Inter-segment communication failure between VMware NSX overlay networks due to guest OS subnet mask misconfiguration

Products

• VMware NSX

Issue/Introduction

Virtual Machines (VMs) connected to different NSX overlay segments are unable to communicate with each other.

For example:

• VM1 on Segment A cannot ping VM2 on Segment B.
• Ping requests fail with “Request Timed Out (RTO)”.
• Communication between VMs within the same segment may still work correctly.

Cause

The issue occurs because the subnet mask configured inside the Guest OS is incorrect.

Example:

• The NSX segment is configured as a /24 network (255.255.255.0)
• But the VM is configured with a broader subnet mask such as /16 (255.255.0.0)

Because of this mismatch, the VM incorrectly assumes that remote IP addresses belong to the same local network.

Instead of sending traffic to the default gateway for routing, the VM tries to directly find the destination VM using ARP requests.

Since the destination VM is actually on another segment, ARP resolution fails and the communication does not work.

Resolution

To change the VM netmask to match that of the segment's netmask, proceed with steps below :

 

1. Log in to the affected VM.
2. Check the current IP configuration:
   • Windows: ipconfig /all
   • Linux: ip addr
3. Verify the subnet mask configured inside the VM.
4. Compare it with the actual subnet/CIDR configured for the NSX Segment in NSX Manager.
5. Correct the subnet mask if needed (for example, change it to 255.255.255.0).
6. Ensure the IP address and default gateway are correct.
7. Test connectivity again between VMs on different segments.

Once the correct subnet mask is configured, the VM will properly send traffic to the gateway, and inter-segment communication should work successfully.

Additional Information

For further details on NSX segment configuration and routing logic, refer to the VMware NSX Administration Guide.