NSX LB VIP responds to ping when Virtual Server is disabled
search cancel

NSX LB VIP responds to ping when Virtual Server is disabled

book

Article ID: 444506

calendar_today

Updated On:

Products

VMware NSX

Issue/Introduction

An NSX Native Load Balancer continues responding to pings (ICMP echo requests) at its Virtual IP (VIP) after the Virtual Server is disabled in the UI.

Environment

VMware NSX 4.x

Cause

Expected behavior by design. When a Virtual Server is disabled, traffic forwarding stops, but the VIP remains present on the Tier-1 Service Router (SR) active Edge Node. As a result, the Edge may continue responding to ICMP (ping) requests for that address.

Resolution

To drop all ICMP traffic to the VIP, use one of these two methods:

Option 1: Gateway Firewall Rule 

  1. In the NSX Manager UI, go to Security > Gateway Firewall.
  2. Add a rule with these parameters:
  3. Source: Any
  4. Destination: <Virtual_Server_VIP>
  5. Service: ICMP ALL
  6. Action: DROP
  7. Click Publish.

Option 2:

    If permanently retiring the service, delete the Virtual Server object to completely unbind the VIP from the Tier-1 Service Router instance.

Powered by Wolken Software