TCP flows are missing when using SG mode=learn on basic_vpnservice.robot

When running basic_vpnservice.robot with security_group_mode=learn,
a security group named "sg-vpnservice" is created with allow tcp,udp,icmp ingress and egress.
The VMs created with that SG.

In the compute, there are no tcp rules in tables 40-42, only flows of ip (although not configured ip rules).

As a result, the test fails each time it tries to ssh a vm.

cookie=0x6900000, duration=116.424s, table=42, n_packets=11, n_bytes=1000, priority=61010,ip,metadata=0x440000000000/0x1fffff0000000000 actions=learn(table=252,idle_timeout=300,priority=61010,cookie=0x6900000,eth_type=0x800,NXM_OF_IP_SRC[]=NXM_OF_IP_DST[],NXM_OF_IP_DST[]=NXM_OF_IP_SRC[],NXM_OF_IP_PROTO[],load:0x1->NXM_NX_REG5[0..7]),resubmit(,17)
cookie=0x6900000, duration=86.490s, table=42, n_packets=11, n_bytes=1000, priority=61010,ip,metadata=0x460000000000/0x1fffff0000000000 actions=learn(table=252,idle_timeout=300,priority=61010,cookie=0x6900000,eth_type=0x800,NXM_OF_IP_SRC[]=NXM_OF_IP_DST[],NXM_OF_IP_DST[]=NXM_OF_IP_SRC[],NXM_OF_IP_PROTO[],load:0x1->NXM_NX_REG5[0..7]),resubmit(,17)

Logs can be found at:
https://jenkins.opendaylight.org/sandbox/job/netvirt-vpnservice-csit-1node-openstack-mitaka-learn-boron/3/

Steps to reproduce:
run job: netvirt-vpnservice-csit-1node-openstack-mitaka-learn-boron in sandbox with
PATCHREFSPEC: refs/changes/92/47792/2