Traceflow Drop Reason KB: IP_OUT_OF_SCOPE

Products

• VMware NSX
• VMware Cloud Foundation

Issue/Introduction

A VM in the private VPC subnet ('Private' access mode) is experiencing connectivity issues. When using traceflow to inject a packet from the VM's vNIC, the result shows a drop observation with the reason IP_OUT_OF_SCOPE.

The possible traceflow UI output:
The source IP is in the 'Private' access mode, the destination IP is a IP from 'Public' access mode pool.

Environment

VCF 9.1 or above

Cause

IPs owned by a subnet in 'Private' access mode should be SNATed to IPs in the 'Private - Transit Gateway' or 'Public' pool to communicate with endpoints in another VPC or external network. Otherwise, the packet will be dropped due to IP_OUT_OF_SCOPE.

Resolution

Either of the two approaches below can address this connectivity issue: 

• Assign an "external IP" to the VM which is experiencing connectivity issues.
• Enable "Default Outbound NAT" in the "VPC Connectivity Profile" for the VPC where the private or TGW private subnet reside.
  
  

The specific steps to check if the "external IP" or "Default Outbound NAT" is enabled from the API perspective:

1. 1. Get VPC policy path from source port.
   2. Get VPC Connectivity profile path from API: /policy/api/v1{vpc_path}/attachments.
   3. Get VPC Connectivity profile and check if `enable_default_snat` is enabled.
   4. Get VPC subnet port path.
   5. Get External IP via API /policy/api/v1/{vpc_subnet_port_path}, check if `external_ip_address` assigned.

Additional Information

Create a Virtual Private Cloud in vCenter