diff --git a/deployment/ovn/ovn-dbs-pacemaker-puppet.yaml b/deployment/ovn/ovn-dbs-pacemaker-puppet.yaml
index 927dba3587..53c696e4f0 100644
--- a/deployment/ovn/ovn-dbs-pacemaker-puppet.yaml
+++ b/deployment/ovn/ovn-dbs-pacemaker-puppet.yaml
@@ -105,6 +105,14 @@ outputs:
           - tripleo::profile::pacemaker::ovn_dbs_bundle::sb_db_port: {get_param: OVNSouthboundServerPort}
           - tripleo::profile::pacemaker::ovn_dbs_bundle::container_backend: {get_param: ContainerCli}
           - tripleo::haproxy::ovn_dbs_manage_lb: false
+          - tripleo::ovn_dbs::firewall_rules:
+              '121 OVN DB server ports':
+                proto: 'tcp'
+                dport:
+                  # Control port for pcmk remote bundle
+                  - 3125
+                  - {get_param: OVNNorthboundServerPort}
+                  - {get_param: OVNSouthboundServerPort}
       service_config_settings: {}
       # BEGIN DOCKER SETTINGS
       puppet_config: