diff --git a/docs/packstack.rst b/docs/packstack.rst
index 0b417a8f4..b536579fd 100755
--- a/docs/packstack.rst
+++ b/docs/packstack.rst
@@ -986,6 +986,9 @@ Provisioning demo config
 **CONFIG_PROVISION_DEMO_FLOATRANGE**
     CIDR network address for the floating IP subnet.
 
+**CONFIG_PROVISION_DEMO_ALLOCATION_POOLS**
+    Allocation pools in the floating IP subnet.
+
 **CONFIG_PROVISION_IMAGE_URL**
     A URL or local file location for an image to download and provision in Glance (defaults to a URL for a recent "cirros" image).
 
diff --git a/packstack/plugins/provision_700.py b/packstack/plugins/provision_700.py
index cd06aa68e..f5005b26f 100644
--- a/packstack/plugins/provision_700.py
+++ b/packstack/plugins/provision_700.py
@@ -15,6 +15,7 @@
 """
 Installs and configures Provisioning for demo usage and testing
 """
+import json
 
 from packstack.installer import basedefs
 from packstack.installer import utils
@@ -103,6 +104,19 @@ def initConfig(controller):
              "NEED_CONFIRM": False,
              "CONDITION": False},
 
+            {"CMD_OPTION": "provision-demo-allocation-pools",
+             "PROMPT": ("Enter the allocation pools from the floating IP "
+                        "subnet, as JSON list [\"start=ip1,end=ip2\", ...]"),
+             "OPTION_LIST": [],
+             "VALIDATORS": [],
+             "DEFAULT_VALUE": "[]",
+             "MASK_INPUT": False,
+             "LOOSE_VALIDATION": False,
+             "CONF_NAME": "CONFIG_PROVISION_DEMO_ALLOCATION_POOLS",
+             "USE_DEFAULT": False,
+             "NEED_CONFIRM": False,
+             "CONDITION": False},
+
             {"CMD_OPTION": "provision-image-name",
              "PROMPT": "Enter the name to be assigned to the demo image",
              "OPTION_LIST": False,
@@ -369,3 +383,9 @@ def initConfig(controller):
 
 def initSequences(controller):
     config = controller.CONF
+    # params modification
+    key = 'CONFIG_PROVISION_DEMO_ALLOCATION_POOLS'
+    value = config.get(key, "[]")
+    config[key] = json.loads(value)
+    if type(config[key]) is not list:
+        raise KeyError("Key %s is not a list: %s" % (key, config[key]))
diff --git a/packstack/puppet/modules/packstack/manifests/provision.pp b/packstack/puppet/modules/packstack/manifests/provision.pp
index c0cbab072..eb0d93039 100644
--- a/packstack/puppet/modules/packstack/manifests/provision.pp
+++ b/packstack/puppet/modules/packstack/manifests/provision.pp
@@ -10,11 +10,14 @@ class packstack::provision ()
       $password             = hiera('CONFIG_KEYSTONE_DEMO_PW')
       $tenant_name          = 'demo'
       $floating_range       = hiera('CONFIG_PROVISION_DEMO_FLOATRANGE')
+      $allocation_pools     = hiera(
+                              'CONFIG_PROVISION_DEMO_ALLOCATION_POOLS')
     } elsif $provision_tempest {
       $username             = hiera('CONFIG_PROVISION_TEMPEST_USER')
       $password             = hiera('CONFIG_PROVISION_TEMPEST_USER_PW')
       $tenant_name          = 'tempest'
       $floating_range       = hiera('CONFIG_PROVISION_TEMPEST_FLOATRANGE')
+      $allocation_pools     = []
       if (empty($tempest_user) or empty($tempest_password)) {
         fail("Both CONFIG_PROVISION_TEMPEST_USER and
         CONFIG_PROVISION_TEMPEST_USER_PW need to be configured.")
@@ -69,11 +72,12 @@ class packstack::provision ()
           provider_physical_network => $public_physnet,
         }
         neutron_subnet { $public_subnet_name:
-          ensure       => 'present',
-          cidr         => $floating_range,
-          enable_dhcp  => false,
-          network_name => $public_network_name,
-          tenant_name  => $admin_tenant_name,
+          ensure           => 'present',
+          cidr             => $floating_range,
+          allocation_pools => $allocation_pools,
+          enable_dhcp      => false,
+          network_name     => $public_network_name,
+          tenant_name      => $admin_tenant_name,
         }
         neutron_network { $private_network_name:
           ensure      => present,
diff --git a/releasenotes/notes/demo-allocation-pools-c535e4235c7edcb2.yaml b/releasenotes/notes/demo-allocation-pools-c535e4235c7edcb2.yaml
new file mode 100644
index 000000000..5c14af7bf
--- /dev/null
+++ b/releasenotes/notes/demo-allocation-pools-c535e4235c7edcb2.yaml
@@ -0,0 +1,4 @@
+---
+features:
+  - Introduced CONFIG_PROVISION_DEMO_ALLOCATION_POOLS
+    to restrict public subnet IP address allocations.