I thought that was it.
I remembered some experience I had with a test install that recommended turning the network filter off.
You probably already did this, but when you turn off filtering or make other changes
to the logical network like MTU size you must completely shutdown the attached VMs and restart them
from oVIrt engine to pickup the change for their network interface.
Restarting networking in a VM from within its OS won't pick up the logical network change
at the necessary KVM/qemu/libvirt levels.
There should a way to verify the various virtual interfaces don't have any filtering configured or enabled,