diff --git a/ansible/roles/nova/templates/nova.conf.j2 b/ansible/roles/nova/templates/nova.conf.j2
index 83d592291a..b4e7a6bf75 100644
--- a/ansible/roles/nova/templates/nova.conf.j2
+++ b/ansible/roles/nova/templates/nova.conf.j2
@@ -14,6 +14,12 @@ metadata_workers = {{ openstack_service_workers }}
 metadata_listen = {{ api_interface_address }}
 metadata_listen_port = {{ nova_metadata_port }}
 
+# NOTE(mgoddard): This option has been deprecated but RDO sets a different
+# default value for it in /usr/share/nova/nova-dist.conf which causes the
+# ironic virt driver to fail to load. See
+# https://bugs.launchpad.net/kolla-ansible/+bug/1701564.
+firewall_driver = nova.virt.firewall.NoopFirewallDriver
+
 allow_resize_to_same_host = true
 
 {% if enable_ironic | bool %}