--- a/nova/api/ec2/cloud.py	
+++ a/nova/api/ec2/cloud.py	
@@ -608,7 +608,7 @@ class CloudController(object):
                       to_port=to_port, msg="For ICMP, the"
                                            " type:code must be valid")
 
-            values['protocol'] = ip_protocol
+            values['protocol'] = ip_protocol.lower()
             values['from_port'] = from_port
             values['to_port'] = to_port
         else:
--- a/nova/api/openstack/compute/contrib/security_groups.py	
+++ a/nova/api/openstack/compute/contrib/security_groups.py	
@@ -497,7 +497,7 @@ class SecurityGroupRulesController(SecurityGroupControllerBase):
                       to_port=to_port, msg="For ICMP, the"
                                            " type:code must be valid")
 
-            values['protocol'] = ip_protocol
+            values['protocol'] = ip_protocol.lower()
             values['from_port'] = from_port
             values['to_port'] = to_port
         else:
--- a/nova/virt/firewall.py	
+++ a/nova/virt/firewall.py	
@@ -300,8 +300,8 @@ class IptablesFirewallDriver(FirewallDriver):
                 else:
                     fw_rules = ipv6_rules
 
-                protocol = rule.protocol
-                if version == 6 and rule.protocol == 'icmp':
+                protocol = rule.protocol.lower()
+                if version == 6 and protocol == 'icmp':
                     protocol = 'icmpv6'
 
                 args = ['-j ACCEPT']
