VM connectivity issues on HCX extended networks due to NSX Global SpoofGuard profile

Products

• VMware HCX

Issue/Introduction

In a VCF 9.1 environment using HCX Network Extension (NE), you may observe the following:

• VMs migrated to VCF 9.1 cannot communicate with non-migrated VMs residing on the same subnet/extended network.
• Packet captures show ARP requests successfully leaving the source VM.
• Packet captures at the Initiator Network Extension (NEE-I) appliance (at the source site) show the ARP reply is being received and forwarded to source VM.
• Despite the NEE-I appliance and the source VM residing on the same ESXi host, the ARP reply is blocked and never reaches the VM.
• The impacted NSX segment is associated with a non-default SpoofGuard profile (e.g., a "global-spoof-guard" profile).

Environment

VCF Operations HCX 9.1

Cause

Non-default or Global SpoofGuard profiles enforce strict address bindings to prevent spoofing. When a VM is migrated via HCX 9.1, its traffic is proxied through the HCX appliance. If a strict Global SpoofGuard policy is in place, the NSX datapath on the host does not recognize the returning traffic (such as the ARP reply from a non-migrated VM) as being authorized for that specific logical port. Consequently, the NSX SpoofGuard filter drops the packet at the host level before it can be delivered to the VM.

Resolution

Workaround:

If this is a test segment and not currently in production, you can try the following workaround to verify and restore connectivity:

1. Navigate to Networking > Segments in the NSX Manager.
2. Update the impacted segment and change the SpoofGuard Profile to the system-defined "default" profile.
3. Connectivity between migrated and non-migrated VMs should be restored immediately as the default profile allows for dynamic address learning.

If your environment requires a specific Global SpoofGuard policy or if you are unable to change the profile due to organizational security constraints:

• Do not change the SpoofGuard.
• Please open a support case with Broadcom Support and refer to this KB article. For more information, see Creating and managing Broadcom support cases.

Additional Information

A similar connectivity issue can occur if MAC Learning is incorrectly configured or disabled on the NSX segment.
For issues where VMs are unable to communicate over newly created HCX Layer 2 extended networks specifically due to MAC Discovery profile settings, please refer to:

VM connectivity issues observed over a newly created HCX Layer 2 extended network