The first vNIC connected to NSX segment loses network connectivity after a VM migrated to another host while NSX Manager was temporarily down

Products

• VMware NSX

Issue/Introduction

• NSX Manager was temporarily down and recovered.
• The VM migrated to another host while NSX Manager was down.
• Even after NSX Manager recovers, the first vNIC connected to a NSX segment can not communicate.
• The second and later vNICs connected to NSX segments, if any, work fine after NSX Manager recovers.
• The port of the first vNIC in blocked state.
  • To check blocked ports, see KB 405110.
• The first vNIC might recover by another migration after NSX Manager recovers.
  • It might create a new port for the first vNIC. In such cases, port specific settings of the original port, for example, address binding and segment profile override, are reset to default and it might block communication.

Environment

VMware NSX

Cause

When a VM migrates to another host, the NSX ports are detached on the source host and attached on the destination host.
If NSX Manager is down, detach and attach requests are pending and sent again after NSX Manager recovers.

When a VM migrates to another host while NSX Manager is down, on the source host, detach is tried for the first vNIC and it fails. The failed operation is stored in the port as a pending operation.
After the first vNIC failed to be detached, the second and the later vNICs are not detached.
Thus the VM migrates with ports and the pending detach operation.

On the destination host, attach fails for all the vNICs, and it is stored in the ports as a pending operation.
However, the port of the first vNIC already has a pending operation. In such a case, the new pending operation is not stored.

Thus, attach request for the first vNIC is not sent to NSX Manager even after NSX Manager recovers.

Resolution

Currently there is no resolution.

To recover such a vNIC, migrate the VM again or connect the vNIC to another portgroup and then connect it back to the original NSX segment after NSX Manager recovers.
The vNIC then gets connected to a new port.
Configure again port specific settings, for example, address binding and segment profile override, as needed.

Mitigation has been added in NSX 9.0.1 so that attach request for the first vNIC is sent after NSX Manager recovers.
However it is not guaranteed the original port is retained.
If a new port is created, port specific settings still need to be configured again.