Currently, Security Groups Rules only match against IPv4/IPv6 traffic. While rest of the traffic is allowed by default which includes ARP, DHCP, FCoE etc. traffic without applying security groups. To align with OpenStack, it is necessary to add EtherType in Security Group Rules to match the protocol being used.