VLAN tagged packet drops on ESXi enabled with EDP Standard in ENSInput function

Products

• VMware NSX

Issue/Introduction

• The VLAN tagged packets get dropped on ESXi host with EDP enabled.
• These packets are guest tagged, like Edge uplinks sending packets to TOR.
• On the ESXi host, the packets are observed until the ENSInput-MbufFree function and there is no further trace for the packet:
  
  
• If EDP is disabled, the same packet is observed getting dropped at VLAN_InputProcessor function.

Environment

VMware NSX 9.x

VMware vSphere ESXi 9.x

Cause

When a VM is attached to a DvPG or an NSX VLAN-backed segment that is non-trunking (access) and guest/nested tagging is disabled, a tagged packet is expected to be dropped. 

Resolution

• Attach the VM Network adapter to a trunk portgroup/segment, while the internal Guest tagging can work as configured for a VLAN tag.
• Follow the workaround in the KB https://knowledge.broadcom.com/external/article/408403/packet-drops-on-esxi-when-a-vm-is-inject.html