ARP failure or East-West traffic drop due to multi-subnet TEP pool despite healthy host status - NSX
Article ID: 448007
Updated On:
Products
Issue/Introduction
- Traceflow analysis confirms packet drops caused by ARP resolution failure.
- East-West (E-W) traffic fails when initiated from specific transport nodes.
- ARP table on the source host shows the destination VIP or VM IP in an unresolved state (00:00:00:00:00:00)
- To validate from the source ESXi host:
nsxcli -c "get logical-switch <VNI> arp-table" - Host preparation status and TEP tunnels appear Healthy or UP in the NSX Manager UI.
- Packet captures indicate overlay broadcast (BUM) traffic reaches the designated replication proxy host but fails to replicate to target hosts in remote subnets.
Environment
- VMware NSX
Cause
The ESXi Geneve/VXLAN netstack maintains only a single default gateway for TEPs, derived from the first acquired subnet. If a TEP IP Pool contains multiple subnets, VTEPs assigned to a secondary subnet experience network unreachability. When such a host is designated as a proxy for Hierarchical Two-Tier (MTEP) replication, it cannot forward ARP broadcast frames to hosts in other subnets. This routing behavior is a design limitation.
Resolution
Temporary Workaround (Immediate Mitigation) To immediately restore E-W connectivity without rebooting hosts or altering IP allocations, bypass the MTEP proxy host mechanism:
Log in to the NSX Manager UI.
Navigate to Networking > Segments and select the affected logical segment(s).
Change the BUM Replication Mode from Hierarchical Two-Tier to Head-End Replication
Note: Head-End Replication forces the source transport node to replicate broadcast frames directly to all target VTEPs, completely bypassing the broken proxy host.
To permanently resolve the gateway mismatch, ensure all TEP VMkernel interfaces on any given ESXi host reside within a single IP subnet
Additional Information
Feedback
