Virtual machines connected to an NSX VLAN-backed segment can communicate internally but cannot reach external networks when using a Tier-1 Service Interface as the default gateway.
search cancel

Virtual machines connected to an NSX VLAN-backed segment can communicate internally but cannot reach external networks when using a Tier-1 Service Interface as the default gateway.

book

Article ID: 450432

calendar_today

Updated On:

Products

VMware NSX

Issue/Introduction

  • Internal L2 connectivity between VMs on the same VLAN-backed segment works.
  • VMs cannot ping the Tier-1 Service Interface IP address.
  • North-South traffic fails when the gateway is moved from an upstream physical switch to an NSX Tier-1 Service Interface.
  • NSX Edge nodes are deployed as Virtual Machines (virtual Edges).

Environment

  • VMware NSX 4.x

Cause

This issue typically occurs due to one of the following configuration gaps:

  1. Transport Zone Mismatch: The Edge Transport Node hosting the Tier-1 Gateway is not associated with the VLAN Transport Zone used by the segment.
  2. VLAN Tagging Conflict: A conflict exists between the vSphere Distributed Switch (VDS) port group tagging and the NSX segment tagging (e.g., "Double Tagging").
  3. Missing Route Advertisement: The Tier-1 gateway is not configured to advertise "Service Port" routes to the Tier-0 or physical network.

Resolution

Follow these steps to resolve the routing failure:

  1. Verify Edge Transport Zone:
    1. Log in to the NSX UI and navigate to System > Nodes > Edge Transport Nodes.
    2. Select the affected Edge Node and click Edit.
    3. Ensure the VLAN Transport Zone used by the Service Interface segment is added to the Edge's switch configuration.
  2. Check Port Group Tagging (Virtual Edges Only):
    1. In vCenter, navigate to the Distributed Port Group used by the Edge Node's trunk interface.
    2. Ensure the port group is configured for VLAN 4095 (VGT mode) if NSX is handling the tagging.
    3. If the port group is tagged with a specific VLAN ID, ensure the NSX Segment's VLAN ID is set to 0 to avoid double tagging.
  3. Enable Route Advertisement:
    1. Navigate to Networking > Tier-1 Gateways.
    2. Edit the Tier-1 Gateway and expand Route Advertisement.
    3. Enable All Connected Segments & Service Ports.
  4. Refresh Interface State:
    1. If connectivity persists in failing, edit the Description field of the Service Interface and click Save to force a re-realization of the port on the Edge node.

Additional Information

Powered by Wolken Software