Edge global ARP table usage high alarm

Products

• VMware NSX

Issue/Introduction

Title: Alarm for Edge global ARP table usage high.
Event ID: edge_health.edge_global_arp_table_usage_high
Alarm Description

• Purpose: Indicates usage percentage of global ARP table.
• Impact: Packets drops when number of ARP entries reaches maximum.

Environment

VMware NSX-T Data Center

 

Edge Form factors:

• Bare Metal Edge
• VM Edge

Cause

Alarm is raised when the ARP table is full and no new entries can be added any more.

Resolution

Steps to resolve
For 3.0.0 and higher

Recommenced Action :

• Consider increasing the ARP table size if it is lesser that default size (50000) which is also the maximum allowed size.
• If the ARP table size is set to the maximum value (50000), try segmenting the IP address range belonging to the Logical router into multiple Logical routers
• If the above steps don't resolve the alarm, check if the Edge node is compromised. 

Steps to increase the ARP limit:

1. Identify if router on which alarm is raised is Tier-0 or Tier-1
2. Get the Tier0/Tier1 message body using GET Policy API
   1. Tier-0: GET https://<NSX Manager IP>/policy/api/v1/infra/tier-0s/<tier-0 name>
   2. Tier-1: GET https://<NSX Manager IP>/policy/api/v1/infra/tier-1s/<tier-1 name>
3. Add the arp_limit attribute if not present in the response or Update the arp_limit attribute if present 
4. Using the updated response payload as body and PATCH Tier-0/Tier-1 
   1. Tier-0: PATCH https://<NSX Manager IP>/policy/api/v1/infra/tier-0s/<tier-0 name>
   2. Tier-1: PATCH https://<NSX Manager IP>/policy/api/v1/infra/tier-1s/<tier-1 name>
5. Valid range for arp_llimit:
   1. Minimum: 5000
   2. Maximum: 50000

Maintenance window required for remediation? Yes