diff --git a/apps/kubevirt-networking/app/src/main/java/org/onosproject/kubevirtnetworking/impl/KubevirtSecurityGroupHandler.java b/apps/kubevirt-networking/app/src/main/java/org/onosproject/kubevirtnetworking/impl/KubevirtSecurityGroupHandler.java
index c551369..674c6ca 100644
--- a/apps/kubevirt-networking/app/src/main/java/org/onosproject/kubevirtnetworking/impl/KubevirtSecurityGroupHandler.java
+++ b/apps/kubevirt-networking/app/src/main/java/org/onosproject/kubevirtnetworking/impl/KubevirtSecurityGroupHandler.java
@@ -297,6 +297,19 @@
 
     private void initializeTenantAclTable(KubevirtNetwork network,
                                             DeviceId deviceId, boolean install) {
+        // FIXME: in bridge initialization phase, some patch ports may not be
+        // available until they are created, we wait for a while ensure all
+        // patch ports are created via network bootstrap
+        while (true) {
+            if (network.tenantToTunnelPort(deviceId) != null) {
+                break;
+            } else {
+                log.info("Wait for tenant patch ports creation for device {} " +
+                         "and network {}", deviceId, network.networkId());
+                waitFor(5);
+            }
+        }
+
         PortNumber patchPort = network.tenantToTunnelPort(deviceId);
         initializeAclTable(deviceId, TENANT_ACL_RECIRC_TABLE, patchPort, install);
     }