Troubleshooting NSX Edge NAT/ NAT64

Products

• VMware NSX

Issue/Introduction

This article provides guidelines for verifying and troubleshooting Network Address Translation (NAT) configurations on NSX-T Edge nodes, specifically focusing on NAT64. NAT64 allows IPv6 hosts to communicate with IPv4 servers using address translation methods. Proper NAT configuration is crucial to ensure traffic flows seamlessly between different network segments. This document covers verification steps using the NSX-T UI, API, and CLI, along with known issues and recommendations.

Environment

VMware NSX

Cause

Issues related to NSX-T Edge NAT configurations can arise due to various factors, including:

• Misconfigured NAT rules, such as incorrect source or destination addresses
• Improper rule priority or sequence in NAT policies
• Firewall rules blocking necessary traffic for NAT translations
• Asymmetric routing in cases where SNAT is enabled
• Packet drops or traffic misrouting due to incorrect configurations on logical routers

Resolution

1. Verify NAT Rule Order and Configuration in the NSX-T UI

• Navigate to NSX-T Manager UI:
  Networking > NAT > Select the relevant NSX Edge > NAT Policies.
• Select the NAT policy you want to review.
• Check the sequence of the NAT rules:
  • Lower priority values indicate higher precedence (rules with lower numbers are evaluated first).
• If necessary, adjust the order of the rules using the drag-and-drop functionality.
• Save the changes to apply the new order.
• View NAT Statistics:
  • Click on the graph icon next to a NAT rule to view real-time statistics such as packet counts and matches. This helps verify whether the rule is actively processing traffic.

• Validate that the desired traffic matches the intended NAT rule based on the statistics displayed.

2. Retrieve NAT Policies and Rules via API

• Retrieve all NAT policies:
  GET /policy/api/v1/infra/nat/policies
• Identify the NAT policy ID you want to review.
• Retrieve NAT rules for a specific NAT policy using the ID:
   

  GET /policy/api/v1/infra/nat/policies/<NAT_POLICY_ID>/nat-rules
• Verify the source/destination addresses, translation method (SNAT/DNAT), and priority.

3. Check Firewall Rules and NAT Configuration Using CLI

• List Firewall Interfaces:

  • First, review the available firewall interfaces on the NSX-T Edge to identify where NAT rules are applied:
    Edge > get firewall interfaces
  • This command lists all interfaces on the NSX-T Edge with their corresponding UUIDs. Identify the interface UUID where your NAT rules are expected to be applied.

• Retrieve and Review NAT Rules Applied to the Interface:

  • Use the following command to get a detailed list of NAT rules applied to the selected interface:
    Edge > get firewall <UUID> ruleset rules
  • This command provides:
    • Rule Count: The total number of rules applied on this interface.
    • Rule ID: A unique identifier for each NAT rule.
    • Rule Details: Information about each rule, including source/destination addresses, translation method (SNAT/DNAT), and action (allow/deny).
  • Important: Ensure that the configured NAT rules match your intended setup and that there are no errors or unexpected configurations.

• Check Rule-Based Statistics:

  • To gather statistics for each rule and determine if they are being hit by traffic, use:
    Edge > get firewall <UUID> ruleset stats
  • This command shows real-time data on the number of packets and bytes processed by each rule, helping you verify if the NAT rules are actively processing traffic.

• Verify Current Connection States:

  • To monitor live connections and verify if the traffic is being translated correctly by the NAT rules, use:
    Edge > get firewall <UUID> connection state
  • This provides information about current flows, including source/destination IPs, translated IPs, and connection status.

• Ensure No Blockages in Traffic Flow:

  • Review the output of these commands to ensure there are no conflicting firewall rules, ACLs, or other network devices blocking the required traffic for NAT. If necessary, adjust the firewall rules to allow the traffic intended for NAT processing.

4. Use Packet Capture Tools for Detailed Analysis

• Capture and analyze traffic between source and destination to identify any connectivity issues or NAT translation errors.
• Inspect the packet headers for correct address translation and response.

Additional Information

Troubleshoot packet drops on edge when NAT is enabled

SNAT Not supported asymmetric forwarding/reverse path 345865