Virtual machines connected to an NSX VLAN-backed segment cannot ping their default gateway

Products

• VMware NSX

Issue/Introduction

• Virtual machines (VMs) are connected to an NSX VLAN-backed segment with a default gateway residing on a physical switch.
• VMs on a specific VLAN (e.g., DMZ-37) are completely inaccessible to external users.
• VMs can communicate with other VMs on the same subnet, however cannot ping their own default gateway.
• Packet captures performed on the client VM switch port and the ESXi host uplink will show traffic leaving the ESXi host, but no return traffic (or ARP response) is received from the physical network.

Environment

• VMware NSX 4.x
• VMware vSphere ESXi 8.0 
• VMware vSphere ESXi 7.0
• Physical Switch (Underlay)

Cause

This issue occurs when virtual machine traffic successfully traverses the VMware network stack and exits the physical uplinks, but the upstream physical network drops the packets or fails to route return traffic back to the host.

This is usually caused by one of two physical network misconfigurations:

1. The required VLAN is not explicitly allowed on the physical switch trunk ports connected to the ESXi hosts.

2. There are MAC learning issues on the physical switch preventing the return of ARP responses.

Resolution

1. Run a ping from the client VM towards the default gateway.
   
   
2. Capture packets on the client VM switch port and ESXi host uplinks following Troubleshooting Packet Captures for VMware NSX.
   
   
3. Verify if packets are leaving the host uplink but not receiving an ARP response.
   
   
4. If the traffic is exiting the ESXi host, engage your network team to perform the following:

• Verify that the specific VLAN is explicitly allowed on the physical switch trunk ports connected to the ESXi hosts.
• Check the physical switch MAC address table to ensure the virtual MACs of the affected VMs are being learned correctly.
• Trace the ARP requests from the host to the gateway to identify the drop point.

For further assistance, see Contact Broadcom support.