NSX Load Balancer Virtual Server is down after VMware Aria Automation (vRA) migration from inline to one-arm topology

Products

• VMware NSX

Issue/Introduction

• VMware Aria Automation (vRA) nodes have been migrated to a new network segment (NSX VLAN portgroup - Connected Gateway showing T0 connection), and a new NSX Load Balancer (LB) has been configured to support the transition.
• A change was made to the IP addresses of the vRA backend nodes
• The designated load-balancer's VIP/FQDN is unreachable, and the web page fails to open.
• The backend server pool members are reachable from external networks.

Environment

VMware NSX

VMware Cloud Foundation (VCF)

Cause

This connectivity failure occurs due to one or more of the following reasons:

• The Tier-1 gateway in use by the Load Balancer is connected to a Tier-0 gateway (one-arm topology does not require a Tier-0 connection).
• The Tier-1 Gateway does not have a Service Interface configured.
• The NSX VLAN segment has a subnet specified in the Subnets field.
• The Tier-1 gateway does not have a static route to forward traffic to the Next-Hop, which is the default gateway of the VLAN.
• Next-Hop of the Tier-1 static route does not have a scope defined.

Resolution

To resolve these routing and interface misalignments, apply the following configuration changes:

1. Detach the Tier-0 gateway from the Tier-1 gateway associated with the Load Balancer.
   
   
2. Segment Cleanup:
   • Navigate to the VLAN segment configuration in NSX: Networking > Segments > Click on the Three Dots > Edit.
   • Remove any manually defined subnet in the Subnets field.
   • Ensure the Connected Gateway field is left blank to avoid default routing conflicts on the segment level.
     
     
3. Add Service Interface to the Tier-1 Gateway.
   
   
4. Configure the static route and Next-Hop Scope:
   • Navigate to Networking > Tier-1 Gateways and select the gateway hosting the Load Balancer
   • Under Static Routes, click Add Static Route
   • Configure a default route (0.0.0.0/0)  to ensure traffic is correctly routed out of the segment
   • Set the Next-Hop IP address (usually Default Gateway of the segment) and ensure the Scope matches the Tier-1 gateway Interface in question (Service Interface).
     
5. Verification:
   • Perform a connectivity test to the Load Balancer VIP to confirm accessibility.
   • Verify within the NSX user interface that the Load Balancer virtual server status is 'Success'

Additional Information

Load Balancer Topologies

Troubleshooting NSX Native Load Balancer

NSX Load Balancer Configuration Not Working for VCF Operations Cluster

Static routes configured on a Tier-1 gateway are not reflected on the Edge node