NSX L4 Load Balancer drops packets due to session exhaustion

Products

• VMware NSX

Issue/Introduction

• New connections through an L4 load balancer are not working as expected with packets being dropped.
• Existing sessions are not impacted.

Environment

VMware NSX 
VMware NSX-T Data Center 

Cause

L4 LB has a session limit for each size of load balancer. Once this session limit has been exhausted new sessions will be unable to be established. 

You can check session limit as follows on an edge:

root@edge:~# grep l4_sessions /config/vmware/edge/lb/etc/lbs_*.conf
/config/vmware/edge/lb/etc/lbs_large.conf:l4_sessions        2100000;
/config/vmware/edge/lb/etc/lbs_medium.conf:l4_sessions        525000;
/config/vmware/edge/lb/etc/lbs_small.conf:l4_sessions        105000;
/config/vmware/edge/lb/etc/lbs_xlarge.conf:l4_sessions        4200000;

L4 LB cannot accept new session if session table is full. The following is example of reaching the session limit for a small size LB: 

edge> get load-balancer ########-####-####-####-##########ff session-tables | count l4lb
Tue Jul 05 2022 UTC 04:53:39.558
Number of lines that match pattern 'l4lb': 105000

The above session limit is the session limit for the load balancer instance and not the virtual server, therefore if multiple l4 virtual servers are running on one instance this limit will be shared across them.

Resolution

As sessions expire and the session table clears new sessions will be able to establish however if this is not a one off level of traffic then please consider changing LB size if session limit is not enough to handle traffic.