@@ -6,6 +6,7 @@
 from openstack import exceptions as sdk_exc
 from openstack.baremetal.baremetal_service import BaremetalService
 from openstack.baremetal.v1.node import Node as BaremetalNode
+from openstack.baremetal.v1.port import Port as BaremetalPort
 from oslo_config import cfg
 
 from neutron_understack import config
@@ -178,6 +179,11 @@ def node_vif_ids(self, node: str | BaremetalNode) -> list[str]:
         """Return the Neutron port (VIF) ids currently attached to the node."""
         return self.irclient.list_node_vifs(node)
 
+    def node_ports(self, node: str | BaremetalNode) -> list[BaremetalPort]:
+        """Return the node's baremetal ports, including their network fields."""
+        node_id = node.id if isinstance(node, BaremetalNode) else node
+        return list(self.irclient.ports(details=True, node_id=node_id))
+
     def adopt_node_for_router(
         self,
         node: str | BaremetalNode,
 
@@ -1,5 +1,6 @@
 import json
 import logging
+import time
 import weakref
 
 from neutron.objects import router as l3_obj
@@ -96,6 +97,14 @@ def __init__(self, l3_plugin):
         self._palo_alto_provider = f"{__name__}.{self.__class__.__name__}"
         self._interface_snapshots = weakref.WeakKeyDictionary()
         self._wiring = PaloAltoWiring(ironic=lambda: self._ironic)
+        # Check the appliance can be wired on BEFORE_CREATE, before Neutron
+        # creates the gateway port: rejecting there leaves nothing behind and
+        # the request can be retried. BEFORE events always re-raise errors.
+        registry.subscribe(
+            self._validate_gateway_create,
+            resources.ROUTER_GATEWAY,
+            events.BEFORE_CREATE,
+        )
         # Gateway attach must run on AFTER_CREATE (the gateway port does not
         # exist earlier) and must be cancellable so a wiring failure returns a
         # real API error instead of a swallowed 200. @registry.receives cannot
@@ -285,6 +294,24 @@ def _process_router_delete(self, resource, event, trigger, payload=None):
             router["id"],
         )
 
+    def _validate_gateway_create(self, resource, event, trigger, payload=None):
+        """ROUTER_GATEWAY / BEFORE_CREATE: check the gateway can be wired.
+
+        Read-only. Catches configuration problems (no adopted node, no NIC
+        Ironic can bind) before Neutron creates anything for the gateway.
+        """
+        router_id = payload.resource_id
+        if self._palo_alto_router(payload.context, router_id) is None:
+            return
+
+        started = time.monotonic()
+        self._wiring.check_can_attach(router_id)
+        LOG.debug(
+            "Palo Alto router %s gateway pre-check passed in %.3fs",
+            router_id,
+            time.monotonic() - started,
+        )
+
     def _process_gateway_create(self, resource, event, trigger, payload=None):
         """ROUTER_GATEWAY / AFTER_CREATE (cancellable): wire the gateway.
 
 
@@ -94,6 +94,15 @@ class PaloAltoParentNotAnnotated(n_exc.BadRequest):
     )
 
 
+# BadRequest -> HTTP 400: no NIC on the node can carry the parent port's VIF.
+class PaloAltoNodeHasNoUsablePort(n_exc.BadRequest):
+    message = (
+        "Ironic node %(node_id)s for Palo Alto router %(router_id)s has no "
+        "baremetal port with both physical_network and local_link_connection; "
+        "check the node's port enrollment."
+    )
+
+
 def _parent_port_name(router_id: str) -> str:
     """Deterministic name for the router's anchor-network parent port."""
     return f"{ANCHOR_PARENT_PORT_NAME_PREFIX}-{router_id}"
@@ -148,6 +157,15 @@ def _device_id_cleared(port: dict) -> Generator[None, None, None]:
         )
 
