Troubleshooting NSX Edge BGP Peering Failures Due to Named Teaming Policy Mismatches

Products

• VMware NSX

Issue/Introduction

 In VMware NSX environments, traffic on specific VLAN segments may fail to traverse the expected physical uplink on an Edge node, potentially resulting in BGP peering or ARP resolution failures. This issue occurs when a VLAN segment is configured to use a named teaming policy that is not explicitly defined in the Edge node's applied Uplink Profile.

• BGP peering fails to establish on specific uplinks.
• ARP requests are received on the physical NIC (pNIC) but are dropped by the NSX datapath.
• Traceflow reveals packets are dropped due to "no routing" or incorrect logical-switch binding despite physical connectivity.
• Logical switch configuration on the Edge node shows segments bound to an incorrect fp-ethx device.
• A system generated Transport Zone is applied to a segment used for an edge logical router uplink. 
• Edpe Uplink Profile has a different name for the teaming policies than what is defined in the teaming policies for the Transport Zone applied to the segment. 

Environment

VMware NSX

Cause

The issue is caused by a configuration mismatch between the NSX Segment's expected teaming policy and the Uplink Profile applied to the Edge node.

1. Named Teaming Policy Mismatch: The VLAN segment is configured to use a named teaming policy (e.g., teaming-1 or teaming-2) inherited from a Transport Zone.
2. Profile Incompatibility: The Edge node is using an Uplink Profile that does not contain those specific named teaming policies (e.g., it might use teaming-uplink-1 and teaming-uplink-2 or similar).
3. Silent Fallback: Because the Edge node cannot resolve the requested teaming policy name to a defined uplink, the NSX datapath silently falls back to a default physical interface (often fp-eth0), causing traffic to be dropped or misrouted when it arrives on a different physical interface.

Resolution

This is a condition that may occur in a VMware NSX environment.

 

To resolve this, ensure the named teaming policies defined in the Segment's Transport Zone match the policies defined in the Edge node's applied Uplink Profile. When using a system generated Transport Zone where additional Uplink Teaming named policies cannot be added, you much use the same matching names for the named teaming policy.

1. Backup: Take a backup of the NSX Manager configuration before making changes.
2. Verify Logical Switch Mapping: Log in to the affected Edge node CLI as admin and run command: get logical-switches
   • Identify the Discrepancy: Check if the UUID for the problematic VLAN segment is bound to the incorrect DEVICE (e.g., it shows fp-eth0 when it should be fp-eth1).
3. Correct the Uplink Profile:
   • • In the NSX UI, navigate to System > Fabric > Profiles > Uplink Profiles.
     • Edit the profile assigned to the Edge node.
     • Under Teamings, ensure a Named Teaming Policy exists (e.g., teaming-2) and is explicitly mapped to the correct Active Uplink.
     • If a system generated Transport Zone is used (e.g., nsx-system-vlan-transport-zone), ensure the teamings are named teaming-1 and teaming-2. Alternatively, revert to a system generated Profile (e.g., nsx-edge-multiple-vteps-uplink-profile) if a system generated Transport Zone is used. 
     • If a non system generated Transport Zone is used, the new Teamings will need to be added to the Transport Zone: System > Fabric > Transport Zones
4. Align Transport Zone:
   • • Navigate to System > Fabric > Transport Zones.
     • Ensure the Uplink Teaming Policy Names list contains the exact name used in the Uplink Profile.
5. Re-verify: Run get logical-switches again on the Edge CLI as admin to confirm the segment is now pinned to the correct fp-ethx interface.

Additional Information

Edge Segments Fail to Pin to Uplinks Using Named Teaming Policies