NSX Bridging Example in Multi Datacenter Overlay Deployments

Products

• VMware NSX

Issue/Introduction

This KB article introduces an example scenario demonstrating how to configure NSX bridging to meet a specific multi data center (DCs) design requirement.

Consider this example below:

• There are two data centers with an NSX overlay segment stretched across both DCs.

• VMs connected to the overlay segment in both DCs can communicate with each other normally.

• Both DCs are managed by the same NSX Manager cluster.

• Each DC has its own physical VLAN network, and the design requires overlay VMs to communicate with physical workloads on those VLANs.

• The VLAN network communication is blocked across the DCs.

• To achieve this, there should be one NSX Edge node deployed in each DC and should belong to the same Edge Cluster, configured with NSX Edge bridging following the techdocs:
  
  https://techdocs.broadcom.com/us/en/vmware-cis/nsx/vmware-nsx/4-2/administration-guide/segments/edge-bridging-extending-overlay-segments-to-vlan.html

• After completing the configuration, the bridge functions in only one data center.

Below is an example network diagram that illustrates the issue.

 

 

Environment

VMware NSX

Cause

1. This behavior is expected because overlay traffic must be forwarded to the primary Edge node for bridging.
2. The Edge bridge profile supports only Active/Standby mode for high availability, meaning only the primary Edge performs bridging while the standby Edge remains idle.
3. In the example above, assume Edge 1 is the primary bridge node and Edge 2 is the standby, overlay traffic originating from VM2 is forwarded across the overlay network to Edge 1 in DC1, because it is the active bridging node.
4. Edge 1 then bridges the overlay traffic to the VLAN network in DC1. Since VLAN traffic is blocked between the two data centers, the bridged traffic cannot reach the VLAN network in DC2.
5. As a result, VMs are unable to communicate with physical workloads located on the VLAN in DC2.

 

Resolution

Workaround :- 

1. Create independent Edge clusters:
   Deploy two separate Edge clusters, each containing Edge nodes local to its respective data center (DC1 and DC2).

2. Define dedicated bridge transport zones:
   Create two bridge transport zones—one assigned to DC1 and one assigned to DC2.

3. Assign the correct transport zone to each Edge uplink:
   Ensure each Edge node uses the transport zone associated with its data center (e.g., DC1 Edge nodes use Bridge TZ1; DC2 Edge nodes use Bridge TZ2).

4. Create separate Edge Bridge Profiles:
   Build two Edge Bridge Profiles, mapping each profile to the corresponding Edge cluster. One profile using an active Edge node in DC1 and the other profile using an active Edge node in DC2.

5. Apply both profiles to the same overlay segment:
   Attach both Edge Bridge Profiles to the same overlay segment to enable bridging in across the DCs.\

Note:

• The same segment cannot be bridged twice on the same edge.
• The bridge does not have any loop detection or prevention. If you configure multiple bridges to the same bridging domain on the VLAN side it results in a permanent bridging loop.

https://techdocs.broadcom.com/us/en/vmware-cis/nsx/vmware-nsx/4-2/common-bridging-tasks.html