diff --git a/manifests/controller.pp b/manifests/controller.pp
index caac303..3285a46 100644
--- a/manifests/controller.pp
+++ b/manifests/controller.pp
@@ -240,6 +240,7 @@ class openstack::controller (
   $neutron_db_name         = 'neutron',
   $neutron_auth_url        = 'http://127.0.0.1:35357/v2.0',
   $enable_neutron_server   = true,
+  $security_group_api      = 'neutron',
   # swift
   $swift                   = false,
   $swift_public_address    = false,
@@ -402,6 +403,7 @@ class openstack::controller (
     neutron                 => $neutron,
     neutron_user_password   => $neutron_user_password,
     metadata_shared_secret  => $metadata_shared_secret,
+    security_group_api      => $security_group_api,
     # Nova
     nova_admin_tenant_name  => $nova_admin_tenant_name,
     nova_admin_user         => $nova_admin_user,
diff --git a/manifests/nova/controller.pp b/manifests/nova/controller.pp
index daf4cb6..3b767d0 100644
--- a/manifests/nova/controller.pp
+++ b/manifests/nova/controller.pp
@@ -74,6 +74,7 @@ class openstack::nova::controller (
   $neutron                   = true,
   $neutron_user_password     = false,
   $metadata_shared_secret    = undef,
+  $security_group_api        = 'neutron',
   # Nova
   $nova_admin_tenant_name    = 'services',
   $nova_admin_user           = 'nova',
@@ -217,6 +218,7 @@ class openstack::nova::controller (
       neutron_admin_tenant_name => 'services',
       neutron_admin_username    => 'neutron',
       neutron_admin_auth_url    => "http://${keystone_host}:35357/v2.0",
+      security_group_api        => $security_group_api,
     }
   }
 
diff --git a/spec/classes/openstack_controller_spec.rb b/spec/classes/openstack_controller_spec.rb
index 9974afe..62faaec 100644
--- a/spec/classes/openstack_controller_spec.rb
+++ b/spec/classes/openstack_controller_spec.rb
@@ -597,6 +597,8 @@ describe 'openstack::controller' do
 
       it { should_not contain_class('nova::network') }
 
+      it { should contain_class('nova::network::neutron').with(:security_group_api => 'neutron') }
+
       it 'should configure neutron' do
 
         should contain_class('openstack::neutron').with(
diff --git a/spec/classes/openstack_nova_controller_spec.rb b/spec/classes/openstack_nova_controller_spec.rb
index b9fa284..ef0de92 100644
--- a/spec/classes/openstack_nova_controller_spec.rb
+++ b/spec/classes/openstack_nova_controller_spec.rb
@@ -68,7 +68,8 @@ describe 'openstack::nova::controller' do
         :neutron_url               => "http://127.0.0.1:9696",
         :neutron_admin_tenant_name => 'services',
         :neutron_admin_username    => 'neutron',
-        :neutron_admin_auth_url    => "http://127.0.0.1:35357/v2.0"
+        :neutron_admin_auth_url    => "http://127.0.0.1:35357/v2.0",
+        :security_group_api        => 'neutron'
       )
 
       ['nova::scheduler', 'nova::objectstore', 'nova::cert', 'nova::consoleauth', 'nova::conductor'].each do |x|