NSX-T IP Pool Error: Pool update/delete failed as range [{#.#.#.#}-{#.#.#.#}] has allocated ids.

Products

VMware NSX

Issue/Introduction

IP Address Pools created for Host or Edge Transport Node Endpoints (TEP) report a realization state of FAILED within the NSX Manager interface. Attempts to update or modify the subnet allocation range within an active IP Pool trigger an explicit validation block.

Range [{#.#.#.#}-{#.#.#.#}]  cannot be updated because it has allocated IDs.

Environment

VMware NSX 9.x
VMware NSX 4.x

Cause

The NSX IP Address Management (IPAM) engine blocks structural modifications to active allocation ranges that contain currently assigned IP addresses.

Modifying a range in the Policy Manager updates the desired intent state, but realization fails at the Management Plane (MP) layer, resulting in an object state desynchronization between Policy and MP.

IP pool in the NSX-T Policy GUI:

Pool details using MP API from the NSX-T Manager :

{
"pool_usage" : {
"total_ids" : #,
"allocated_ids" : #,
"free_ids" : #
},
"subnets" : [ {
"cidr" : "#.#.#.#",
"gateway_ip" : "#.#.#.#",
"dns_nameservers" : [ ],
"allocation_ranges" : [ {
"start" : "#.#.#.#",
"end" : "#.#.#.#"
}, {
"start" : "#.#.#.#",
"end" : "#.#.#.#"
}, {
"start" : "#.#.#.#",
"end" : "#.#.#.#"
} ]
} ],
"check_overlap_with_existing_pools" : false,
"resource_type" : "IpPool",
"id" : "<UUID>",
"display_name" : "##-##-pool",
"tags" : [ {
"scope" : "policyPath",
"tag" : "/infra/ip-pools/<IP POOL NAME>"
} ],
"_create_time" : #######,
"_create_user" : "nsx_policy",
"_last_modified_time" : #######,
"_last_modified_user" : "nsx_policy",
"_system_owned" : false,
"_protection" : "REQUIRE_OVERRIDE",
"_revision" : #
}

Editing an in use IP range is not supported from the IPAM side. So when attempting to update the range, it fails at the time of realisation and MP subnet allocation ranges don’t get updated. Hence even though the policy intent gets updated, pool remains in FAILED state because realisation has failed.

This also leads to discrepancy on MP and policy side ranges of that same IpPool. This discrepancy can be seen in ranges shown in Policy GUI and MP API response.

Resolution

Revert the Policy object allocation range back to match the active Management Plane (MP) state to resolve the realization failure.

Option 1: Resolution via NSX Manager UI

Navigate to Manager UI > IP Address Pools.
Click the Subnet Count link for the impacted IP Pool.
Record the exact IP Ranges and CIDR details for all subnets belonging to the pool.
Navigate to Policy UI > IP Address Pools.
Edit the affected pool subnet and restore the Allocation Ranges to match the values recorded in Step 3.
Click Save.

Option 2: Resolution via NSX REST API

Retrieve the current MP state to obtain the active allocation ranges:

GET https://<manager-IP>/api/v1/pools/ip-pools/<mp-pool-id>

Response Body:

{
  "pool_usage": {
    "total_ids": 100,
    "allocated_ids": 10,
    "free_ids": 90
  },
  "subnets": [
    {
      "cidr": "<REDACTED_IP>/24",
      "dns_nameservers": [],
      "allocation_ranges": [
        {
          "start": "<REDACTED_IP>",
          "end": "<REDACTED_IP>"
        }
      ]
    }
  ],
  "check_overlap_with_existing_pools": false,
  "ip_address_type": "IPV4",
  "resource_type": "IpPool",
  "id": "<REDACTED_UUID>",
  "display_name": "<REDACTED_NAME>"
}

Retrieve the <policy-pool-id> by sending a GET request to:
```
GET https://<manager-IP>/policy/api/v1/infra/ip-pools
```
Extract the unique_id field from the corresponding pool entry to obtain the <policy-pool-id>.
Retrieve the <policy-subnet-id> from the Policy UI by clicking the three dots next to the IP Pool and copying the numerical identifier string from the object path.

Revert the Policy subnet object back to the active MP values:

PATCH https://<manager-IP>/policy/api/v1/infra/ip-pools/<policy-pool-id>/ip-subnets/<policy-subnet-id>

Request Body:

{
  "cidr": "<REDACTED_IP>/24",
  "allocation_ranges": [
    {
      "start": "<REDACTED_IP>",
      "end": "<REDACTED_IP>"
    }
  ],
  "resource_type": "IpAddressPoolStaticSubnet",
  "display_name": "<REDACTED_NAME>"
}

Additional Information

To change pool boundaries with active TEPs, add an additional non-overlapping IP range to the existing pool rather than modifying the bounds of an in-use range.
Range bounds modification requires migrating or unbinding all allocated endpoints to reduce allocated_ids to zero before execution.