Communication between F5 VMs and Web VMs intermittently down, while being on the same host.

Products

• VMware vSphere ESXi

Issue/Introduction

• The F5 VMs, and the Web VMs are wired to separate Port Groups, but have IPs from the same IP network.
• This is a typical design with ACI, where the ACI is performing VLAN bridnging.
• While both the F5 VMs and the Web VMs are on the same host, the ping is not working. 
• Packet capture shows the ARP request broadcasted out of the Web VM and delivered.
• The ARP reply was spotted leaving the F5 VM, leaving the host to the ACI for VLAN bridging, coming back to the host with the correct VLAN (Web dvPG), entering the vDS, but never been forwarded out of the switchport to the Web VM. 

Environment

VMware NSX

Cause

This issue occurs because Cisco ACI requires explicit encapsulation settings to bridge Layer 2 traffic across different VLANs/port groups within the same IP subnet. When Flood in Encapsulation is disabled on the Cisco ACI Endpoint Group (EPG), ARP replies and bridged traffic returning to the vDS are dropped or improperly handled.

 

Resolution

To resolve this issue, enable encapsulation flooding in your Cisco ACI configuration:

1. Log in to the Cisco APIC management console.

2. Navigate to the Application Endpoint Group (EPG) configured for the affected port groups/VLANs.

3. Enable Flood in Encapsulation.

4. Save and apply the configuration changes.

Additional Information

For additional context on Cisco ACI Layer 2 encapsulation requirements, refer to the Cisco APIC Layer 2 Configuration Guide.