Unable to send traffic via IPSec VPN that is setup in NSX

Products

• VMware NSX

Issue/Introduction

• IPSec VPN is configured in the NSX environment towards FortiGate Firewall.
• Phase1 is established.
• Phase2 is also established correctly.
• But traffic between both networks (network behind NSX and network behind FortiGate) fails to communicate.
• Packet statistics show outbound (Tx) packets incrementing, but no inbound (Rx) packets are received as shown below:

get ipsecvpn tunnel stats

 

Environment

VMware NSX

Cause

Packets were dropped at the physical environment causing the endpoint communication issue on IPSec as there is no return traffic seen at the uplinks of the ESXi host where Edge VM is present.

Resolution

Analyze the packet captures for the IPSec traffic:

1. Packet captures will need to be performed to verify if the traffic is leaving the Edge and Host when trying to ping from source VM in NSX towards destination IP which is in physical environment.

ESXi uplinks capture:

pktcap-uw --uplink vmnicX --capture UplinkSndKernel,UplinkRcvKernel --ip <source-vm-ip> -o - | tcpdump-uw -enr

Edge IPSec packet capture: 

edge01> start capture interface <ipsec-uuid>

2. Verify from the packet captures on the ESXi host uplinks if the return traffic is also seen.

3. If the return traffic is not seen, then it is dropped in the physical environment.

4. If return traffic is seen at ESXi uplinks, then please open a support request with Broadcom to investigate further and refer this KB article (Refer to Creating and Managing Broadcom Support Cases for instructions on how to open a support request).