Connectivity Failures When Multiple Network Adapters Are Connected to the Same Overlay Segment/Subnet in NSX-T

Products

• VMware NSX

Issue/Introduction

• A virtual machine (VM) is configured with two or more virtual network adapters (vNICs) that are connected to the same NSX-T overlay segment and assigned IP addresses from the same subnet. This may specifically apply wherein one vNIC is intended for management traffic and the other for production traffic.
• This configuration can lead to unexpected and intermittent communication failures, where inbound traffic arrives on one vNIC but response traffic egresses a different vNIC. TCP sessions may fail to establish, management connectivity may be lost, and troubleshooting may become significantly more complex.

Environment

VMware NSX

Cause

Having multiple vNICs in the same subnet on the same Layer-2 overlay domain is not a recommended or supported design for guest operating systems or for NSX-T networking environments.

The root technical issues include:

• Asymmetric routing: The operating system sees both adapters as valid paths for the same subnet and may choose a different interface for the response path than the one that received the request.

• Incorrect source IP selection: Replies may be sourced from the management IP instead of the production IP, causing session resets, packet drops, and policy failures.

• ARP conflict and MAC learning issues: Two MAC/IP relationships originating from the same VM but different vNICs on the same subnet can confuse the overlay’s forwarding tables.

• Unpredictable OS routing behavior: Without explicit policy-based routing, the route table will not guarantee traffic separation.

• Difficult supportability: VMware and most OS vendors do not support multiple interfaces in the same broadcast domain for separation of traffic planes.

As a result, management services may intermittently break, production connectivity may drop, and applications may experience inconsistent network behavior.

Resolution

Resolution
Implement one of the following supported configurations:

• Best Practice (Recommended)
  Separate the traffic logically at Layer-3 by placing management and production network interfaces on different subnets and different overlay segments.
  This ensures deterministic routing behavior and prevents MAC/ARP collisions.
• Alternate (Advanced and Not Preferred)
  If the design absolutely requires two interfaces in the same subnet, configure guest OS policy-based routing or source routing that forces each IP address to use its associated vNIC for egress.

Note: This remains non-ideal and may not be fully supported in NSX-T reference design guidance.

• Simplification Option
  Assign multiple IP addresses to a single vNIC instead of using multiple vNICs for the same L2 domain.

After implementing a supported configuration, verify correct routing behavior and ensure applications successfully complete TCP handshakes.

Additional Information

 

• This behavior can affect any guest OS, including Windows and Linux, as this is a Layer-3 routing limitation, not a VMware-specific bug.

• Issues are commonly seen during:

  • Troubleshooting network connectivity

  • Backup and agent communication

  • Management plane access interruptions

  • Application session failures (SYN received, SYN-ACK sent on wrong NIC)

• VMware and other vendor documentation warns against multiple network interfaces within the same subnet due to routing unpredictability and unsupported outcomes.