Comment 2 for bug 985184

yup appears easy. Suggested patch:

diff --git a/nova/virt/firewall.py b/nova/virt/firewall.py
index 3f53334..62de2c2 100644
--- a/nova/virt/firewall.py
+++ b/nova/virt/firewall.py
@@ -300,7 +300,7 @@ class IptablesFirewallDriver(FirewallDriver):
                 else:
                     fw_rules = ipv6_rules

- protocol = rule.protocol
+ protocol = rule.protocol.lower()
                 if version == 6 and rule.protocol == 'icmp':
                     protocol = 'icmpv6'