Upstream physical firewall fails to update ARP table after NSX Edge HA failover

Products

• VMware NSX

Issue/Introduction

Traffic loss occurs following an NSX Edge HA failover or failback event.

Upstream physical firewalls or switches continue sending traffic to the standby node MAC address, despite the active node broadcasting a Gratuitous ARP (GARP).

Below frr logs on the Active Edge node shows the edge has failed over.

root@edge01:/var/log/frr# grep -ai "ADJCHANGE" frr.log
<Date&time> BGP: %ADJCHANGE: neighbor ##.##.##.##(Unknown) in vrf default Down BGP Notification received
<Date&time> BGP: %ADJCHANGE: neighbor ##.##.##.##(Unknown) in vrf default Up

GARP reply are received from the firewall on the standby Edge node syslog.log.

<Date&time> edge02 NSX 3733 - [nsx@6876 comp="nsx-edge" subcomp="datapathd" s2comp="arp" level="INFO"] GARP reply reveived for ##.##.##.## from <MAC> on lrouter port <UUID>
<Date&time> edge02 NSX 3733 - [nsx@6876 comp="nsx-edge" subcomp="datapathd" s2comp="arp" level="INFO"] GARP reply reveived for ##.##.##.## from <MAC> on lrouter port <UUID> 
<Date&time> edge02 NSX 3733 - [nsx@6876 comp="nsx-edge" subcomp="datapathd" s2comp="arp" level="INFO"] GARP reply reveived for ##.##.##.## from <MAC> on lrouter port <UUID> 
<Date&time> edge02 NSX 3733 - [nsx@6876 comp="nsx-edge" subcomp="datapathd" s2comp="arp" level="INFO"] GARP reply reveived for ##.##.##.## from <MAC> on lrouter port <UUID> 

Environment

VMware NSX

Cause

The NSX Edge nodes broadcast GARP packets correctly during failover and failback operations. The upstream physical device fails to update its ARP table with the correct MAC address for the Edge HA VIP, retaining the MAC of the standby node instead.

Resolution

1. Verify the GARP transmission from the NSX Edge node by checking logs during the failover event.
2. Inspect the ARP table of the upstream physical device to confirm if it holds the correct MAC address for the HA VIP.
3. If the upstream device retains the old MAC, perform a manual clear of the ARP entry on the physical device to force an update.
4. If traffic is critical and the ARP update does not resolve the issue, place the standby Edge node into Maintenance Mode to force traffic to the active node.
5. Engage the network/firewall infrastructure team to analyze why the physical device is not processing incoming GARP updates.

Additional Information

Relevant KB articles:

Traffic interruption observed after NSX Tier-0-Gateway HA VIP failover from active to standby edge node
Traffic interruption during Edge upgrade due to physical switch GARP processing failure

Contact Broadcom support