NFS mount failure or timed out on VMware ESXi: Error 13 or Connection timed out.

Products

• VMware vSphere ESXi

Issue/Introduction

Symptoms

• NFS datastore mount fails from the ESXi host.
  
  
• In /var/log/vmkernel.log, errors similar to the following appear:
  
  
  • WARNING: NFS: 209: Got error 13 from mount call
  • NFS: 3500: NFS mount failed for [IP]. Status: The mount request was denied by the NFS server.
    
    
• Manual network probes using nc -zv return: nc: connect to [IP] port 2049 (tcp) failed: Connection timed out.
  
  
• Packet captures on the host storage interface show outbound frames (ARP or SYN) with no corresponding response from the storage controller.

Environment

VMware vSphere ESXi 6.x, 7.x, 8.x

Cause

1. Permission Denied (Error 13): The storage export policy does not permit the ESXi host's VMkernel IP address.
   
   vmkernel: cpu32:#### opID=####)NFS: 349: Command: (mount) Server: (##.##.#.##) IP: (##.##.#.##) Connections: (1) Vmknic: (None)  Path: (/NFS_Path) Label: (NFS_Label) Options: (None)
vmkwarning: cpu0:####)WARNING: NFS: 209: Got error 13 from mount call
vmkernel: cpu32:#### opID=####)NFS: 3500: NFS mount failed for ##.##.#.##:/NFS_Path volume NFS_Label. Status: The mount request was denied by the NFS server. Check that the export exists and that the client is permitted to mount it.
   
   
2. Connection Timeout:
   
   
   • Firewall Classification: Stateful firewalls (e.g., Palo Alto) may classify raw nc probes as unknown-tcp and drop the packets if they lack valid application-layer headers (e.g., NFS RPC).
     
     
   • Asymmetric Routing: The storage controller lacks a return route to the ESXi storage subnet, causing it to send replies to an incorrect gateway.
     
     
   • Downstream Block: Security rules or VLAN tagging mismatches are preventing bidirectional traffic.

Resolution

1. Verify Export Policies: Ensure the ESXi VMkernel IP address is explicitly allowed in the volume export policy on the storage array.
   
   
2. Audit Network Path:
   
   2.1: Review firewall logs for the source host IP and destination storage IP on port 2049.
   2.2: Check for "unknown-tcp" or "incomplete" session markers.
   2.3: Test connectivity using a legitimate mount attempt (esxcli storage nfs add) rather than just network probes to allow the firewall to classify the traffic.
   
   
3. Confirm Routing Symmetry: Verify the storage controller has a valid return route to the ESXi host's storage subnet.
   
   
4. MTU Consistency: Ensure MTU settings match (e.g., Jumbo Frames 9000) across all switches and physical interfaces in the path.

Additional Information

• To speak with a customer representative or a Support Engineer, see Contact Support.
• Subscribe to this article to receive updates: How to subscribe to Knowledge Management articles.