Route based IPSec VPN session down on Tier-0 with HA VIP

Products

• VMware NSX

Issue/Introduction

• You configure a second Route Based IPSec VPN session, but its status goes down after initially being up for ~30 minutes.
• IKE Session Status is marked as down with Peer Not Responding.
• In /var/log/syslog on the active Tier-0 Edge node, you might see logs similar to:

  NSX #### VPN [nsx@#### comp="nsx-edge" subcomp="iked" s2comp="ike-stack" level="INFO"] Local IP ##.##.##.## unavailable.

• On the Tier-0 where you have IPsec configured, High Availability VIP is enabled and configured.

Cause

The local endpoint IP used for the session that is down, is the same as the Tier-0 High Availability VIP address.The HA VIP address is incorrectly moved to the loopback interface when the second endpoint is added, making it unavailable as the local endpoint IP for the VPN session.

Resolution

This issue is resolved in VMware NSX 4.2.4 available at Broadcom downloads.
If you are having difficulty finding and downloading software, review the Download Broadcom products and software KB.

Workaround:

• Create another IPSec VPN Session with a local endpoint using a different IP than used for the HA VIP of the Tier-0.