BGP advertised routes from NSX visible as connected routes on peer firewall

Products

• VMware NSX

Issue/Introduction

Specific Border Gateway Protocol (BGP) prefixes advertised from VMware NSX-T are received by a peer firewall but are not installed as dynamic routes. Instead, the peer firewall interprets these prefixes as local connected interfaces, preventing correct routing and communication with BGP neighbors.

Environment

VMware NSX

Resolution

This is typically an environmental or configuration-specific behavior on the peer firewall end. Perform the following steps to verify and resolve:

1. Log in to the NSX Manager and verify advertised routes:
   * Navigate to **Networking > Tier-0 Gateways**.
   * Select the gateway and generate the **BGP Summary**.
   * Use the CLI command `get bgp neighbor <IP> advertised-routes` within the T0 SR VRF to confirm the prefixes are sent.

2. On the peer firewall, inspect the BGP received table:
   * Verify that the prefix is received with the correct Next Hop (the NSX Edge uplink IP).

3. Check for overlapping configurations on the peer firewall:
   * Ensure no local interfaces or loopbacks on the firewall overlap with the prefixes being advertised from NSX.

4. Review the BGP redistribution policy on NSX:
   * See Enable Route Redistribution on the Tier-0 Logical Router for standard configuration steps.

5. If the issue persists, review the BGP import policies and routing table precedence on the firewall side.

Additional Information

If the routes are not being advertised from NSX end, Please reach out to Broadcom Support.