Symptoms:
- On The Host
nsxcli -c 'get logical-switch 697cd139-####-####-####-##########2d mac-table' | grep "83:e1:2e\|Entry"
Host Kernel Entry
00:50:56:##:##:2e 00:50:56:##:##:4e 10.220.136.11 0xb ==> Edge TEP
LCP Remote Entry
00:50:56:##:##:2e 00:50:56:##:##:4e 10.224.135.12
- The output of the command "net-vdl2 -n <logical segment VNI number>-M mac -s <name of NSX related switch>" also shows the incorrect MAC table entry pointing to the edge TEP while the issue happens:
Inner MAC: 00:50:56:##:##:2e
Outer MAC: 00:50:56:##:##:4e
Outer IP: 10.220.136.11
Flags: (V,U,A)
- While the ping fails, both the Edge and NSX-T manager show the MAC table entry for the Dst MAC (00:50:56:##:e##1:2e for this example):
- On The Edge
nsxcli -c 'get logical-switch 697cd139-####-####-####-##########2d mac-address-table'
MAC : 00:50:56:##:##:2e
Tunnel : 9c0192fc-####-####-####-##########09
IFUID : 448
LOCAL : 10.220.136.11
REMOTE : 10.224.135.12
ENCAP : GENEVE
SOURCE : Static
- On the NSX-T manager:
root@CYSNSXM02:~# nsxcli -c 'get logical-switch 697cd139-####-####-####-##########2d mac-table'
VNI MAC VTEP-IP TransportNode-ID
71691 00:50:56:##:##:2e 10.224.135.12 c14cff84-####-####-####-##########e8
- Reverse path filter has been configured on the ESXi host where the edge is running
esxcli system settings advanced list -o /Net/ReversePathFwdCheckPromisc
Path: /Net/ReversePathFwdCheckPromisc
Type: integer
Int Value: 1
Default Int Value: 0
Min Value: 0
Max Value: 1
String Value:
Default String Value:
Valid Characters:
Description: Block duplicate packet in a teamed environment when the virtual switch is set to Promiscuous mode.
The issue has been observed in NSX-T versions 3.0.1 and 3.1.1.
NOTE 1 : Please ensure that ReversePathFwdCheckPromisc is set on each ESXi hosts, which may host the EDGE Bridge VM. If the EDGE Bride VM moves to a host where ReversePathFwdCheckPromisc is not implemented, the traffic may be impacted as described above.
NOTE 2 : In NSX-T version 3.0.1 the "nsxdp-cli" command will not be persistent across reboots. For an alternative solution that persists across reboots contact VMware Support.