BGP Route Aggregation Fails to Advertise NAT Egress Pool Prefix

Products

• VMware NSX

Issue/Introduction

BGP route aggregation on Tier-0 Gateway <REDACTED_HOSTNAME> was updated. The original configuration used a /21 summary. This was modified to two more specific aggregates: /22 and /24. While the /22 ingress range is advertising correctly, the /24 egress pool is no longer being published via BGP to external neighbors. This results in a loss of external connectivity for services utilizing the egress pool, as the return path is missing from the physical infrastructure.

Execution of the get route bgp command on the Tier-0 Service Router (SR) confirms the missing /24 prefix. Reverting to the original /21 aggregate restores connectivity.

Environment

VMware NSX

Cause

The root cause is a configuration omission within the Tier-0 route redistribution rules. When the broad aggregate was removed, the /24 pool utilized for NAT required explicit redistribution instructions.

In NSX-T architecture, NAT and Egress pool IPs are not automatically redistributed by BGP unless the specific "NAT IP" redistribution flag is active for the relevant gateway level.

Resolution

 

• Navigate to Networking > Tier-0 Gateways in the NSX Manager UI.

• Edit the affected Tier-0 Gateway.

• Expand Routing > Route Re-distribution and edit the existing Redistribution Rule.

• If the Egress pool is applied to NAT rules directly on the Tier-0: Check the box for NAT IP under Tier-0 Subnets.

• If the Egress pool is applied to a Tier-1 gateway: Check the box for NAT IP under Advertised Tier-1 and VPC Subnets.

• Click Apply and Save the gateway configuration.

• Verify the advertisement on the Edge CLI by running the get route bgp command.