip_address: {get_param: flannel_network_cidr}
 
   swarm_master_floating:
     type: "OS::Neutron::FloatingIP"
diff --git a/magnum/templates/swarm/swarmnode.yaml b/magnum/templates/swarm/swarmnode.yaml
index 99a611ead5..d50c7f618d 100644
--- a/magnum/templates/swarm/swarmnode.yaml
+++ b/magnum/templates/swarm/swarmnode.yaml
@@ -41,6 +41,10 @@ parameters:
     type: string
     description: network driver to use for instantiating container networks
 
+  flannel_network_cidr:
+    type: string
+    description: network range for flannel overlay network
+
   discovery_url:
     type: string
     description: url provided for node discovery
@@ -272,6 +276,8 @@ resources:
       fixed_ips:
         - subnet_id:
             get_param: fixed_subnet_id
+      allowed_address_pairs:
+        - ip_address: {get_param: flannel_network_cidr}
 
   swarm_node_floating:
     type: "OS::Neutron::FloatingIP"
diff --git a/magnum/tests/unit/conductor/handlers/test_k8s_bay_conductor.py b/magnum/tests/unit/conductor/handlers/test_k8s_bay_conductor.py
index 6964165ff2..110b5f3bb7 100644
--- a/magnum/tests/unit/conductor/handlers/test_k8s_bay_conductor.py
+++ b/magnum/tests/unit/conductor/handlers/test_k8s_bay_conductor.py
@@ -41,7 +41,7 @@ class TestBayConductorWithK8s(base.TestCase):
             'no_proxy': 'no_proxy',
             'labels': {'flannel_network_cidr': '10.101.0.0/16',
                        'flannel_network_subnetlen': '26',
-                       'flannel_use_vxlan': 'yes'},
+                       'flannel_backend': 'vxlan'},
             'tls_disabled': False,
             'server_type': 'vm'
         }
@@ -114,7 +114,7 @@ class TestBayConductorWithK8s(base.TestCase):
             'discovery_url': 'discovery_url',
             'labels': {'flannel_network_cidr': '10.101.0.0/16',
                        'flannel_network_subnetlen': '26',
-                       'flannel_use_vxlan': 'yes'},
+                       'flannel_backend': 'vxlan'},
             'http_proxy': 'http_proxy',
             'https_proxy': 'https_proxy',
             'no_proxy': 'no_proxy',
@@ -137,7 +137,7 @@ class TestBayConductorWithK8s(base.TestCase):
             'discovery_url': 'https://discovery.etcd.io/test',
             'flannel_network_cidr': '10.101.0.0/16',
             'flannel_network_subnetlen': '26',
-            'flannel_use_vxlan': 'yes',
+            'flannel_backend': 'vxlan',
             'http_proxy': 'http_proxy',
             'https_proxy': 'https_proxy',
             'no_proxy': 'no_proxy',
@@ -188,7 +188,7 @@ class TestBayConductorWithK8s(base.TestCase):
             'no_proxy': 'no_proxy',
             'flannel_network_cidr': '10.101.0.0/16',
             'flannel_network_subnetlen': '26',
-            'flannel_use_vxlan': 'yes',
+            'flannel_backend': 'vxlan',
             'tls_disabled': False,
             'trustee_domain_id': '3527620c-b220-4f37-9ebc-6e63a81a9b2f',
             'trustee_username': 'fake_trustee',
@@ -233,7 +233,7 @@ class TestBayConductorWithK8s(base.TestCase):
             'no_proxy': 'no_proxy',
             'flannel_network_cidr': '10.101.0.0/16',
             'flannel_network_subnetlen': '26',
-            'flannel_use_vxlan': 'yes',
+            'flannel_backend': 'vxlan',
             'tls_disabled': False,
             'trustee_domain_id': '3527620c-b220-4f37-9ebc-6e63a81a9b2f',
             'trustee_username': 'fake_trustee',
@@ -347,7 +347,7 @@ class TestBayConductorWithK8s(base.TestCase):
             'no_proxy': 'no_proxy',
             'flannel_network_cidr': '10.101.0.0/16',
             'flannel_network_subnetlen': '26',
-            'flannel_use_vxlan': 'yes',
+            'flannel_backend': 'vxlan',
             'tenant_name': 'fake_tenant',
             'username': 'fake_user',
             'user_token': 'fake_token',
diff --git a/magnum/tests/unit/conductor/handlers/test_swarm_bay_conductor.py b/magnum/tests/unit/conductor/handlers/test_swarm_bay_conductor.py
index 284f4a52e3..667abdb4f3 100644
--- a/magnum/tests/unit/conductor/handlers/test_swarm_bay_conductor.py
+++ b/magnum/tests/unit/conductor/handlers/test_swarm_bay_conductor.py
@@ -44,7 +44,7 @@ class TestBayConductorWithSwarm(base.TestCase):
             'network_driver': 'network_driver',
             'labels': {'flannel_network_cidr': '10.101.0.0/16',
                        'flannel_network_subnetlen': '26',
-                       'flannel_use_vxlan': 'yes'}
+                       'flannel_backend': 'vxlan'}
         }
         self.bay_dict = {
             'id': 1,
@@ -108,7 +108,7 @@ class TestBayConductorWithSwarm(base.TestCase):
             'network_driver': 'network_driver',
             'flannel_network_cidr': '10.101.0.0/16',
             'flannel_network_subnetlen': '26',
-            'flannel_use_vxlan': 'yes',
+            'flannel_backend': 'vxlan',
             'trustee_domain_id': '3527620c-b220-4f37-9ebc-6e63a81a9b2f',
             'trustee_username': 'fake_trustee',
             'trustee_password': 'fake_trustee_password',
@@ -151,7 +151,7 @@ class TestBayConductorWithSwarm(base.TestCase):
             'tls_disabled': False,
             'flannel_network_cidr': u'10.101.0.0/16',
             'flannel_network_subnetlen': u'26',
-            'flannel_use_vxlan': u'yes',
+            'flannel_backend': u'vxlan',
             'trustee_domain_id': '3527620c-b220-4f37-9ebc-6e63a81a9b2f',
             'trustee_username': 'fake_trustee',
             'trustee_password': 'fake_trustee_password',
diff --git a/magnum/tests/unit/conductor/test_template_definition.py b/magnum/tests/unit/conductor/test_template_definition.py
index 06b57ca860..90ec45ea4c 100644
--- a/magnum/tests/unit/conductor/test_template_definition.py
+++ b/magnum/tests/unit/conductor/test_template_definition.py
@@ -193,7 +193,7 @@ class AtomicK8sTemplateDefinitionTestCase(base.TestCase):
 
