NSX-v IPSEC VPN routing issues after IPSec policy based VPN is modified

Products

• VMware NSX

Issue/Introduction

• After updating a policy-based VPN, to change a remote subnet from a /32 to a /29 network the /32 address was no longer accessible despite being within the range of the wider /29 network.
• After removing a remote subnet from a policy-based VPN and replacing it with a static route, traffic destined for the remote subnets was not routed to the interface associated with the static route.

Environment

VMware NSX Data center for vSphere

Cause

IPSec policy based VPN routing is not clearing down when VPN subnets are amended/moved/deleted.

Resolution

This is a known issue impacting VMware NSX Data Center for vSphere.

Workaround
* Redeploy or reboot the Edge on which VPN is configured.
* If the edge is deployed in HA configuration, you can avoid redeploy or reboot by setting the active edge admin state to down to force failover to the standby edge, which will route the traffic as expected, then set the admin state of the edge back to up to restore HA functionality.