diff --git a/deployment/sshd/sshd-baremetal-puppet.yaml b/deployment/sshd/sshd-baremetal-puppet.yaml
index d4a06ae9a3..bbb49fa219 100644
--- a/deployment/sshd/sshd-baremetal-puppet.yaml
+++ b/deployment/sshd/sshd-baremetal-puppet.yaml
@@ -87,7 +87,12 @@ outputs:
                 '003 accept ssh from all':
                   proto: 'tcp'
                   dport: 22
-            - null
+            - tripleo::sshd::firewall_rules:
+                '003 accept ssh from all':
+                  proto: 'tcp'
+                  dport: 22
+                  extras:
+                    ensure: 'absent'
 
       step_config: |
         include ::tripleo::profile::base::sshd