VCF 9.1 - Supervisor API unreachable from external networks due to missing NSX VLAN or T0 VRF misconfiguration
Article ID: 448259
Updated On:
Products
Issue/Introduction
After a successful Supervisor deployment in a VMware Cloud Foundation (VCF) or vSphere Kubernetes Service (VKS) environment, the Supervisor API remains unreachable from external networks (e.g., jump boxes, external firewalls, or NSX Edges).
Traffic may be observed leaving the external firewall, but no response is received from the Supervisor VIP
Environment
VMware Cloud Foundation (VCF) 9.x
VMware vSphere Kubernetes Service (VKS)
VMware NSX (Networking with VPC)
Cause
This issue occurs when North-South traffic from external networks is dropped at the NSX edge boundary due to a misconfiguration in the physical-to-virtual network mapping. Specifically:
- Missing VLAN - The specific VLAN ID used for the Supervisor network was not included in the allowed VLAN list on the NSX uplink trunk segments.
- Incorrect Interface Tagging - The Tier-0 VRF interface dedicated to the Supervisor was assigned an incorrect access VLAN, preventing Layer 2/Layer 3 continuity between the Supervisor Control Plane and the external gateway.
Resolution
To resolve this issue, ensure the ingress network path is correctly configured through NSX:
Update NSX Trunk Segments
1. Log in to the NSX Manager UI.
2. Navigate to Networking - Segments.
3. Locate the Uplink Trunk Segments used by your Tier-0 Gateways.
4. Edit the segment and add the Supervisor VLAN ID to the list of allowed VLANs.
Correct T0 VRF Interface Configuration
1. Navigate to Networking -> Tier-0 Gateways.
2. Locate the Tier-0 VRF associated with the Supervisor.
3. Edit the Interfaces configuration.
4. Ensure the interface is mapped to the correct segment and assigned the correct Access VLAN ID matching your physical network requirements.
Verification
1. Perform a connectivity test (e.g., `curl -v telnet://<Supervisor_VIP>:6443`) from an external jump box to confirm the API is now reachable.
Feedback
