Error: Routing subsystem on the edge node is down due to physical network reachability failure for NSX Edges

Products

• VMware NSX

Issue/Introduction

Northbound routing from a VMware NSX Edge node remains unavailable when BGP neighborship sessions are stuck in a "Connect" state.
This condition typically triggers high-severity alarms in the NSX Manager, including "Routing subsystem on the edge node is down" (Event ID: routing_down).
This article provides diagnostic steps to verify whether the failure stems from the underlying physical network infrastructure, such as incorrect VLAN tagging, switch port misconfigurations, or cabling issues, which are prerequisites for Tier-0 Gateway peering.

Symptoms:

• The NSX Manager UI displays the Tier-0 HA state as "Down" for one or more Edge nodes.
• High-severity alarm routing.routing_down is active for the Transport Node.
• BGP neighborship status remains stuck in the "Connect" state.
• Egress traffic fails to reach the physical network.
• Log entries in NSX Manager or Edge logs show:
  • eventType="routing_down" ... No northbound connectivity from the edge.
  • errorCode="MP701099" ... eventType="routing_down" ... subcomp="monitoring"
  • BGP runtime states for peer sessions show Down with a state description of Concat Path Down.

Environment

• VMware NSX 4.x
• VMware Cloud Foundation (VCF)

Cause

A lack of physical network reachability between the NSX Edge nodes and the upstream physical routing infrastructure. This prevents the Edge Service Router (SR) from performing basic ICMP pings to the neighbor or gateway IPs, causing the BGP state machine to stall in the "Connect" phase.

Resolution

1. Log in to the NSX Edge node CLI via SSH.
2. Identify the Service Router (SR) VRF ID for the affected Tier-0 gateway using the command: get logical-routers
3. Enter the VRF context: vrf <SR-ID>
4. Attempt to ping the upstream BGP neighbor IP: ping <Peer-IP>
5. If the ping fails, perform a network layer audit:
   • Verify physical cabling between ESXi hosts and top-of-rack (ToR) switches.
   • Inspect switch port configurations to ensure the required Edge uplink VLANs are allowed on the trunk lines.
   • Confirm that VLAN tagging on the physical switches matches the NSX Edge uplink profile configuration.
6. Validate that the upstream routers/firewalls are configured to accept traffic from the Edge uplink IP addresses.
7. Once reachability is restored, verify that the ping is successful from the Edge SR VRF.
8. Confirm BGP status transitions to "Established" using the command: get bgp neighbor summary