After a NSX-v to NSX-T migration, L2 traffic may not work

Products

• VMware NSX

Issue/Introduction

You have successfully migrated from NSX-v to NSX-T 3.1.1.

On the ESXi host, using vsish we can see filtered packets:

vsish -e get /net/portsets/DvsPortset-X/ports/XXXXXXXX/outputStats

...

        FILTER <vswith-reverse:0x0>

                pktsStarted:793696

                pktsPassed:483910

                pktsDropped:2

                pktsFiltered:309784

                pktsQueued:0

                pktsFaulted:0

                pktsInjected:0

                pktErrors:0

...

You see ARP requests post DVFilter, but they are not seen at VnicRX:

Post DVfilter:

pktcap-uw --switchport XXXXXXXX --stage 1 --dir 1 --ethtype 0x0806 -o - |tcpdump-uw -enr - |grep "XXX.XXX.XXX.XXX" |grep "XXX.XXX.XXX.XXX"

VnicRX:

pktcap-uw --switchport XXXXXXXX --capture VnicRx --ethtype 0x0806 -o - |tcpdump-uw -enr - |grep "XXX.XXX.XXX.XXX" |grep "XXX.XXX.XXX.XXX"

 

Note: XXXXXXXX above is the switchport of the impacted VM.

DvsPortset-X is the portgroup used in your environment.

XXX.XXX.XXX.XXX represents the source and destination IP address in the packet capture.

Environment

VMware NSX-T Data Center 3.x
VMware NSX-T Data Center

Cause

As per NSX-T design for the NSX-v to NSX-T migration, in the host uplink profile of NSX-T manager UI, under the teaming section, it is should use the teaming policy “Loadbalance Source” not "Loadbalance Source MAC".

Resolution

Refer workaround section below.

Workaround:

Go to the NSX-T UI > System > Fabric > Profiles > Uplink Profiles
Edit the profile being used by the transport node.
Under Teamings, edit and change the Teaming Policy to Load Balance Source.