VPN session on Tier1 SR is down due to "Local Endpoint not bound to interface” issue

Products

• VMware NSX

Issue/Introduction

• VPN session on Tier1 is down
• You see messages similar to the following on the edge node in /var/log/syslog:
  
  2025-07-25T09:30:09.849Z ######## NSX 18875 VPN [nsx@6876 comp="nsx-edge" subcomp="iked" s2comp="nestdb-iked" level="INFO"] Session status change for 80373ace-####-####-####-5ac0bfa9f646 to status: IKE_STATUS_DELETE, reason: IPSec service not active, current status: IKE_STATUS_DOWN, reason: Local Endpoint IP not bound to interface, refcount: 0
  
  
• In NSX versions prior to 9.0, you might also see messages on the edge node in /var/log/syslog that mention "Peer not reachable"
• In NSX 9.0 and above, you might also see messages on the edge node in /var/log/syslog that mention "Peer not responding"
• You see that datapath traffic over the VPN session on the Tier1 SR is impacted

Environment

• VMware NSX 4.x/9.x
• VMware NSX-T Data Center 3.x
• On the T1, Auto Allocate Edges is set to "No" and there are two or more edges configured
• Edge failover/failback has recently occurred

Cause

Linux netlink notification of loopback interface add is not received by the VPN

Resolution

This is a known issue affecting VMware NSX. There is currently no resolution.

To workaround this issue, remove and add back the Edge in the preferred edge list of the Tier1 by making sure that Tier1 is standby on the Edge.