NSX Segment Realization Failure with Error "LogicalSwitch still have logical ports attached, can not modify IP/MAC pool id"

Products

• VMware NSX
• VMware vCenter Server

Issue/Introduction

When attempting to modify an overlay segment, move it to a different Tier-1 Gateway/Edge Cluster, or during general segment realization, the operation fails with the following error in the NSX Manager UI:

LogicalSwitch [UUID] still have logical ports attached, can not modify IP/MAC pool id

The segment status remains in "Failed" or "In Progress" indefinitely.

Environment

• NSX Manager
• vCenter Server (Compute Manager)

Cause

This error occurs when the NSX Manager is unable to communicate with the Compute Manager (vCenter).

When a segment is modified or moved, NSX must synchronize these changes with the Distributed Virtual Switch (DVS) on the vCenter side. If the Compute Manager connection is DOWN (commonly due to a vCenter certificate replacement or network interruption), NSX cannot push the updates. The manager incorrectly reports a conflict with the IP/MAC pool (often the TEP pool) because it cannot complete the transaction with the attached logical ports on the vCenter-managed DVS.

Resolution

To resolve this issue, the underlying connectivity between NSX and the Compute Manager must be restored.

1. Check Compute Manager Status:

   • Navigate to System > Fabric > Compute Managers.
   • Check the status of the vCenter Server. If it shows "Down" or "Not Registered", proceed to step 2.

2. Restore Connectivity:

   • If the connection is down due to a recent vCenter certificate replacement, follow the steps in KB 323341: After the vCenter Server certificate is replaced, the compute manager connection is "Down" in the NSX UI to refresh the thumbprint and restore the connection.
   • Ensure the vCenter credentials and network connectivity (Port 443) are valid.

3. Force Segment Realization:

   • Once the Compute Manager status is UP, go to Networking > Segments.
   • Find the failing segment and click Edit.
   • Perform a "dummy edit" (e.g., add a space to the description or toggle a setting) and click Save.
   • This will trigger a new realization request, which should now succeed as communication with vCenter is available.

4. Verification:

   • Confirm the segment status changes to Success.
   • Verify that the segment is correctly associated with the intended Tier-1 Gateway.