NAT's for Service Insertion are configured on the 3rd party interface causing BFD_DOWN status in the edge cluster
search cancel

NAT's for Service Insertion are configured on the 3rd party interface causing BFD_DOWN status in the edge cluster

book

Article ID: 374595

calendar_today

Updated On:

Products

VMware vDefend Firewall

Issue/Introduction

When NAT's are configured on the North 3rd party component/interface and not controlled by NSX-T/T-0 you will see various portions of the Service Insertion setup in a down(detached) or only partially setup. 

Environment

NSX-T 4.1.X
NSX-T 3.x
3rd Party Option for Service Insertion
Edge Cluster

Cause

Service Insertion setup will be unaware of NAT's north bound and traffic for SI dropped. When this occurs it will never create a path for SI traffic and other components will not be accessible to complete SI setup in the NSX-T UI. One example, you can run from the edge to confirm connectivity. We can see its properly configured for N/S policy but, shows "BFD_DOWN" for connectivity. 

Edge_CLI> get service-insertion
Service Insertion Policy:

Policy UUID                                  : e8f84d67-3536-49f8-af5b-example-UUID
Transport type                               : L2_BRIDGE
Is EW policy                                 : 0 <---------------------0 stats this is a North/South policy
Is BFD enabled                               : 1
BFD status                                   : BFD_DOWN <---------No communication.
Ingress lookup count                         : 8427477
Egress lookup count                          : 85322
Service link1 IP                             : 169.254.16.4
Service link2 IP                             : 169.254.17.4
Service link1 nexthop IP                     : 169.254.16.2
Service link2 nexthop IP                     : 169.254.17.2
Failure Policy                               : FAIL_ALLOW

 

It will show "BFD_UP" and "Is EW policy 0"  when properly configured for N/S Service Insertion policy.

Resolution

Apply NAT's at the NSX-T T-0 for proper Service Insertion Integration. 

Additional Information

Powered by Wolken Software