NSX IPsec VPN fails when traffic ingresses via Inter-VRF ports

Products

• VMware NSX

Issue/Introduction

Route-based IPsec VPN sessions established between two Tier-0 VRFs show a "Success" status, but data traffic fails to pass between the Virtual Tunnel Interfaces (VTIs).

• Traffic is unidirectional (Tx increments on the sender, but Rx remains zero on the receiver), as shown below:
  get ipsecvpn tunnel stats



• Packet captures (pcap) on the Inter-VRF ingress port show packets arriving at the Edge.
  
  
• Verification of the Security Association Database (SAD) shows matching entries for the traffic.
  get ipsecvpn sad summary | find <remote_ip>
  
  
• Despite the SAD match, the no-sa error counter in the IPsec statistics increases, and packets are dropped, as shown below:
  get logical-router interface <uuid> | find IPsec
  
• The ingress port type is identified as Inter-VRF.

Environment

• VMware NSX-T Data Center 3.X 
• VMware NSX 4.X
• VCF NSX 9.x

Cause

This is a known limitation. Inter-VRF ingress for IPsec VPN is not supported in these versions. For the NSX datapath to correctly process and decrypt IPsec traffic, the packets must ingress the Edge Node via a physical uplink interface. 

Resolution

Inter-VRF ingress for VPN is not supported in NSX versions prior to 9.1.

Workaround: 

• Adjust the network topology to avoid IPsec ingress via Inter-VRF port.

For supported versions (9.1 and higher), verify if the configuration adheres to standard uplink requirements. For further assistance, contact support: Contact Broadcom Support.

Additional Information

For defects and enhancements, subscribe to this article (reference: Subscribe to a Broadcom knowledge article by article or product) to be updated on fix status.