Traffic disruption observed in an L2VPN environment

Products

• VMware NSX

Issue/Introduction

• An Autonomous Edge is connected to a Standard switch configured for L2VPN
• Promiscuous mode and forged transmits are set to accept
• Intermittent packet drops are observed between VMs in the environment

Environment

VMware NSX

Cause

• Routing loop may occur in L2VPN.
• The same can be verified by running traceflow on NSX UI between the VMs connected to same segment during the time of the issue, the traffic will be observed getting forwarded to Edge tunnel which is not expected:

Resolution

• Enable reverse filter on ESXi host where autonomous edge is running when promiscuous mode is set to accept:
  esxcli system settings advanced set -o /Net/ReversePathFwdCheckPromisc -i 1

OR


• Connect autonomous edge to a VDS portgroup and enable Mac learning on the portgroup.
  Starting with vSphere 8.0, you can enable the Mac Learning option from UI in the distributed portgroup configuration

Note: If the MAC learning feature is available for your release and VDS version, it is highly recommended over setting forged transmit and promiscuous mode. The only exception is that if you bridge a segment to VLAN 0 and you use a distributed router on this segment, do not use the MAC learning option if the edge VM is on the same VDS prepared for NSX-T Data Center.