External DHCP Leases Dropped on NSX Overlay Segments due to DHCP Server Block

Products

• VMware NSX

Issue/Introduction

This article addresses an issue where non-VMware workloads (such as Hyper-V VMs) connected via an L2 Bridge to an NSX overlay segment fail to receive IP addresses from an external DHCP server (e.g., Infoblox).

• Symptoms:
  
  • Physical Hyper-V virtual machines located on a VLAN bridged to an NSX overlay segment are unable to obtain IP leases from an external DHCP server.
  • Virtual machines natively attached to the NSX segment obtain DHCP leases without issue. Packet captures on the NSX Edge node validate that DHCP Discover/Request packets arrive at the physical uplink but fail to traverse the Layer 2 Bridge to the Tier-1 gateway, or returning DHCP Offers are dropped before egressing to the physical network.
  • VMware-native VMs on the overlay segment receive DHCP IP without issue.
  • External/Bridge-connected VMs fail to receive DHCP leases or renew existing ones.
  • Packet captures show DHCP requests reaching the NSX Edge nodes, but DHCP reply packets from the external server are dropped before reaching the client VMs.
    
    Packet capture on the ESXi host where Edge VM is placed.
    
    Switchport where edge uplink (fp-ethx) is connected.
    pktcap-uw --capture VnicTx,VnicRx --switchport "swid of the fp-ethx"--vlan "vlanid" --rfc "port 67" -o - | tcpdump-uw -enr -
    
    Uplink (vmnicx) where edge uplink (fp-ethx) is connected.
    
    pktcap-uw --capture UplinkSndKernel,UplinkRcvKernel --uplink vmnicx --vlan "vlanid" --rfc "port 67" -o - | tcpdump-uw -enr -

• To confirm if the 'DHCP Server Block Drop Count' is incrementing, run the below ESXi command where Edge VM is residing.
  

  1.  SSH to the ESXi host of the Edge VM(s):
  
  2. Confirm the DVS Name and dvPort ID:
  esxcfg-vswitch -l | grep <vm-name>
  
  3. Read the security statistics on this port, noting the "DHCP Block Drop Count":
  nsxdp-cli swsec get stats --dvs <dvs_name> -p <switchport_ID> | grep -i dhcp
  
  DHCPv4 Server Block Drop Count     : 56       <------- Confirm that drop count is incrementing.

Environment

VMware NSX

Cause

The default NSX Segment Security Profile applied to the Edge segments has the DHCP Server Block feature enabled. While this feature allows DHCP requests to reach a relay agent, it identifies legitimate DHCP server responses (DHCPOFFER/DHCPACK) or unicast renewal replies as unauthorized server traffic and drops them at the switch security layer on the Edge.

Resolution

To resolve this issue, create and apply a custom Segment Security Profile with the DHCP Server Block disabled:

1. Log in to the NSX Manager UI.
2. Navigate to Networking > Segments > Segment Profiles.
3. Select the Segment Security tab.
4. Click Add Segment Security Profile.
5. Enter a name for the profile (e.g., Allow-External-DHCP-Profile).
6. Locate the DHCP Server Block toggle and set it to Disabled.
7. Click Save.
8. Navigate to Networking > Segments.
9. Locate and edit the segment where the Edge VMs reside.
10. Under Segment Profiles, locate the Segment Security dropdown and select the newly created profile.
11. Click Save.

Additional Information

Related articles

DHCP IP Lease Renewal Requests are Dropped on DHCP Server VM Connected to NSX Segment.