diff --git a/muranorepository/Services/activeDirectory-manifest.yaml b/muranorepository/Services/activeDirectory-manifest.yaml
index e59e92d..f39fcfc 100644
--- a/muranorepository/Services/activeDirectory-manifest.yaml
+++ b/muranorepository/Services/activeDirectory-manifest.yaml
@@ -14,6 +14,7 @@ heat:
 - RouterInterface.template
 - Windows.template
 - Network.template
+- NNSecurity.template
 - Param.template
 - Subnet.template
 - InstancePortWSubnet.template
diff --git a/muranorepository/Services/aspNetApp-manifest.yaml b/muranorepository/Services/aspNetApp-manifest.yaml
index f9accab..077be12 100644
--- a/muranorepository/Services/aspNetApp-manifest.yaml
+++ b/muranorepository/Services/aspNetApp-manifest.yaml
@@ -23,6 +23,7 @@ heat:
   - InstancePort.template
   - InstancePortWSubnet.template
   - Network.template
+  - NNSecurity.template
   - Param.template
   - RouterInterface.template
   - Subnet.template
diff --git a/muranorepository/Services/aspNetAppFarm-manifest.yaml b/muranorepository/Services/aspNetAppFarm-manifest.yaml
index 74dc5bf..e6d0c7a 100644
--- a/muranorepository/Services/aspNetAppFarm-manifest.yaml
+++ b/muranorepository/Services/aspNetAppFarm-manifest.yaml
@@ -23,6 +23,7 @@ heat:
   - InstancePort.template
   - InstancePortWSubnet.template
   - Network.template
+  - NNSecurity.template
   - Param.template
   - RouterInterface.template
   - Subnet.template
diff --git a/muranorepository/Services/demoService-manifest.yaml b/muranorepository/Services/demoService-manifest.yaml
index f243077..4bcf0bf 100644
--- a/muranorepository/Services/demoService-manifest.yaml
+++ b/muranorepository/Services/demoService-manifest.yaml
@@ -8,6 +8,7 @@ heat:
 - Demo.template
 - RouterInterface.template
 - Network.template
+- NNSecurity.template
 - Param.template
 - Subnet.template
 - InstancePortWSubnet.template
diff --git a/muranorepository/Services/heat_templates/NNSecurity.template b/muranorepository/Services/heat_templates/NNSecurity.template
new file mode 100644
index 0000000..c6d617c
--- /dev/null
+++ b/muranorepository/Services/heat_templates/NNSecurity.template
@@ -0,0 +1,13 @@
+{
+    "Resources": {
+        "$instanceName": {
+            "Properties": {
+                "SecurityGroups": [
+                    {
+                        "Ref": "MuranoDefaultSecurityGroup"
+                    }
+                ]
+            }
+        }
+    }
+}
\ No newline at end of file
diff --git a/muranorepository/Services/linuxApacheService-manifest.yaml b/muranorepository/Services/linuxApacheService-manifest.yaml
index c9b29b5..6f3ae83 100644
--- a/muranorepository/Services/linuxApacheService-manifest.yaml
+++ b/muranorepository/Services/linuxApacheService-manifest.yaml
@@ -23,6 +23,7 @@ heat:
   - InstancePort.template
   - InstancePortWSubnet.template
   - Network.template
+  - NNSecurity.template
   - Param.template
   - RouterInterface.template
   - Subnet.template
diff --git a/muranorepository/Services/linuxTelnetService-manifest.yaml b/muranorepository/Services/linuxTelnetService-manifest.yaml
index 56f79ef..50bab0a 100644
--- a/muranorepository/Services/linuxTelnetService-manifest.yaml
+++ b/muranorepository/Services/linuxTelnetService-manifest.yaml
@@ -22,6 +22,7 @@ heat:
   - InstancePort.template
   - InstancePortWSubnet.template
   - Network.template
+  - NNSecurity.template
   - Param.template
   - RouterInterface.template
   - Subnet.template
