External connectivity failure in VMware NSX T0 VRF due to SNAT IP conflict

Products

• VMware NSX

Issue/Introduction

You may experience the following symptoms when using Source NAT (SNAT) in a Tier-0 VRF environment:

• Virtual Machines (VMs) connected to an NSX Segment are unable to reach external networks or devices outside of the NSX environment.
• Traceflow analysis from the NSX UI shows packets being dropped on the NSX Edge node with the error: Dropped for no route found.
• Packet captures on the Tier-0 VRF uplink show both ICMP echo requests leaving and ICMP echo replies returning to the interface.
• Packet captures on the Edge datapath interface (fp-eth####, or T1 Uplink Interface) show that while the source VM sends the ICMP echo request, the Tier-0 Gateway does not forward the ICMP echo reply back to the VM.
• Static routes configured on the Tier-0 VRF appear in the NSX Manager UI but are missing from the Active Edge forwarding table (get logical-router route).

Environment

VMware NSX 4.2.x

Cause

The issue occurs because the SNAT Translated IP address is configured to be the same IP address as the Tier-0 VRF Uplink Interface.

When the same IP is used for both the translation and the physical uplink, the Tier-0 Gateway cannot correctly process the return traffic. The Edge node identifies the incoming packet's destination (the translated IP) as its own local interface address rather than a NAT translation entry, preventing the traffic from being forwarded back to the downstream Tier-1 Gateway and the source VM.

Resolution

Workaround: To restore connectivity, you must ensure the SNAT Translated IP does not conflict with the Tier-0 Uplink IP:

1. Log in to the NSX Manager UI.
2. Navigate to Networking > NAT.
3. Locate the SNAT rule currently configured on the Tier-1 Gateway.
4. Delete the conflicting SNAT rule from the Tier-1 Gateway.
5. Re-create the SNAT rule on the Tier-0 Gateway.
6. Ensure the Translated IP used is either a unique IP address or, if the uplink IP must be used, that the rule is appropriately bound to the Tier-0 Uplink.
   • Note: As a best practice, use a different IP for SNAT translation than the one assigned to the Uplink Interfaces to ensure redundancy and avoid port exhaustion or logical conflicts.
7. Verify the fix by running a Traceflow to confirm the packet is no longer dropped with "no route found" and that translation occurs at the Tier-0 stage.