ESXi host unreachable on network due to upstream switch PVST/RPVST STP blocking state.

Products

• VMware vSphere ESXi

Issue/Introduction

• After a routine maintenance reboot, the ESXi host becomes unreachable on the management network.

• Outbound packets (such as ARP requests) are successfully transmitted from the active uplink (vmnic0), but no return packets are received.

• Traffic captures via pktcap-uw on the ESXi host show outbound ARP requests without any associated responses.

• On the upstream physical switch (e.g., Aruba 6300M), no MAC addresses are learned on the ports connected to the ESXi host.

• Switch packet captures indicate that ARP requests reach the switch but receive no response.

• Switch ports are stuck in a Disabled Blocking spanning tree state despite being configured as Admin Edge.

Environment

VMware vSphere ESXi

Cause

A malfunction in the upstream physical switch's PVST/RPVST process (e.g., hpe-pvstd on Aruba AOS-CX switches) incorrectly maintains the interfaces in a blocking state. This prevents MAC address learning and blocks inbound return traffic to the ESXi host.

Resolution

Identify and Mitigate from the ESXi Host: To confirm the traffic imbalance and temporarily restore connectivity by forcing a failover:

1. Enable VLAN statistics for the affected vmnic: esxcli network nic vlan stats set -e true -n vmnic0

2. Review the statistics to confirm packets are sent but not received: esxcli network nic vlan stats get -n vmnic0 (or localcli network nic vlan stats get -n vmnic0)

3. Administratively bring down the affected vmnic to force failover to the standby adapter: esxcli network nic down -n vmnic0

4. Once network connectivity is restored on the standby adapter, you can bring the original vmnic back up for further testing: esxcli network nic up -n vmnic0

5. Disable VLAN statistics once troubleshooting is complete: esxcli network nic vlan stats set -e false -n vmnic0

Resolve on the Upstream Physical Switch (Example for Aruba AOS-CX): To immediately restore traffic and MAC address learning on the affected ports, restart the spanning tree process on the switch:

1. Access the switch command line and start the shell: start-shell

2. Switch to the root user: sudo su

3. Find the PID for the PVST process: ps -aux | grep pvstd

4. Kill the process to force it to restart: kill -9 <PID>

5. Verify the ports have transitioned to a forwarding state: show spanning-tree vlan <VLAN_ID>

Note: A permanent resolution requires upgrading the physical switch firmware to a version containing the fix for this PVST/RPVST defect (e.g., version 10.13.1180 or a subsequent major upgrade).