diff --git a/muranorepository/Services/msSqlClusterServer-manifest.yaml b/muranorepository/Services/msSqlClusterServer-manifest.yaml
index 9442a29..1c6b281 100644
--- a/muranorepository/Services/msSqlClusterServer-manifest.yaml
+++ b/muranorepository/Services/msSqlClusterServer-manifest.yaml
@@ -24,6 +24,7 @@ heat:
   - InstancePort.template
   - InstancePortWSubnet.template
   - Network.template
+  - NNSecurity.template
   - Param.template
   - RouterInterface.template
   - Subnet.template
diff --git a/muranorepository/Services/msSqlServer-manifest.yaml b/muranorepository/Services/msSqlServer-manifest.yaml
index d25df2b..f4ed1f5 100644
--- a/muranorepository/Services/msSqlServer-manifest.yaml
+++ b/muranorepository/Services/msSqlServer-manifest.yaml
@@ -24,6 +24,7 @@ heat:
   - InstancePort.template
   - InstancePortWSubnet.template
   - Network.template
+  - NNSecurity.template
   - Param.template
   - RouterInterface.template
   - Subnet.template
diff --git a/muranorepository/Services/webServer-manifest.yaml b/muranorepository/Services/webServer-manifest.yaml
index f64b968..8922014 100644
--- a/muranorepository/Services/webServer-manifest.yaml
+++ b/muranorepository/Services/webServer-manifest.yaml
@@ -23,6 +23,7 @@ heat:
   - InstancePort.template
   - InstancePortWSubnet.template
   - Network.template
+  - NNSecurity.template
   - Param.template
   - RouterInterface.template
   - Subnet.template
diff --git a/muranorepository/Services/webServerFarm-manifest.yaml b/muranorepository/Services/webServerFarm-manifest.yaml
index 2b2ae96..c19fd9d 100644
--- a/muranorepository/Services/webServerFarm-manifest.yaml
+++ b/muranorepository/Services/webServerFarm-manifest.yaml
@@ -23,6 +23,7 @@ heat:
   - InstancePort.template
   - InstancePortWSubnet.template
   - Network.template
+  - NNSecurity.template
   - Param.template
   - RouterInterface.template
   - Subnet.template
diff --git a/muranorepository/Services/workflows/Networking.xml b/muranorepository/Services/workflows/Networking.xml
index f69c83c..8008336 100644
--- a/muranorepository/Services/workflows/Networking.xml
+++ b/muranorepository/Services/workflows/Networking.xml
@@ -37,6 +37,10 @@
             </get-default-network-id>
         </rule>
 
+      <rule match="$[?(@.networking.topology == 'nova' and not @.networking.state.ready_for_cf)]"
+              desc="Nova topology - skip all neutron actions">
+          <set path="networking.state.ready_for_cf"><true/></set>
+      </rule>
 
         <rule match="$[?(@.networking.topology == 'manual' and not @.networking.state.ready_for_cidrs)]"
               desc="No topology queries required, ready to query cidrs">
@@ -185,6 +189,17 @@
             </update-cf-stack>
         </rule>
 
+      <rule match="$[?(@.networking.state.ready_for_cf and @.networking.topology == 'nova')].services[*].units[?(@.state.hostname and not @.temp.instanceName)]"
+              desc="Need to define SecGroups for nova topology">
+          <update-cf-stack template="NNSecurity">
+              <parameter name="mappings">
+                  <map>
+                      <mapping name="instanceName"><select path="state.hostname"/></mapping>
+                  </map>
+              </parameter>
+          </update-cf-stack>
+      </rule>
+
         <rule match="$[?(@.networking.createNetwork and @.networking.state.ready_for_cf)]">
             <rule match="$.services[*].units[?(@.state.hostname and not @.temp.instanceName)]"
                 desc="Units to be created requiring ports in new network">