VCF SDDC Pre-Checks Fail due to one or more ESXi hosts being unable to enter Maintenance Mode

Products

• VMware NSX

Issue/Introduction

During a VCF SDDC upgrade pre-check, one or more ESXi hosts fail to enter Maintenance Mode, preventing the pre-check from completing successfully. 

In the vSphere Client or ESXi host logs the following errors may be observed, indicating that connected network interfaces cannot access the required NSX port groups on the Distributed Virtual Switch because the network status is down (vdl2 down).

Currently connected network interface 'Network adapter 1' uses network 'DVSwitch[50 22 c3 be 9d 43 82 c7-## ## ## ## ## ## ## ##] NSX port group [dvportgroup-412###](vdl2 down)', which is not accessible.

Environment

NSX 4.x

Cause

The overlay transport zone relies on Tunnel Endpoints (TEPs) on vmk10 and vmk11 to facilitate encapsulation and data plane communication. This issue occurs when the TEP configuration in NSX is configured to use DHCP, but no functional DHCP server exists within the TEP VLAN to lease addresses. Consequently, the host's overlay vmkernel interfaces default to Automatic Private IP Addressing (APIPA/IPIPA) link-local addresses, causing Geneve tunnel establishment to fail and the port groups to state vdl2 down.

Resolution

Workaround:

The following procedure provides a workaround by configuring the ESXi host Tunnel Endpoints (TEPs) to use a Static IP Pool instead of DHCP. This restores overlay connectivity when a DHCP server is unavailable or not functioning on the TEP VLAN.

1. Navigate to System > Fabric > Profiles > Transport Node Profiles.
2. Select and edit the Transport Node Profile assigned to the affected host cluster.
3. Under the Subnets or TEP Configuration section, locate the IP Assignment option.
4. Change the IP Assignment method from DHCP to Static IP Pool.
5. Select an existing IP Pool assigned for TEP infrastructure or create a new one with available IP addresses.
6. Save the changes. NSX Manager will automatically push the updated configuration to the transport nodes and reconfigure the vmk10 and vmk11 TEP interfaces with static IP addresses. Once valid IP addresses are assigned, the Geneve tunnels should be established and the vdl2 down condition should be resolved.

Permanent Resolution:

If the environment is intended to use DHCP for TEP IP assignment, restore DHCP functionality instead of using the workaround above. Ensure that:

A functional DHCP server is available on the TEP VLAN.
The DHCP server is configured to lease IP addresses to the ESXi host TEP interfaces.
Any connectivity or configuration issues preventing DHCP lease assignment are resolved.

Once DHCP is functioning correctly, the ESXi host TEP interfaces will obtain valid IP addresses, the Geneve tunnels will be established, the vdl2 down will be cleared, and the VCF SDDC pre-check should be complete successfully. 

Additional Information

For additional information see:

APIPA IP addresses (169.254.#.#) seen on vmk10 and vmk11 interfaces on NSX prepared ESXi hosts.