vSphere Replication Fails with "Not Active" Status After Management Port VRF Migration

Products

• VMware Live Recovery

Issue/Introduction

vSphere Replication tasks may fail with a Not Active status immediately following the migration of ESXi management or replication VMkernel adapters into a Virtual Routing and Forwarding (VRF) instance on Cisco Nexus switches.

• Replication status changes to Not Active.
• Site Recovery Manager (SRM) may report disconnection or synchronization failures.
• ICMP (ping) between source and target ESXi hosts remains successful.
• TCP connectivity on port 32032 is refused or timed out between ESXi hosts.

Environment

VMware Live Recovery 9.0.x

Cause

When moving a VLAN to a new VRF, the vSphere Replication service (hbrsrv) may fail to accept traffic due to:

1. Service Binding: The service remains bound to the loopback interface (127.0.0.1) if the network change occurred while the host was active.
2. Network Routing: Lack of route leaking or improper ACLs between the source and target VRFs specifically for TCP port 32032.

Resolution

To resolve this issue, perform a coordinated verification of the ESXi service state and physical network routing.

1. Verify ESXi Service Binding

Ensure the replication service is listening on the correct network interfaces.

1. Log in to the target ESXi host via SSH.
2. Run the following command to check the port 32032 listener:
   bash

   esxcli network ip connection list | grep 32032

   Verification: The state should be LISTEN and the local address should be 0.0.0.0:32032 or the specific VMkernel IP. If it shows 127.0.0.1:32032, the service is bound to the loopback and cannot accept external traffic.

2. Restart Replication Services

If the service is not listening correctly or to force a re-binding to the new VRF path:

1. Run the following commands on the affected ESXi hosts:
   bash

   /etc/init.d/hbrsrv restart
   /etc/init.d/envoy restart

3. Network Path Validation

Verify that the VRF configuration allows the specific required ports.

1. From a source ESXi host, test the path to the target ESXi host:
   bash

   nc -zv <target_esxi_ip> 32032

2. If the connection is refused or times out, engage the network team to:
   • Verify Route Leaking between the source and destination VRFs.
   • Ensure ACLs on the Cisco Nexus switches permit TCP 32032 and TCP 44046.
   • Check for asynchronous routing where traffic enters one VRF but the return path is not defined.

Additional Information

• Port numbers that must be open for vSphere Replication
• Troubleshooting vSphere Replication connectivity