NSX IPsec VPN Tunnels Fail With Peer Not Responding After NSX Upgrade

Products

• VMware NSX

Issue/Introduction

Following an upgrade of VMware NSX, some IPsec VPN tunnels fail to establish. Network traffic is successfully transmitted from the NSX side, but no response is received from the destination peer endpoint. Tunnels that remain operational display successful bidirectional traffic.

The /var/log/syslog file on the NSX Edge node confirms communication failures triggering Dead Peer Detection, displaying errors similar to the following:

2026-07-17T13:28:47.392Z <Edge_Name> NSX 13674 VPN [nsx@6876 comp="nsx-edge" subcomp="iked" s2comp="iked-main" level="DBG"] Request for IPSEC tunnel status update : tunnel: 8202, rule: 536916929, local_ip: <##.##.##.XX>, peer_ip: <##.##.##.YY> inbound_spi: 0x0, outbound_spi: 0x0 status: IPSEC_STATUS_DOWN, error: Peer not responding

2026-07-17T13:28:47.393Z <Edge_Name> NSX 13674 VPN [nsx@6876 comp="nsx-edge" subcomp="iked" s2comp="ike-stack" level="INFO"] DPD; Peer <##.##.##.YY>: is already marked as dead

Cause

The 3rd-party perimeter firewall drops or fails to forward the return traffic because its IKE sessions became out of sync and stale, possibly due to reconnection attempts during the maintenance window upgrade. 

The reasoning for the faulty IKE sessions would need to be investigated either by the 3rd-party firewall vendor or the respective firewall admin.

Resolution

Reset the IKE sessions on the 3rd-party firewall:

• Access the management interface of the 3rd-party perimeter firewall routing the IPsec VPN traffic.
• Identify the stalled or out-of-sync IKE sessions associated with the affected NSX and peer endpoints.
• Clear the active IKE sessions on the 3rd-party perimeter firewall to force a clean negotiation between the VPN endpoints.