Communication failure on HCX Layer 2 extended network due to DVS security policies - VMware HCX
search cancel

Communication failure on HCX Layer 2 extended network due to DVS security policies - VMware HCX

book

Article ID: 321612

calendar_today

Updated On:

Products

VMware HCX

Issue/Introduction

Virtual machines (VMs) residing on a Layer 2 extended network (VLAN) between an on-premises data center and a cloud site is is not able to communicate to OnPrem VM over L2C extended segment.

Symptoms:

  • Cloud VMs cannot communicate with on-premises VMs on the same extended segment.
  • Packet captures taken simultaneously on the cloud and on-premises NE appliances show that ARP request packets from the on-premises site and ARP reply packets from the cloud are visible on the on-premises NE appliance vNIC interface attached to the extended segment. This confirms that the data path across the Layer 2 extension is functional, but return packets from the cloud are not reaching the on-premises VM.
  • The issue often occurs when VMs and the NE appliance are placed on separate Distributed Virtual Switch (DVS) port groups using the same VLAN ID.

Log Indicators: When DVS port group policies for MAC address changes and Forged transmits are set to Reject, the following error messages may appear in the HCX Network Extension appliance logs:

[Err-macUpdate] : Cannot send mac entries: rpc error: code = Unavailable desc = connection error: desc = "transport: Error while dialing: dial tcp <IP_ADDRESS>:8182: connect: connection refused"

OR

[Err-macUpdate] : Failed to stream update: rpc error: code = DeadlineExceeded desc = context deadline exceeded

Log Locations:

  • /var/log/messages* on the NE appliances.
  • In the HCX support bundle: <bundle>/HCX/<appliance-name>-NE-*/var/log/messages*.

Environment

  • VMware HCX
  • VMware vSphere Distributed Switch (DVS) 6.7, 7.x, 8.x

Cause

When using HCX Network Extension (NE) to extend VLAN port groups associated with a vSphere Distributed Switch (DVS), the MAC address changes and Forged transmits policies must be in the Accept state.

If these policies are set to Reject, packets originating from a cloud VM can reach the on-premises NE appliance's sink port attached to the extended segment, but they are dropped by the DVS port group itself and fail to reach the on-premises VM.

Resolution

Update the DVS security policies to Accept for the port groups involved in the HCX Network Extension.

  1. Access the on-premises vCenter Server via the vSphere Client.
  2. Navigate to Networking and select the Distributed Port Group used for the HCX Network Extension.
  3. Select Configure > Settings > Policies > Security.
  4. Click Edit and set the following policies to Accept:
    • MAC address changes
    • Forged transmits
  5. Ensure these settings are applied to both the port group hosting the VMs and the port group hosting the NE appliance if they are distinct.
  6. Verify that ARP resolution completes and bidirectional communication is restored.

Additional Information

The difference between MAC Address Changes and Forged Transmits involves the direction of the traffic:

  • MAC Address Changes: Concerns the integrity of incoming traffic. If set to Reject, traffic from the HCX vNIC is not passed through the DVS to the virtual machine (incoming) if the initial and effective MAC addresses do not match.
  • Forged Transmits: Oversees the integrity of outgoing traffic. If set to Reject, traffic is not passed from the virtual machine to the DVS (outgoing) if the initial and effective MAC addresses do not match.

The HCX NE appliance requires both policies to be in the Accept state to bridge traffic effectively across the Layer 2 extension.

Powered by Wolken Software