diff --git a/environments/undercloud.yaml b/environments/undercloud.yaml
index ca997aaae4..5f1456a8a1 100644
--- a/environments/undercloud.yaml
+++ b/environments/undercloud.yaml
@@ -61,9 +61,10 @@ parameter_defaults:
   IronicForcePowerStateDuringSync: false
   IronicInspectorCollectors: default,extra-hardware,numa-topology,logs
   IronicInspectorInterface: br-ctlplane
-  IronicProvisioningNetwork: 'ctlplane'
   IronicInspectorSubnets:
     - ip_range: '192.168.24.100,192.168.24.200'
+  IronicProvisioningNetwork: 'ctlplane'
+  IronicRescuingNetwork: 'ctlplane'
   ZaqarMessageStore: 'swift'
   ZaqarManagementStore: 'sqlalchemy'
   # our undercloud default eth1 for the control plane bridged interface
diff --git a/puppet/services/ironic-conductor.yaml b/puppet/services/ironic-conductor.yaml
index 75a5ff2253..7ab0dda631 100644
--- a/puppet/services/ironic-conductor.yaml
+++ b/puppet/services/ironic-conductor.yaml
@@ -81,6 +81,11 @@ parameters:
                  advances networking features. Requires
                  IronicProvisioningNetwork to be correctly set.
     type: string
+  IronicDefaultRescueInterface:
+    default: 'agent'
+    description: Default rescue implementation to use. The "agent" rescue
+                 requires a compatible ramdisk to be used.
+    type: string
   IronicDeployLogsStorageBackend:
     default: 'local'
     description: Backend to use to store ramdisk logs, either "local"
@@ -134,6 +139,11 @@ parameters:
     description: Enabled RAID interface implementations. Each hardware
                  type must have at least one valid implementation enabled.
     type: comma_delimited_list
+  IronicEnabledRescueInterfaces:
+    default: ['no-rescue', 'agent']
+    description: Enabled rescue interface implementations. Each hardware
+                 type must have at least one valid implementation enabled.
+    type: comma_delimited_list
   IronicEnabledStorageInterfaces:
     default: ['cinder', 'noop']
     description: Enabled storage interface implementations. Each hardware
@@ -169,6 +179,15 @@ parameters:
                  created yet) and should be changed to an actual UUID in
                  a post-deployment stack update.
     type: string
+  IronicRescuingNetwork:
+    default: 'provisioning'
+    description: Name or UUID of the *overcloud* network used for resucing
+                 of bare metal nodes, if IronicDefaultRescueInterface is not
+                 set to "no-rescue". The default value of "provisioning" can be
+                 left during the initial deployment (when no networks are
+                 created yet) and should be changed to an actual UUID in
+                 a post-deployment stack update.
+    type: string
   IronicForcePowerStateDuringSync:
     default: true
     description: Whether to force power state during sync.
@@ -217,6 +236,7 @@ outputs:
             ironic::conductor::cleaning_disk_erase: {get_param: IronicCleaningDiskErase}
             ironic::conductor::cleaning_network: {get_param: IronicCleaningNetwork}
             ironic::conductor::provisioning_network: {get_param: IronicProvisioningNetwork}
+            ironic::conductor::rescuing_network: {get_param: IronicRescuingNetwork}
             ironic::conductor::default_boot_option: {get_param: IronicDefaultBootOption}
             ironic::conductor::enabled_drivers: {get_param: IronicEnabledDrivers}
             ironic::conductor::automated_clean: {get_param: IronicAutomatedClean}
@@ -275,9 +295,11 @@ outputs:
             ironic::drivers::interfaces::enabled_network_interfaces: {get_param: IronicEnabledNetworkInterfaces}
             ironic::drivers::interfaces::enabled_power_interfaces: {get_param: IronicEnabledPowerInterfaces}
             ironic::drivers::interfaces::enabled_raid_interfaces: {get_param: IronicEnabledRaidInterfaces}
+            ironic::drivers::interfaces::enabled_rescue_interfaces: {get_param: IronicEnabledRescueInterfaces}
             ironic::drivers::interfaces::enabled_storage_interfaces: {get_param: IronicEnabledStorageInterfaces}
             ironic::drivers::interfaces::enabled_vendor_interfaces: {get_param: IronicEnabledVendorInterfaces}
             ironic::drivers::interfaces::default_network_interface: {get_param: IronicDefaultNetworkInterface}
+            ironic::drivers::interfaces::default_rescue_interface: {get_param: IronicDefaultRescueInterface}
             tripleo.ironic_conductor.firewall_rules:
               '134 ironic conductor TFTP':
                 dport: 69
diff --git a/releasenotes/notes/ironic-rescue-cb1edecce357fc0b.yaml b/releasenotes/notes/ironic-rescue-cb1edecce357fc0b.yaml
new file mode 100644
index 0000000000..278298a377
--- /dev/null
+++ b/releasenotes/notes/ironic-rescue-cb1edecce357fc0b.yaml
@@ -0,0 +1,5 @@
+---
+features:
+  - |
+    Rescue mode is now enabled by default in ironic. To disable it, set
+    ``IronicDefaultRescueInterface`` to ``no-rescue``.