 
+def _is_bindable_port(port) -> bool:
+    """Return True if Ironic can attach the parent VIF here and annotate it.
+
+    Ironic fills the parent port's binding profile from these two fields; a
+    port without them leaves the parent unannotated and the wiring fails.
+    """
+    return bool(port.physical_network) and bool(port.local_link_connection)
+
+
 def _missing_binding_fields(port: dict) -> list[str]:
     """Return the binding fields Ironic should have set on the port but did not."""
     profile = port.get(portbindings.PROFILE) or {}
@@ -423,6 +441,19 @@ def _ensure_trunk(self, router_id: str, parent_port: dict) -> dict:
             return existing
         return self._create_trunk(router_id, parent_port)
 
+    def check_can_attach(self, router_id: str) -> None:
+        """Raise if the router's appliance cannot be wired; change nothing.
+
+        Meant to run before Neutron creates a gateway: rejecting the request
+        then leaves nothing to clean up, and the same request can be retried
+        once the node is fixed. Runtime failures are still possible later.
+        """
+        node = self._ironic().node_by_instance_uuid(router_id)
+        if node is None:
+            raise PaloAltoNodeNotAdopted(router_id=router_id)
+        if not any(_is_bindable_port(port) for port in self._ironic().node_ports(node)):
+            raise PaloAltoNodeHasNoUsablePort(router_id=router_id, node_id=node.id)
+
     def ensure_stack(self, router_id: str) -> AttachmentStack:
         """Find or create the router's parent port, VIF attachment and trunk.
 
 
@@ -245,6 +245,22 @@ def test_node_vif_ids(self, mocker):
         assert client.node_vif_ids(node) == ["p1", "p2"]
 
 
+class TestNodePorts:
+    def test_lists_the_nodes_ports_with_details(self, mocker):
+        client = _client(mocker)
+        client.irclient.ports.return_value = iter(["port-a", "port-b"])
+
+        assert client.node_ports(_node()) == ["port-a", "port-b"]
+        client.irclient.ports.assert_called_once_with(details=True, node_id="n1")
+
+    def test_accepts_a_node_id(self, mocker):
+        client = _client(mocker)
+        client.irclient.ports.return_value = iter([])
+
+        assert client.node_ports("n1") == []
+        client.irclient.ports.assert_called_once_with(details=True, node_id="n1")
+
+
 class TestReleaseClearsOwnership:
     def test_active_node_is_undeployed_then_ownership_cleared(self, mocker):
         client = _client(mocker)
 
@@ -534,6 +534,71 @@ def test_gateway_wiring_error_reaches_the_caller(self, mocker):
             for exc in failure.value.inner_exceptions
         )
 
+    def _gateway_create_check(self):
+        registry.publish(
+            resources.ROUTER_GATEWAY,
+            events.BEFORE_CREATE,
+            self,
+            payload=self._payload(metadata={"network_id": "ext-net"}),
+        )
+
+    def test_gateway_check_rejects_before_neutron_creates_the_gateway(self, mocker):
+        # BEFORE_CREATE runs before the gateway port exists, so rejecting here
+        # leaves nothing to clean up and the same request can be retried.
+        ironic = mocker.Mock()
+        ironic.node_by_instance_uuid.return_value = None
+        provider = _make_provider(
+            mocker, FakeFlavorPlugin(_palo_alto_driver()), ironic=ironic
+        )
+        provider.l3plugin.get_router.return_value = dict(self._ROUTER)
+
+        with pytest.raises(callback_exc.CallbackFailure) as failure:
+            self._gateway_create_check()
+
+        [error] = failure.value.inner_exceptions
+        assert isinstance(error, palo_alto_wiring.PaloAltoNodeNotAdopted)
+
+    def test_gateway_check_passes_without_creating_anything(self, mocker):
+        ironic = mocker.Mock()
+        ironic.node_by_instance_uuid.return_value = mocker.Mock(id="node-1")
+        ironic.node_ports.return_value = [
+            SimpleNamespace(
+                physical_network="physnet-1",
+                local_link_connection={"switch_id": "aa", "port_id": "Eth1/1"},
+            )
+        ]
+        core = mocker.Mock()
+        trunk_plugin = mocker.Mock()
+        mocker.patch(
+            "neutron_understack.utils.fetch_trunk_plugin", return_value=trunk_plugin
+        )
+        provider = _make_provider(
+            mocker,
+            FakeFlavorPlugin(_palo_alto_driver()),
+            ironic=ironic,
+            core_plugin=core,
+        )
+        provider.l3plugin.get_router.return_value = dict(self._ROUTER)
+
+        self._gateway_create_check()
+
+        ironic.node_ports.assert_called_once()
+        ironic.attach_vif_to_node.assert_not_called()
+        core.create_network.assert_not_called()
+        core.create_port.assert_not_called()
+        trunk_plugin.create_trunk.assert_not_called()
+
+    def test_gateway_check_ignores_other_flavors(self, mocker):
+        ironic = mocker.Mock()
+        provider = _make_provider(
+            mocker, FakeFlavorPlugin(_OTHER_DRIVER), ironic=ironic
+        )
+        provider.l3plugin.get_router.return_value = dict(self._ROUTER)
+
+        self._gateway_create_check()
+
+        ironic.node_by_instance_uuid.assert_not_called()
+
     def test_gateway_teardown_runs_before_gateway_port_delete(self, mocker):
         # BEFORE_DELETE is the last point where the gateway port still exists.
         core = mocker.Mock()
 
