VMs in VPC subnets fail to communicate outbound with a Distributed Transit Gateway with "NO_GATEWAY_CIDR_FOUND"

Products

• VMware NSX

Issue/Introduction

You observe that Virtual Machines (VMs) attached to public and private Virtual Private Cloud (VPC) subnets cannot communicate outbound. This issue occurs when a distributed transit gateway is implemented with a public network for the VPCs, and default outbound NAT is enabled in the VPC profile. You will see that outbound network connectivity tests from the VPC VMs to the physical network fail, despite no vDefend Firewall being configured for the VPC.

 

Environment

 

• VMware Cloud Foundation

• VMware NSX

 

Cause

This issue occurs because the external network for the Distributed Transit Gateway is missing the required VPC External IP Blocks (CIDR/IP Range) configuration. Without this configuration, the VPC VMs cannot successfully route outbound traffic to the physical network.

Resolution

To resolve this issue, configure the missing IP blocks for the external network:

1. Create a new external IP block for the VPC.
2. Set the VLAN ID and Gateway CIDR to match the physical VLAN and its corresponding subnet.
3. Configure the VPC External IP Blocks with the ranges used for external IPs or public subnets. For a distributed external connection, you typically use the entire subnet configured on the VLAN.
4. For Private Transit Gateway IP Blocks, you can safely assign subnet.

Additional Information

For additional context and configuration details regarding VPC distributed network connectivity, review the VMware public blog: https://blogs.vmware.com/cloud-foundation/2025/06/25/vpc-distributed-network-connectivity-no-nsx-edge-vms/