Supervisor Cluster connectivity to Broadcom image sites fails with Connection Timed Out on eth1

Products

• VMware NSX

Issue/Introduction

When configuring services in a Supervisor Cluster, you may observe that external Broadcom image repositories (e.g., projects.packages.broadcom.com) are unreachable from the Supervisor Control Plane VMs via the eth1 (Workload Network) interface.

Attempts to pull container images for Supervisor Services fail.
A manual connection test using curl from the Supervisor node results in the following error:

* connect to <IP_Address> port 443 from <Source_IP> port <Port> failed: Connection timed out
* Failed to connect to projects.packages.broadcom.com port 443 after 131307 ms: Could not connect to server
curl: (28) Failed to connect to projects.packages.broadcom.com port 443 after 131307 ms: Could not connect to server

Environment

VMware Cloud Foundation (VCF) 9.x
VMware NSX 9.x

Cause

The issue is caused by an IP address overlap between the VPC External IP Block assigned to the Supervisor Cluster and the existing physical network infrastructure (Underlay).

When a Supervisor Cluster uses a specific external IP range for SNAT (Source Network Address Translation) to communicate externally, and that same range is already defined as a local VLAN or subnet on the physical switches, the return traffic from the external site is misrouted. Packet captures show that traffic successfully exits the NSX Tier-0 (T0) Uplink, but return packets are dropped or routed incorrectly by the physical network because the SNAT IPs are viewed as local to the underlay switches rather than reachable via the NSX Edge uplinks.

Resolution

To resolve this issue, you must ensure that the IP ranges allocated for VCF/NSX External IP blocks are unique and do not overlap with any ranges in the physical network.

Identify Overlapping Range:

Log in to NSX Manager.
Navigate to Networking > IP Address Management > IP Address Blocks.
Verify the range assigned to the Supervisor Cluster and compare it against your physical network.
Modify Physical Infrastructure:

Make sure there are no Overlapping IP address Ranges in the Underlay/Physical Network and also ensure bidirectional communication is working between the NSX External IP blocks and the Underlay Physical Network.

Additional Information

VPC external IP blocks are IP ranges owned by VCF/NSX and should not overlap with other ranges in the physical network. The Tier-0 gateway advertises these ranges to external routers via BGP or requires proper static routing in the underlay to ensure bidirectional communication.

VPC Centralized Network Connectivity – With Guided Edge Deployment (Pre-provision IP blocks for VPC)