Understanding NSX Edge Datapath State Synchronization Traffic (PFSync / 250.x.x.x)

Products

• VMware vDefend Firewall

Issue/Introduction

When running packet captures or monitoring performance metrics on NSX Edge Nodes, administrators may observe large volumes of internal packets sourced from IP address 250.x.x.x using IP Protocol 240 (IP-PROTO-240).

Under high connection-churn workloads, this traffic can account for a significant percentage of total Edge interface packets, occasionally leading to receive ring buffer overflows (rx_misses) or buffer utilization alarms (edge_nic_out_of_receive_buffer).

Environment

VMware NSX

VMware vDefend Firewall

Cause

The IP address 250.x.x.x is an internal pseudo-IP address used strictly by the NSX Edge datapath for PFSync.

1. State Replication for High Availability: To provide seamless failover without dropping active user sessions, Active Edge Service Routers (SRs) continuously replicate connection state updates (creation, updates, and deletions) for stateful services—such as Gateway Firewalls and NAT—to Standby or peer SR instances.

2. Datapath Encapsulation: PFSync messages are generated out-of-band directly within the datapath. These packets feature an inner IP header sourced from 250.x.x.x with protocol 240 (PFSYNC) and are encapsulated inside standard Geneve overlay frames (UDP port 6081) across Edge VTEPs. They are strictly internal datapath constructs and are not intended to be routed or exposed on physical IP networks.

3. Volume Correlation: The volume and burstiness of PFSync traffic directly correlate with the flow-churn rate on the Active Edge node. Rapid connection setups, short-lived TCP sessions, or high-volume state updates generate a corresponding surge in synchronization traffic sent to the peer Edge.

Resolution

This is Expected Behavior. PFSync traffic cannot and should not be disabled or filtered, as doing so prevents the Standby Edge node from maintaining an accurate flow table, resulting in dropped sessions during an HA failover.

To mitigate buffer overflow alarms (rx_misses) or packet drop counters resulting from high-volume state replication bursts:

1. Increase the physical or virtual NIC receive (rx) ring buffer sizes on the Edge Nodes to absorb transient bursts of synchronization packets without dropping frames.

2. Identify workloads driving high connection-creation rates and implement connection pooling or keep-alives to reduce connection creation and teardown frequency.

3. Where applicable, evaluate whether extreme flow-churn traffic requires stateful inspection at the Gateway Firewall, or if stateless handling is appropriate.

Additional Information

 

• The NSX Edge datapath incorporates built-in dampening and aggregation algorithms on the Active SR to consolidate state updates and minimize synchronization packet overhead before encapsulation.

• If PFSync packets are dropped due to network congestion or interface buffer exhaustion during heavy bursts, connection states for those specific un-synced flows will not exist on the peer node. If an HA failover occurs under these conditions, those specific active connections may reset.