diff --git a/neutron/cmd/sanity/checks.py b/neutron/cmd/sanity/checks.py
index 761be3c0659..2f46f44629f 100644
--- a/neutron/cmd/sanity/checks.py
+++ b/neutron/cmd/sanity/checks.py
@@ -343,6 +343,17 @@ def ebtables_supported():
         return False
 
 
+def ipset_supported():
+    try:
+        cmd = ['ipset', '--version']
+        agent_utils.execute(cmd)
+        return True
+    except (OSError, RuntimeError, IndexError, ValueError) as e:
+        LOG.debug("Exception while checking for installed ipset. "
+                  "Exception: %s", e)
+        return False
+
+
 def get_minimal_dibbler_version_supported():
     return MINIMUM_DIBBLER_VERSION
 
diff --git a/neutron/cmd/sanity_check.py b/neutron/cmd/sanity_check.py
index c063481f73c..71a286d9a5c 100644
--- a/neutron/cmd/sanity_check.py
+++ b/neutron/cmd/sanity_check.py
@@ -39,6 +39,7 @@ def setup_conf():
     cfg.CONF.import_group('ml2_sriov',
                           'neutron.plugins.ml2.drivers.mech_sriov.mech_driver.'
                           'mech_driver')
+    cfg.CONF.import_group('SECURITYGROUP', 'neutron.agent.securitygroups_rpc')
     dhcp_agent.register_options(cfg.CONF)
     cfg.CONF.register_opts(l3_hamode_db.L3_HA_OPTS)
 
@@ -200,6 +201,14 @@ def check_ebtables():
     return result
 
 
+def check_ipset():
+    result = checks.ipset_supported()
+    if not result:
+        LOG.error(_LE('Cannot run ipset. Please ensure that it '
+                      'is installed.'))
+    return result
+
+
 # Define CLI opts to test specific features, with a callback for the test
 OPTS = [
     BoolOptCallback('ovs_vxlan', check_ovs_vxlan, default=False,
@@ -232,6 +241,8 @@ OPTS = [
                     help=_('Check keepalived IPv6 support')),
     BoolOptCallback('dibbler_version', check_dibbler_version,
                     help=_('Check minimal dibbler version')),
+    BoolOptCallback('ipset_installed', check_ipset,
+                    help=_('Check ipset installation')),
 ]
 
 
@@ -269,6 +280,8 @@ def enable_tests_from_config():
         cfg.CONF.set_override('ovsdb_native', True)
     if cfg.CONF.l3_ha:
         cfg.CONF.set_override('keepalived_ipv6_support', True)
+    if cfg.CONF.SECURITYGROUP.enable_ipset:
+        cfg.CONF.set_override('ipset_installed', True)
 
 
 def all_tests_passed():
diff --git a/neutron/tests/functional/sanity/test_sanity.py b/neutron/tests/functional/sanity/test_sanity.py
index 88846907120..37e81d5fa24 100644
--- a/neutron/tests/functional/sanity/test_sanity.py
+++ b/neutron/tests/functional/sanity/test_sanity.py
@@ -38,6 +38,9 @@ class SanityTestCase(base.BaseTestCase):
     def test_dibbler_version(self):
         checks.dibbler_version_supported()
 
+    def test_ipset_support(self):
+        checks.ipset_supported()
+
 
 class SanityTestCaseRoot(functional_base.BaseSudoTestCase):
     """Sanity checks that require root access.