NSX Transport Node Degraded due to TEP IP Conflict with PfSense Gateway

Products

• VMware NSX

Issue/Introduction

An NSX Transport Node may report a DEGRADED or DOWN status when its Tunnel Endpoint (TEP) IP address conflicts with the network gateway IP. This conflict prevents the establishment of BFD tunnels between the ESXi host and the NSX Edges, subsequently blocking SDDC Manager upgrade workflows.

• NSX Manager shows Transport Node status as "Degraded."
• Tunnel status from a specific host (e.g., Host 4) to Edges is "Down."
• Connectivity tests (ping) from the problematic host's TEP to the Edge TEPs fail, while other hosts in the same cluster can reach the Edges.
• SDDC Manager upgrade pre-checks fail due to cluster health being "DOWN."

Environment

VMware NSX 9.x

Cause

This issue is caused by an IP address overlap. If the PfSense gateway is configured with an IP that is also available within the DHCP scope assigned to the NSX TEPs, a host may be assigned the gateway's IP. This creates a routing loop or IP conflict, causing all encapsulated Geneve traffic (TEP-to-TEP) to fail for that specific host.

Resolution

Resolution

1. Identify the Conflict:
   • Log into the PfSense web interface and check the Gateway IP for the TEP VLAN.
   • Compare this IP against the TEP IP assigned to the degraded host in NSX Manager (System > Fabric > Nodes > Host Transport Nodes).
2. Modify DHCP Scope:
   • In PfSense, navigate to Services > DHCP Server > [TEP VLAN Interface].
   • Update the Range to ensure it does not include the Gateway IP. (Example: Change scope to a range like 192.168.x.162 to 192.168.x.171).
3. Refresh Host TEP:
   • Restart the affected ESXi host or perform a "Reboot" of the Transport Node to force it to release the conflicting IP and request a new one from the updated DHCP pool.
4. Verify Connectivity:
   • Once the host is back online, verify the TEP has received an IP from the new range.
   • Confirm the Transport Node and Tunnel status in NSX Manager now show as UP.