Connectivity Loss and MPA Disconnect on NSX Edge Nodes Following Expired Certificate Replacement in VCF Environments

Products

• VMware NSX

Issue/Introduction

Symptoms:

• Loss of network connectivity to workloads on specific NSX-T segments (e.g., APP-DGI).
• Intermittent RDP accessibility for VMs within the same segment.
• Management Plane Agent (MPA) status shows as Down for NSX Edge nodes.
• Traceflow results indicate packets are "lost/No route" after leaving the logical network.
• Standard troubleshooting, including sequential NSX Manager restarts, fails to restore connectivity.

Environment

• VMware Cloud Foundation (VCF) 5.x
• VMware NSX 4.x

Cause

 This issue occurs when a certificate replacement or mismatch triggers a persistent synchronization failure between the NSX Manager and the Edge node's Management Plane Agent. While existing KBs address certificate expiry or general mismatches, certain states can result in a hung MPA process or corrupted local datapath state that does not recover through service restarts or Manager reboots.

Resolution

When service-level restarts (e.g., nsx-proxy, nsx-mpa) and Manager restarts fail to restore the MPA status, a redeployment of the Edge nodes is required to force a clean instantiation of the management and control plane state.

Using the NSX-T API provides a streamlined method to trigger this redeployment:

1. Identify the Edge Transport Node UUID: GET https://<NSX-Manager-IP>/api/v1/transport-nodes
2. Trigger the Redeploy Action: POST https://<NSX-Manager-IP>/api/v1/transport-nodes/<transport-node-id>?action=redeploy Note: Ensure Content-Type: application/json and Authorization: Basic headers are set.
3. Validation: Monitor the NSX UI to ensure the Edge node returns to a Healthy state and the MPA status shows as Up.

 

Additional Information

• KB 345825: Alarm For Transport Node Certificate Has Expired - Host/Edges MPA Disconnected.
• KB 389595: MPA connectivity down on NSX Edge VM after certificate replacement.
• KB 412483: MPA connection is down due to certificate mismatch between Edge and Manager.

When this solution should be used: When the MPA and datapath synchronization remain broken despite exhausting standard recovery steps. Redeploying via the API should be selected as the most efficient path to resolution because it automates the decommissioning and clean re-instantiation of the node, bypassing manual configuration steps and ensuring all local state files are refreshed, which service restarts failed to achieve.

For further assistance with this issue you may Contact Broadcom Support.