...
2- go the the VM Instance and edit the Security Group ( remove the default and add the new one )
3- On Contrail the SG will be apply at the Port level
OpenStack Fundamentals: Managing Security Groups Using Dashboard
Widget Connector url https://www.youtube.com/watch?v=5nPOsbt6Rhc
3- On Contrail the SG will be apply at the Port level