Network connectivity issues seen with virtual machines using an L2VPN while using an Autonomous Edge
search cancel

Network connectivity issues seen with virtual machines using an L2VPN while using an Autonomous Edge

book

Article ID: 414861

calendar_today

Updated On:

Products

VMware NSX

Issue/Introduction

Virtual machines experience network connectivity loss while using an L2VPN over an autonomous edge.

From CLI of the Autonomous edge, check for fragmented packets and MTU:

  1. nsx_autonomous_edge_cli> get logical-routers
  2. nsx_autonomous_edge_cli> vrf # 
  3. nsx_autonomous_edge_cli> get interfaces <interface-uuid>
        Interface     : b6fe1a27-####-####-####-5be228854eb4
        Ifuid         : 266
        Name          : lrport_0
        Fwd-mode      : IPV4_ONLY
        Internal name : uplink-266
        Mode          : lif
        Port-type     : uplink
        IP/Mask       : 192.168.###.###/24
        MAC           : 00:50:56:##:##:##
        VLAN          : 20
        Access-VLAN   : untagged
        LS port       : 057131be-####-####-####-84875802aab0
        Urpf-mode     : STRICT_MODE
        DAD-mode      : LOOSE
        RA-mode       : RA_INVALID
        Admin         : up
        Op_state      : up
        Enable-mcast  : False
        MTU           : 1500
        arp_proxy     :

 

On the other end of the VPN tunnel, the NSX Edge managed by an NSX Manager cluster, 

nsx_edge_cli> get logical-router interface stats | more

interface   : 40892b08-####-####-####-91f36adc6094
ifuid       : 273
VRF         : 1b65cc35-####-####-####-d9cbe333509c
name        : test
IP/Mask     : 192.168.###.###/24
MAC         : 00:50:56:##:##:##
VLAN        : 100
LS port     : dda5a069-####-####-####-06eb000c54d8
urpf-mode   : STRICT_MODE
admin       : up
op_state    : up
MTU         : 9000
statistics
    RX-Packets  : 0
    RX-Bytes    : 0
    RX-Drops    : 0
        Blocked     : 0
        DST-Unsupported: 0
        Firewall    : 0
        Malformed   : 0
        No-Receiver : 0
        No-Route    : 0
        RPF-Check   : 0
        Protocol-Unsupported: 0
        IPv6        : 0
        Port-Unsupported: 0
        TTL-Exceeded: 0
        Kni         : 0
        Rate-Limit  : 0
        IPsec       : 0
        IPsec-NoSA  : 0
        IPsec-NoVTI : 0
    TX-Packets  : 58
    TX-Bytes    : 2590
    TX-Drops    : 0
        Blocked     : 0
        Firewall    : 0
        Frag-Needed : 0
        No-neighbor : 0
        No-Memory   : 0
        No-Linked-Port: 0
        Rate-Limit  : 0
        IPsec       : 0
        IPsec-NoSA  : 0
        IPsec-NoVTI : 0
        IPsec-Policy-Error: 0
        IPsec-Policy-Block: 0
    IP Ressemble
        Fragments-OK: #####
        Fragemnts-Error: #####
        Fragments-Timeout: 0
    IP Fragment
        Fragments-OK: #####
        Fragments-Error: #####

 

Environment

  • VMware NSX
  • L2VPN is configured
  • NSX Autonomous Edge

Cause

MTU difference between endpoints can cause fragmentation.  If large packets are sent through the L2VPN tunnel and fragmented at the receiving side, the communication can experience performance issues, longer transfer times, or fail entirely.

To enable large MTU sizes, it is best practices to ensure all networking components are using the same MTU setting.

Resolution

To change MTU of an lrport it can be done at time of install(Select the correct MTU on the port group) or with the below API 

  1. Run a GET request to /api/v1/ports to list all logical ports. Identify the port you want to modify and copy the UUID. From the output, identify the ID of the port to edit (i.e. lrport_0)
    1. Run a GET request to /api/v1/ports/<UUID from Step 1> using the port’s ID to retrieve its full configuration. You should see the incorrect MTU (1500 in this example) in the body of the response.
      GET https://<IP or FQDN of Autonomous Edge>/api/v1/ports/<lrport_0 ID> 
      {
          "display_name": "lrport_0",
          "exit_interface": "eth2",
          "id": "<lrport_0 ID>",
          "mac_address": "##:##:##:##:##:##",
          "mtu": 1500, <-- Default MTU
          "resource_type": "LogicalRouterPort",
          "subnets": [
              {
                  "ip_addresses": [
                      "<Logical Port IP address>"
                  ],
                  "prefix_length": 24
              }
          ],
          "urpf_mode": "STRICT",
          "vlan_id": <VLAN>
      }
  2. Copy the full JSON response (as shown above) and change the "mtu" value from 1500 to 9000. Make sure to preserve all other required fields in the body.
  3. Send a PUT request to /api/v1/ports/<UUID> with the modified JSON body to update the port.
    1. Confirm the change by running another GET request to /api/v1/ports/<UUID> and verify that MTU value now shows 9000.
      {
          "display_name": "lrport_0",
          "exit_interface": "eth2",
          "id": "<lrport_0 ID>",
          "mac_address": "##:##:##:##:##:##",
          "mtu": 9000,
          "resource_type": "LogicalRouterPort",
          "subnets": [
              {
                  "ip_addresses": [
                      "<Logical Port IP address>"
                  ],
                  "prefix_length": 24
              }
          ],
          "urpf_mode": "STRICT",
          "vlan_id": <VLAN>
      }

Additional Information

Verify configuration of the L2VPN tunnel between sites 

Troubleshooting NSX L2 VPN

Troubleshooting MTU issues and fragmentation in NSX fabric

Powered by Wolken Software