Unicast ARP probes fail in NSX Bridge topologies with extended Layer 2 segments
Article ID: 449403
Updated On:
Products
Issue/Introduction
In environments where network segments are extended across multiple layers (e.g., NSX Global Manager Overlay extended via NSX Bridge to a VLAN segment, then further extended via HCX or third-party L2 extensions), the following behavior may be observed:
- ARP Broadcasts function correctly, allowing initial IP discovery and connectivity.
- Unicast ARP Probes (neighbor solicitation) fail to receive a response.
- Neighbor tables (
ip neigh) show the gateway status as FAILED shortly after initial resolution. - Packet captures confirm that unicast probes reach the ESXi host where the NSX Bridge Edge resides but are dropped before being processed by the Edge appliance.
Environment
- VMware NSX
- VMware HCX
Cause
This drop occurs due to the dynamic learning behavior of the Distributed Virtual Switch (DVS). Like a physical switch, a DVS learns MAC addresses as they leave a switchport.
In a bridging topology, traffic destined for the NSX Bridge's MAC address will be dropped by the DVS until it has observed a frame originating from that specific MAC leaving the port. Without Unknown Unicast Flooding enabled on the NSX VLAN segment profile, the DVS cannot forward the unicast ARP probes to the Bridge Edge if the MAC has not yet been learned or has aged out. This prevents the probe from reaching the Gateway (VDR).
Resolution
Configure the intermediate NSX VLAN segment as per official NSX documentation for Edge Bridging:
- Log in to NSX Manager.
- Navigate to Networking > Segments.
- Locate the intermediate VLAN Segment used for the bridge.
- Edit the MAC Discovery Profile associated with this segment.
- Enable MAC Learning.
- Note: Enabling MAC Learning will also enable Unknown Unicast Flooding.
- Ensure Unknown Unicast Flooding remains Enabled to ensure bridging works in all scenarios.
Additional Information
For detailed packet capture procedures to isolate where the drop occurs in the datapath, refer to:
Feedback
