diff --git a/deployment/tripleo-firewall/tripleo-firewall-baremetal-puppet.yaml b/deployment/tripleo-firewall/tripleo-firewall-baremetal-puppet.yaml
index ca756466e7..774c106c56 100644
--- a/deployment/tripleo-firewall/tripleo-firewall-baremetal-puppet.yaml
+++ b/deployment/tripleo-firewall/tripleo-firewall-baremetal-puppet.yaml
@@ -39,6 +39,12 @@ parameters:
     description: Whether IPtables rules should be purged before setting up the new ones.
     type: boolean
 
+conditions:
+  no_ctlplane:
+    equals:
+      - get_params: [ServiceData, net_cidr_map, ctlplane]
+      - Null
+
 outputs:
   role_data:
     description: Role data for the TripleO firewall settings
@@ -60,6 +66,19 @@ outputs:
 
       step_config: |
         include ::tripleo::firewall
+
+      host_prep_tasks:
+        if:
+        - no_ctlplane
+        -
+          name: Ensure ctlplane subnet is set
+          fail:
+            msg: |
+              No CIDRs found in the ctlplane network tags.
+              Please refer to the documentation in order to
+              set the correct network tags in DeployedServerPortMap.
+        - null
+
       deploy_steps_tasks:
         - when: step|int == 0
           block: