IPv6 traffic drop due to RPF lookup failure with IPv6 static route with NULL next-hop setting

Products

• VMware NSX

Issue/Introduction

• IPv4 traffic functions normally, but IPv6 sessions fail to maintain connectivity. Inbound traffic reaches the Virtual Machine (VM), but egress reply packets are dropped on the ESXi host.
• The issue is observed in Tanzu Kubernetes Grid (TKG) environments where a /128 IPv6 VIP (Virtual IP) is assigned to control plane nodes. An IPv6 static route for the VIP is configured with a Null next-hop on the Tier-1 gateway to forward packets to the interface connected to the segment.
• NSXCLI: get logical-router <Router-ID> interface <Interface-ID> stats shows a high count for IPv6 RPF Failure Drops.

Environment

• NSX 4.2.3.3

Cause

• The drop occurs when a Tier-1 Gateway uses an IPv6 static route configured with a NULL next-hop. The NSX cfgAgent fails to correctly process host routes (/128) using this configuration. Consequently, the DR does not identify the correct return path for RPF validation and incorrectly drops the traffic as an RPF failure.

Resolution

This is a known issue. 

Workaround

Verify that IPv6 RPF Failure Drops counter is increasing on ESXi host.

1. SSH to the ESXi host
2. Run nsxcli
3. Run get logical-routers
4. Run get logical-router <Router-ID> interfaces for each logical-routers ID (VDR UUID) and find the interface ID (LIF UUID) that the segment is connected.
5. Run get logical-router <Router-ID> interface <Interface-ID> stats and make sure IPv6 RPF Failure Drops counter is increasing.

Change the uRPF mode on the affected segment from STRICT to NONE to bypass the RPF check for return traffic.

1. Log in to NSX Manager.
2. Navigate to Networking > Segments.
3. Edit the segment connected to the impacted VMs.
4. Expand Additional Settings.
5. Change uRPF mode from STRICT to NONE.
6. Click Save.