HCX Service Mesh Tunnels DOWN with Multi-Homing

Products

• VMware HCX

Issue/Introduction

Bulk migration tasks fail to submit or initiate within the VMware HCX 4.11.3 environment, blocking all planned workload migration schedules.

Within the HCX User Interface, the Interconnect Service Mesh dashboard displays the IPsec tunnel status explicitly as DOWN. No migration traffic or remote site pairing handshake can occur over the affected Interconnect (IX) appliances.

Environment

HCX

Cause

A multi-homing configuration conflict exists on the HCX Interconnect (IX) appliance. Both the Management interface network profile and the Uplink interface network profile (designated for IPsec traffic) are configured within the exact same IP subnet boundary, resulting in routing ambiguities and interface binding failures for local system services.

Resolution

Because both interfaces share an identical subnet, network stack architecture constraints prevent the IPsec daemon from correctly prioritizing or differentiating traffic paths. This asymmetric routing loop prevents IPsec tunnel negotiation packets from completing the cryptographic handshake, forcing the tunnel to remain down.

 
Log into the HCX Manager UI and navigate to the Infrastructure > Interconnect > Compute Profile / Service Mesh configuration.

Modify the network profile assignments for the Interconnect (IX) appliance to merge the Management and Uplink (IPsec) functions onto a single shared network configuration.

Execute a Resync operation on the active Service Mesh to push the consolidated configuration and re-initialize the appliances.
 
Consolidating the overlapping Management and Uplink networks into a single network footprint eliminates the multi-homing routing loop completely. This architectural change ensures clean local interface binding and single-path routing table rules on the appliance, allowing the IPsec tunnel to immediately negotiate, establish stability, and successfully process Bulk migration payloads.