NAT's for Service Insertion are configured on the 3rd party interface causing BFD_DOWN status in the edge cluster
search cancel

NAT's for Service Insertion are configured on the 3rd party interface causing BFD_DOWN status in the edge cluster

book

Article ID: 374595

calendar_today

Updated On:

Products

VMware vDefend Firewall VMware NSX

Issue/Introduction

When NAT's are configured on the North 3rd party component/interface and not controlled by NSX-T/T-0 you will see various portions of the Service Insertion setup in a down(detached) or only partially setup. 

Environment

  • VMware NSX
  • NSX-T Data Center
  • 3rd Party Option for Service Insertion
  • Edge Cluster

Cause

Service Insertion setup will be unaware of NAT's north bound and traffic for SI dropped. When this occurs it will never create a path for SI traffic and other components will not be accessible to complete SI setup in the NSX-T UI. One example, you can run from the edge to confirm connectivity. We can see its properly configured for N/S policy but, shows "BFD_DOWN" for connectivity. 

Edge_CLI> get service-insertion
Service Insertion Policy:

Policy UUID                                  : e8f84d67-3536-49f8-af5b-example-UUID
Transport type                               : L2_BRIDGE
Is EW policy                                 : 0 <---------------------0 stats this is a North/South policy
Is BFD enabled                               : 1
BFD status                                   : BFD_DOWN <---------No communication.
Ingress lookup count                         : 8427477
Egress lookup count                          : 85322
Service link1 IP                             : 169.###.##.4
Service link2 IP                             : 169.###.##.4
Service link1 nexthop IP                     : 169.###.##.2
Service link2 nexthop IP                     : 169.###.##.2
Failure Policy                               : FAIL_ALLOW

 

It will show "BFD_UP" and "Is EW policy 0"  when properly configured for N/S Service Insertion policy.

Resolution

Apply NAT's at the NSX-T T-0 for proper Service Insertion Integration. 

Additional Information

Powered by Wolken Software