NSX Edge drops inbound external Geneve (UDP 6081) traffic with "unknown geneve version" during OpenShift upgrade precheck to OVN-Kubernetes

Products

• VMware NSX

Issue/Introduction

During an OpenShift cluster upgrade precheck, network connectivity fails in the Physical Server → NSX Edge VM direction.

 - Traffic from the VMs inside NSX environment to the OpenShift physical nodes works normally, but traffic from the OpenShift physical nodes to the VMs fails entirely.

As the CNI upgrades to OVN-Kubernetes, the overlay network mandates the use of GENEVE (UDP 6081). Packet captures on the NSX Edge VM uplink reveal that GENEVE encapsulated packets sent from the OpenShift physical nodes are dropped by the Edge with an 'unknown geneve version' error.

Environment

VMware NSX 4.x

Cause

Within NSX Edge, UDP 6081 is a strictly reserved port dedicated solely to internal NSX overlay (TEP-to-TEP) traffic.

 - The Edge attempts to decapsulate the packet. However, because the packet was encapsulated by an external OVN platform, the metadata (TLV Options) does not match NSX specifications. The Edge fails header validation and drops the packet.

Resolution

There is no configuration option within VMware NSX to bypass or allow external third-party GENEVE (UDP 6081) traffic. Egress traffic must be corrected on the OpenShift (OVN) side to ensure it is decapsulated before reaching the NSX boundary.

 - Ensure that traffic destined for the NSX environment is fully decapsulated and transmitted as standard L3 IP packets over a standard VLAN network.

Additional Information

Geneve: Generic Network Virtualization Encapsulation - https://datatracker.ietf.org/doc/html/rfc8926

Firewall Ports and Protocols Requirements for vSphere with NSX - https://techdocs.broadcom.com/us/en/vmware-tanzu/standalone-components/tanzu-kubernetes-grid-integrated-edition/1-20/tkgi/ports-protocols-nsx-t.html