NSX Edge-Host Tunnels Down; TEP Interface in Fallback State

Products

• VMware NSX

Issue/Introduction

Users may experience a total disruption of overlay network traffic across one or multiple clusters. When investigating the hosts and edges, the following behaviors are observed:

• All Edge-Host tunnels report a "Down" state across the affected clusters.
• Host-to-Host Tunnel Endpoint (TEP) pings are unsuccessful.

• Running tunnel diagnostics via the ESXi CLI using the command nsxdp-cli bfd sessions list shows that TX (sent) and RX (received) counters are not actively increasing. The local_state of all the tunnels are also reported as down.

• The uplink backing the TEP interface (typically vmk10) shows the interface operating in a fallback state rather than utilizing an active physical uplink.

Environment

VMware NSX

Cause

• This issue occurs due to an incomplete uplink mapping within the Transport Node Profile (TNP) applied to the hosts.
• In a standard redundant setup, traffic may normally rely on a primary physical NIC and uplink (e.g., vmnic1 mapped to uplink-1). However, if the physical switch connected to this primary link goes down, such as during scheduled maintenance, traffic must failover to the secondary link (e.g., vmnic2 relying on uplink-2).
• If the secondary uplink (uplink-2) is marked as "not set" and is not mapped to the corresponding vSphere Distributed Switch (VDS) uplink in the Host Switch Profile, the failover fails. Because the active path is down and the secondary path is unmapped, the vmk10 interface cannot establish a valid physical path. Consequently, it enters a "fallback" state, causing all encapsulation tunnels to drop.

Resolution

To resolve this issue and restore redundancy, you must update the Host Switch Profile to correctly map the missing uplink to the VDS.

• Log in to the NSX Manager UI.
• Navigate to System > Fabric > Profiles > Transport Node Profiles.
• Select the Transport Node Profile that is applied to the affected clusters and click Edit.
• Navigate to the Host Switch configuration section.

• Locate the active Host Switch Profile and expand it.
• Identify the unmapped secondary uplink under the Teaming Policy Uplink Maping (e.g., uplink-2 showing as "not set").

• Map the unmapped host switch uplink directly to the corresponding VDS uplink (e.g., map uplink-2 to VDS uplink 2).
• Save the changes. The Transport Node Profile will automatically push the updated configuration to all hosts in the cluster.