         flannel_cidr = mock_baymodel.labels.get('flannel_network_cidr')
         flannel_subnet = mock_baymodel.labels.get('flannel_network_subnetlen')
-        flannel_vxlan = mock_baymodel.labels.get('flannel_use_vxlan')
+        flannel_backend = mock_baymodel.labels.get('flannel_backend')
 
         k8s_def = tdef.AtomicK8sTemplateDefinition()
 
@@ -204,8 +204,8 @@ class AtomicK8sTemplateDefinitionTestCase(base.TestCase):
             'minions_to_remove': removal_nodes,
             'discovery_url': 'fake_discovery_url',
             'flannel_network_cidr': flannel_cidr,
-            'flannel_use_vxlan': flannel_subnet,
-            'flannel_network_subnetlen': flannel_vxlan,
+            'flannel_network_subnetlen': flannel_subnet,
+            'flannel_backend': flannel_backend,
             'username': 'fake_user',
             'tenant_name': 'fake_tenant',
             'magnum_url': mock_osc.magnum_url.return_value,
@@ -244,7 +244,7 @@ class AtomicK8sTemplateDefinitionTestCase(base.TestCase):
 
         flannel_cidr = mock_baymodel.labels.get('flannel_network_cidr')
         flannel_subnet = mock_baymodel.labels.get('flannel_network_subnetlen')
-        flannel_vxlan = mock_baymodel.labels.get('flannel_use_vxlan')
+        flannel_backend = mock_baymodel.labels.get('flannel_backend')
 
         k8s_def = tdef.AtomicK8sTemplateDefinition()
 
@@ -255,8 +255,8 @@ class AtomicK8sTemplateDefinitionTestCase(base.TestCase):
             'minions_to_remove': removal_nodes,
             'discovery_url': 'fake_discovery_url',
             'flannel_network_cidr': flannel_cidr,
-            'flannel_use_vxlan': flannel_subnet,
-            'flannel_network_subnetlen': flannel_vxlan,
+            'flannel_network_subnetlen': flannel_subnet,
+            'flannel_backend': flannel_backend,
             'username': 'fake_user',
             'tenant_name': 'fake_tenant',
             'magnum_url': mock_osc.magnum_url.return_value,
@@ -418,7 +418,7 @@ class AtomicSwarmTemplateDefinitionTestCase(base.TestCase):
 
         flannel_cidr = mock_baymodel.labels.get('flannel_network_cidr')
         flannel_subnet = mock_baymodel.labels.get('flannel_network_subnetlen')
-        flannel_vxlan = mock_baymodel.labels.get('flannel_use_vxlan')
+        flannel_backend = mock_baymodel.labels.get('flannel_backend')
 
         swarm_def = tdef.AtomicSwarmTemplateDefinition()
 
@@ -429,8 +429,8 @@ class AtomicSwarmTemplateDefinitionTestCase(base.TestCase):
             'user_token': mock_context.auth_token,
             'magnum_url': mock_osc.magnum_url.return_value,
             'flannel_network_cidr': flannel_cidr,
-            'flannel_use_vxlan': flannel_subnet,
-            'flannel_network_subnetlen': flannel_vxlan}}
+            'flannel_backend': flannel_backend,
+            'flannel_network_subnetlen': flannel_subnet}}
         mock_get_params.assert_called_once_with(mock_context, mock_baymodel,
                                                 mock_bay, **expected_kwargs)
 
diff --git a/specs/container-networking-model.rst b/specs/container-networking-model.rst
index e6bb1a21ad..0577a3e407 100644
--- a/specs/container-networking-model.rst
+++ b/specs/container-networking-model.rst
@@ -225,7 +225,7 @@ Proposed Changes
                             --network-driver flannel \
                             --labels flannel_network_cidr=10.0.0.0/8,\
                                      flannel_network_subnetlen=22,\
-                                     flannel_use_vxlan=vxlan
+                                     flannel_backend=vxlan
 
    With Magnum's current implementation, this document would support
    labels for the Kubernetes COE type. However, labels are applicable