When using NSX VXLAN, first connection through F5 Load Balancer fails

Products

• VMware NSX for vSphere

Issue/Introduction

When using NSX VXLAN, the first connection through F5 Load Balancer fails. The Load Balancer is reached through a DLR (source VM and F5 Load Balancer are on a different VXLAN).

Environment

• VMware NSX for vSphere 6.3.x
• VMware NSX for vSphere 6.2.x

Cause

• The issue occurs because the first packet sent to the DLR is queued waiting for the DLR to complete ARP resolution for the destination.
• After the ARP resolution process is complete, the queued packet get the "replace vMAC attribute" set incorrectly which causes the vMAC to be switch with the pMAC.
• When F5 feature Auto Last Hop is enabled, this will cause the F5 to send the response to the source MAC of the packet, which will be the pMAC for the first packet and the connection will fail.
• All subsequent packet swill have the vMAC as source MAC all those connection will succeed.

Resolution

This issue is resolved in VMware NSX for vSphere 6.4.0.

Workaround:
Disable the Auto Last Hop feature on the F5 Load Balancer.