@@ -66,6 +66,16 @@ def _snapshot(**changes):
     return palo_alto_wiring.AttachmentSnapshot(**{**fields, **changes})
 
 
+def _ironic_port(physical_network="physnet-1", local_link_connection=None):
+    """An Ironic baremetal port; bindable unless a field is overridden empty."""
+    if local_link_connection is None:
+        local_link_connection = {"switch_id": "aa", "port_id": "Eth1/1"}
+    return SimpleNamespace(
+        physical_network=physical_network,
+        local_link_connection=local_link_connection,
+    )
+
+
 @pytest.fixture
 def core_plugin(mocker):
     core = mocker.Mock()
@@ -131,6 +141,7 @@ def test_no_subport_vlan_available_is_conflict(self):
         [
             palo_alto_wiring.PaloAltoNodeNotAdopted,
             palo_alto_wiring.PaloAltoParentNotAnnotated,
+            palo_alto_wiring.PaloAltoNodeHasNoUsablePort,
         ],
     )
     def test_wiring_errors_are_bad_request(self, exc):
@@ -399,6 +410,52 @@ def test_reuses_existing_trunk(self, wiring, trunk_plugin):
         trunk_plugin.create_trunk.assert_not_called()
 
 
+class TestCheckCanAttach:
+    """The read-only check run before Neutron creates a gateway."""
+
+    def test_passes_when_node_has_a_bindable_port(
+        self, wiring, ironic, node, core_plugin, trunk_plugin
+    ):
+        ironic.node_ports.return_value = [
+            _ironic_port(physical_network=None),
+            _ironic_port(),
+        ]
+
+        wiring.check_can_attach("r1")
+
+        ironic.node_ports.assert_called_once_with(node)
+        # Nothing is created or attached: the check must have no side effects.
+        ironic.attach_vif_to_node.assert_not_called()
+        core_plugin.create_network.assert_not_called()
+        core_plugin.create_port.assert_not_called()
+        trunk_plugin.create_trunk.assert_not_called()
+
+    def test_rejects_router_without_adopted_node(self, wiring, ironic):
+        ironic.node_by_instance_uuid.return_value = None
+
+        with pytest.raises(palo_alto_wiring.PaloAltoNodeNotAdopted, match="router r1 "):
+            wiring.check_can_attach("r1")
+        ironic.node_ports.assert_not_called()
+
+    @pytest.mark.parametrize(
+        "ports",
+        [
+            [],
+            [_ironic_port(physical_network=None)],
+            [_ironic_port(local_link_connection={})],
+        ],
+        ids=["no-ports", "no-physical-network", "no-local-link-connection"],
+    )
+    def test_rejects_node_without_bindable_port(self, wiring, ironic, node, ports):
+        ironic.node_ports.return_value = ports
+
+        with pytest.raises(
+            palo_alto_wiring.PaloAltoNodeHasNoUsablePort,
+            match="node node-1 for Palo Alto router r1",
+        ):
+            wiring.check_can_attach("r1")
+
+
 class TestEnsureStack:
     def test_binds_parent_before_building_trunk(self, mocker, wiring):
         parent = {"id": "parent-1"}