"Local Endpoint IP not bound to interface" error resulting in down VPN session on Tier1 SR
search cancel

"Local Endpoint IP not bound to interface" error resulting in down VPN session on Tier1 SR

book

Article ID: 410106

calendar_today

Updated On:

Products

VMware NSX

Issue/Introduction

  • VPN session on Tier1 is down.
  • You see messages similar to the following on the edge node in /var/log/syslog:

    2025-07-25T09:30:09.849Z ######## NSX 18875 VPN [nsx@6876 comp="nsx-edge" subcomp="iked" s2comp="nestdb-iked" level="INFO"] Session status change for 80373ace-####-####-####-5ac0bfa9f646 to status: IKE_STATUS_DELETE, reason: IPSec service not active, current status: IKE_STATUS_DOWN, reason: Local Endpoint IP not bound to interface, refcount: 0

  • In NSX versions prior to 9.0, you might also see messages on the edge node in /var/log/syslog that mention "Peer not reachable".
  • In NSX 9.0 and above, you might also see messages on the edge node in /var/log/syslog that mention "Peer not responding".
  • You see that datapath traffic over the VPN session on the Tier1 SR is impacted.

Environment

  • VMware NSX 4.x/9.x
  • VMware NSX-T Data Center 3.x
  • On the T1, Auto Allocate Edges is set to "No" and there are two or more edges configured.
  • Edge failover/failback has recently occurred.

Cause

Linux netlink notification of loopback interface add is not received by the VPN.

Resolution

This issue is resolved in VMware NSX 4.2.4, VCF 9.0.2 and 9.1, available at Broadcom downloads.

If you are having difficulty finding and downloading software, review the Download Broadcom products and software KB.

 

Workaround:

  1. Identify Active and Standby Edges:
    1. In NSX Manager, go to Networking > Gateways > Tier-1 Gateways.
    2. Expand the Tier-1 Gateway and check the Edge Cluster settings to identify which Edge node is currently Active (for example, Edge-1) and which is Standby (for example, Edge-2).
  2. Force Failover to Edge-2:
    1. Edit the Tier-1 Gateway configuration. Under Edge Cluster settings.
    2. Remove Edge-1 from the Preferred Edge Members list.
    3. Save the changes. This forces the active Tier-1 SR to fail over to Edge-2, making Edge-1 the Standby node.
  3. Re-add Edge-1 to the Preferred Edge List:
    1. Edit the Tier-1 Gateway configuration again.
    2. Add Edge-1 back to the Preferred Edge Members list.
    3. Save the changes.
  4. Verify VPN Status:
    1. Check the IPSec VPN status under Networking > VPN > IPSec Sessions to ensure the tunnel establishes and shows as Up.
Powered by Wolken Software