Default gateway unreachable for VMs using L2 Bridge between NSX data centers

Products

• VMware NSX

Issue/Introduction

• L2 Bridge has been created between two NSX environments.
• DR downlink on either server or client side is configured as default gateway.
• While the VM's on the Client side of the tunnel will likely be able to communicate with VM's on the Server side and vice versa.
• VMs on one site can't ping the default gateway on the other site.

Environment

VMware NSX-T Datacenter

VMware NSX

Cause

• This issue occurs only when both the server and client are managed by NSX.
• VMs on one site cannot ping the default gateway on the other site. This is expected behavior of the ESXi host, because the destination mac-address of ICMP request packet is the mac-address of the VDR port, which is also locally present on the ESXI host as T1-DR instance, so traffic never leaves the ESXI host. This happens because the MAC addresses for NSX virtual distributed router are the same across all installations.

Resolution

This is a condition that may occur in a VMware NSX environment.

To workaround the issue, change the VDR MAC on either site so that both sites don't use the same VDR MAC. 

Follow documentation to set the VDR MAC address correctly for both deployments.

NSX 3.1 - Change the MAC Address of NSX-T Virtual Distributed Router

NSX 4.1 - Change the MAC Address of NSX Virtual Distributed Router

NSX 4.2  - Change the MAC Address of NSX Virtual Distributed Router

VCF 9.0 -  Changing the Distributed Router Interfaces' MAC Address

 

Note: As per KB #385241, avoid using upper case characters while setting the VDR MAC address. 

 

Additional Information

While changing the MAC address of NSX Virtual Distributed Router, if a VM is attached to an NSX overlay segment, you might observe a short disruption in the data plane. Kindly plan the change accordingly.

Also check Default gateway unreachable for VMs using L2VPN tunnels between NSX data centers