Error: Supervisor Control Plane unreachable on port 443 - VMware NSX

Products

• VMware NSX
• VMware Cloud Foundation

Issue/Introduction

Establishment of a connection to the vSphere Supervisor Control Plane VIP on port 443 fails. Attempts to log in to the cluster result in timeouts. Diagnostic tests like ping or traceroute show 100% packet loss or traffic dropping at the network handoff between the physical and virtual environments.

 

Symptoms:

• Port connectivity tests return a timeout or failure:  

   nc -vz <Supervisor IP> 443

• A traceroute shows traffic dropping at an external hop # 9 (typically at the physical network boundary) indicating the traffic was not reaching the intended subnet. 

Environment

VMware Cloud Foundation (VCF)
VMware NSX 4.x
vSphere Supervisor Cluster

Cause

A misconfiguration in the external BGP peering prevents traffic from being routed. Ingress and Egress routes required for the Supervisor Control Plane are either not advertised by the NSX Tier-0 Gateway or are not processed by the physical upstream routers.

Resolution

1. Check BGP Neighbor Status: Log in to the NSX Edge node CLI and verify the BGP session status:

get logical-router <T0-VRF-ID> bgp neighbor

     2. Verify Route Advertisement: Confirm that the Supervisor Ingress/Egress subnets are advertised to physical peers:

get logical-router <T0-VRF-ID> bgp neighbor <Neighbor-IP> advertised-routes

     3. Audit Physical Network Configuration: Ensure the Top-of-Rack (ToR) switches are configured to accept these advertisements. Verify no firewall rules on the physical path block port 443.

     4. Confirm Connectivity: Once BGP peering is restored and routes are installed in the physical routing table, verify the cluster is reachable.

Additional Information

Troubleshooting BGP on NSX Edge Nodes

Enable Route Redistribution on the Tier-0 Logical Router

VMware NSX Administration Guide

Subscribe to a Broadcom knowledge article by article or product