NSX Native Load Balancer sessions stuck in SYN_RECV due to physical network ACK drops

Products

• VMware NSX

Issue/Introduction

• Connections to the NSX Native Load Balancer Virtual Server VIP fail.
• Virtual Server status may show as "Up", but backend applications are unreachable.
• Packet captures on the Tier-1 Service Interface show the Load Balancer receiving a TCP SYN and sending a TCP SYN-ACK.
• The final TCP ACK from the client never reaches the NSX Edge.
• Connection status on the Edge CLI remains in SYN_RECV.

Environment

VMware NSX 

Cause

The TCP 3-way handshake is interrupted because the return traffic (ACK) from the client is dropped or misrouted in the physical network layer (external switches or firewalls) before reaching the NSX Edge transport node.

Resolution

1. Identify the physical next-hop IP address configured in the static routes of the Tier-1 Gateway.
2. Coordinate with the network infrastructure team to trace the TCP ACK packet from the client source IP (####) to the NSX Edge uplink.
3. Verify the physical firewall logs and switch port statistics for any drops related to the VIP IP (####).
4. Ensure that asymmetric routing is not causing the ACK to bypass the necessary gateway or stateful firewall.
5. Validate that the packet reaches the NSX Edge by running a packet capture on the uplink interface: start capture interface <interface-uuid> direction in

Additional Information

Troubleshooting NSX Native Load Balancer

Troubleshooting Packet Captures for VMware NSX