VLAN tagged packets destined for NSX Bridge being "dropped by VLAN" on ESXi host

Products

• VMware NSX

Issue/Introduction

• Edge L2 bridge VLAN communication between virtual and physical will not work over the overlap VLAN
  
  edge-1> get logical-switch

Logical Switch
UUID                                   VLAN   DEVICE   NAME                                              
####ecef-####-45ae-####-b9d8e58d####   ##     fp-eth0  Edge-uplin-1                                      
####0108-####-995f-####-6e7bab66####   untagged fp-eth1                                                    
####e976-####-d155-####-b13260f####   untagged fp-eth0                                                    
####7a1f-####-1c5d-####-f4d4d9c3####   50-60  fp-eth0     -----> bridge switch profile 1                                                 
####3789-####-545c-####-1bf202ee####   58-62  fp-eth0    -----> bridge switch profile 2 
####4139-####-4b58-####-c8613f41####   7###1        GENEVE   fp-eth0      segment-1 ---> bridge switch profile 1 attached to segment 1                                                       
####e7eb-####-41ec-####-c994b329####   6###6        GENEVE   fp-eth0      segment-2 ---> bridge switch profile 2 attached to segment 1     

edge-1> get logical-switch ####7a1f-####-1c5d-####-f4d4d9c3#### ports

Logical Switch
UUID        : ####7a1f-####-1c5d-####-f4d4d9c3####
VLAN        : 50-60
Device      : fp-eth0
IFUID       : 0
Enable Hub  : False
Ports
    Port        : ####9463-####-4421-####-2dd90b20####
    IFUID       : 349 ---------------------------> If UID between logical bridge switch to segment switch. 
    Peer        : ####0d3a-####-4bc5-####-fd43b4a1####


edge-1> get logical-switch ####3789-####-545c-####-1bf202ee####  ports

Logical Switch
UUID        : ####3789-####-545c-####-1bf202ee####
VLAN        : 58-62
Device      : fp-eth0
IFUID       : 0
Enable Hub  : False
Ports
    Port        : ####c4ad-####-4f33-####-611a678c####
    IFUID       : 351 ---------------------------> If UID between logical bridge switch to segment switch. 
    Peer        : ####8388-####-4422-####-94159986####


  Before configuring the 2nd bridge Profile: 
  
  Port 349 has been assigned to VLAN 58, which is part of bridge profile 1. 
  
  root@edge-1:~# edge-appctl -t /var/run/vmware/edge/dpd.ctl lswitch/show vlan_fdb all-mac | json_pp 
 {
      "egress" : {
         "ifuid" : 349,
         "ifuuid" : "####9463-####-4421-####-2dd90b20####"
      },
      "ingress" : {
         "ifname" : "fp-eth0",
         "ifuid" : 0
      },
      "mac" : "ff:ff:ff:ff:ff:ff",
      "vlan" : 58
   },
{
      "egress" : {
         "ifuid" : 349,
         "ifuuid" : "####9463-####-4421-####-2dd90b20###"
      },
      "ingress" : {
         "ifname" : "fp-eth0",
         "ifuid" : 0
      },
      "mac" : "ff:ff:ff:ff:ff:ff",
      "vlan" : 59
   },
   {

After configuring bridge profile 2. Port 351 has bee assinged to VLAN 58 which is part of bridge profile 2. 

 {
      "egress" : {
         "ifuid" : 351,
         "ifuuid" : "####c4ad-####-4f33-####-611a678c####"
      },
      "ingress" : {
         "ifname" : "fp-eth0",
         "ifuid" : 0
      },
      "mac" : "ff:ff:ff:ff:ff:ff",
      "vlan" : 58
{
      "egress" : {
         "ifuid" : 351,
         "ifuuid" : "####c4ad-####-4f33-####-611a678c####"
      },
      "ingress" : {
         "ifname" : "fp-eth0",
         "ifuid" : 0
      },
      "mac" : "ff:ff:ff:ff:ff:ff",
      "vlan" : 59
   },
  
  

 

Environment

VMware NSX

Cause

• If there is a VLAN bridge in the environment with a VLAN range X-Y (Example 50-60).
• And another bridge profile with VLAN X-Z (Example 58-62)
• Then the overlap VLAN 58-60 will not work in the environment. 

There is an interface configuration between the L2 segment to bridge switch that overwrites the existing configuration. 

Resolution

• Overlap VLAN is not supported.
• If any existing configuration is present, then remove all the bridge configurations and reconfigure it without overlapping configurations.