BGP Peering Deadlock in NSX on AWS EVS due to Static Route Redistribution Loop

Products

• VMware NSX

Issue/Introduction

• BGP sessions between NSX Tier-0 Gateways and AWS VPC Route Server enter a "Down" or "Idle" state.
• Traffic looping prevents the establishment of BGP sessions, and BGP Keepalive packets are reflected back to the source.

Environment

VMware NSX

Cause

A routing loop occurs when a static route pointing to the VPC Route Server is redistributed into BGP from the NSX Tier-0 Gateway. The AWS Route Server learns this redistributed static route and updates the VPC routing table to point traffic back to the NSX Tier-0 uplink. This configuration traps BGP Keepalive traffic in a loop between the NSX T0 uplink and the Route Server. Even after correcting the NSX configuration, the AWS Route Server may persist the loop-causing route in its routing table, preventing the BGP session from recovering.

Resolution

1. Disable the redistribution of the problematic static route on the NSX Tier-0 Gateway:

a. Navigate to Networking > Tier-0 Gateways.

b. Select the Tier-0 Gateway and open Route Re-distribution.

c. Locate the route redistribution policy and disable the redistribution of T0 Static Routes.

2. Manually reset the AWS VPC Route Server to clear stale or persisted routing entries:

3. Validate the BGP session status in the NSX Manager:

a. Navigate to Networking > Tier-0 Gateways > BGP.

b. Monitor the BGP neighbor status to ensure it transitions to "Established".

c. Use packet captures on the Edge node uplink to confirm that BGP TCP traffic (Port 179) successfully initiates and receives acknowledgment without looping.