Transient Loss of L2 Bridge Communication After NSX Edge Exits Maintenance Mode.

Products

• VMware NSX

Issue/Introduction

VMware NSX experiences a transient loss of L2 communication to specific IP addresses on a bridged VLAN immediately following the NSX Edge node's exit from maintenance mode.

During this timeframe, partial ARP entry synchronization occurs, and tenant traffic is effectively blackholed. Normal traffic flow is only restored once the dynamic ARP entry for the affected IP is organically learned by the Dataplane.

The following log snippets outline the behavior during the issue:

• Service Dataplane Starts:

  2026-06-17T21:38:38.880Z NSX 7116 - [nsx@6876 comp="nsx-edge" subcomp="node-mgmt" username="root" level="WARNING" eventFeatureName="infrastructure_service" eventType="edge_service_status_changed" eventSev="warning" eventState="Off" entId="########-####-####-####-########f28e"] The service dataplane changed from STOPPED to STARTED.

• Bridgeport Mac-Sync Stats (Showing TX Failures):

  /edge/vlan-bridgeport-show:
      {
        "ifuuid": "########-####-####-####-########8dd2",
        "internal_op_state": "0",
        "lswitch": "########-####-####-####-########5428",
        "lswitch name": "",
        "vlan": ##3,
        "ra_guard": "enabled",
        "last rarp": "2026-06-17 21:34:22.392",
        "rarp_count": 41,
        "last_loop_detected": "2026-06-17 21:17:01.688",
        "n_loop_mac": 0,
        "looped_mac": "##:##:##:##:##:44",
        "mac-sync stats": {
            "rx_update_count": 12,
            "rx_delete_count": 1,
            "rx_full_sync_count": 5,
            "tx_update_count": 12,
            "tx_delete_count": 0,
            "tx_full_sync_count": 2,
            "tx_errors": 2,
            "last_tx_succ": "2026-06-17 21:34:21.216",
            "last_tx_fail": "2026-06-17 21:37:24.192",
            "tx_has_been_failing": "1 d 17 h 0 m 19 s"
        },

• Delayed Organic ARP Learning (~4-5 Minutes Later):

  2026-06-17T21:44:38.660Z NSX 24116 SWITCHING [nsx@6876 comp="nsx-edge" subcomp="datapathd" s2comp="arp" level="INFO"] ARP/ND proxy for ##.##.##.92 from ##:##:##:##:##:7b on lrouter port ########-####-####-####-########71d0

  2026-06-17T21:44:38.660Z NSX 24116 SWITCHING [nsx@6876 comp="nsx-edge" subcomp="datapathd" s2comp="neigh" tname="dp-learning3" level="INFO"] dynamic arp entry(########-####-####-####-########71d0, ##.##.##.92) is created

Environment

VMware NSX

Cause

This issue is caused by a timing or race condition between two distributed edges on their BFD tunnel view. When an Edge with a preemptive bridge exits maintenance mode, it first stays as standby and sends full-sync requests to its peer active edge for mac-sync entries. The active edge attempts to reply to the full-sync request through the tunnel; however, if the BFD tunnel is not yet UP on the active edge's side, the mac-sync entries fail to be transmitted and updated on the preemptive edge. As a result, the preemptive edge decides to bring up its bridge port with empty mac-sync entries, and traffic is blackholed to its peer Edge with a down bridge port.

Resolution

• As an immediate workaround, configure and utilize a non-preemptive bridge profile.

• For a permanent solution, Engineering Team is working on it and may implement the fix in one of the upcoming major release.