Edge Transport Node configuration status shows as "FAILED" intermittently

Products

• VMware NSX

Issue/Introduction

• Edges show Configuration State: Failed
• You are utilizing a monitoring / proxy appliance placed in-line between the Edges / NSX managers management gateway.
• Edge is connected to managers/controllers and ports 1234/1235 are open as seen from Edge CLI:
  get controllers
Tue Jul 28 2026 UTC HH:MM:SS.MS
 Controller IP    Port     SSL         Status       Is Physical Master   Session State  Controller FQDN   Failure Reason
 ###.##.##.###    1235   enabled     connected             true               up               NA               NA
 ###.##.##.###    1235   enabled      not used            false              null              NA               NA
 ###.##.##.###    1235   enabled      not used            false              null              NA               NA
get managers
- ###.##.##.###    Connected (NSX-RPC)
- ###.##.##.###    Connected (NSX-RPC)
- ###.##.##.###    Connected (NSX-RPC) *
nc -zv <NSX_Manager_IP> 1234
nc -zv <NSX_Manager_IP> 1235
Connection to <IP> 1235 port [tcp/*] succeeded!
  
  
• If you click on the failed status in the UI you will see:
  Host configuration: Failed to send the HostConfig message.
[TN=TransportNode/########-####-####-####-############]. Reason: Failed to send HostConfig RPC to MPA TN:########-####-####-####-############
Error: Unable to reach client 659720c5-6264-4a48-adOf-9c09154eOdbc, application SwitchingVertical.
• In the Edge syslog:
  YYYY-MM-DDTHH:MM:SS.MS+HH:MM [FQDN] NSX 3943 - [nsx@6876 comp="nsx-edge" subcomp="nsx-proxy" >s2comp="nsx-net" tid="7689" level="WARNING"] StreamConnection[6342 Connecting to ssl://###.##.##.###:1234 sid:6342] >Couldn't connect to 'ssl://###.##.##.###:1234' (error: 110-Connection timed out)
YYYY-MM-DDTHH:MM:SS.MS+HH:MM [FQDN] NSX 3943 - [nsx@6876 comp="nsx-edge" subcomp="nsx-proxy" >s2comp="nsx-rpc" tid="7689" level="WARNING"] RpcConnection[6342 Connecting to ssl://###.##.##.###:1234 0] Couldn't >connect to ssl://###.##.##.###:1234 (error: 110-Connection timed out)
• In /var/log/kern.log on NSX manager at time of the issue, the SRC IP is the IP of the monitoring / proxy appliance instead of the Edge management IP and we see the connection is being dropped due to connection limit being exceeded:
  YYYY-MM-DDTHH:MM:SS.MS+HH:MM ##### kernel - - - [2273644.607472] Dropped per conn limit: IN=eth0 OUT= >MAC=##:##:##:## SRC=###.##.##.# DST=###.##.##.### LEN=52 TOS=0x00 PREC=0x00 TTL=63 >ID=<ID> DF PROTO=TCP SPT=38436 DPT=1234 WINDOW=64240 RES=0x00 SYN URGP=0
  
  
• In /var/log/syslog.log for sub-component appl-proxy on a Manager, you see the UUID of the affected Edge to be status down, and when it recovers it will show status up:
  YYYY-MM-DDTHH:MM:SS.MS+HH:MM Z ##### NSX 73414 - [nsx@6876 comp="nsx-manager" subcomp="appl-proxy" tid="73414" >level="INFO"] TnConnMgr: OnServerConnectionUpDown: ConnInfo:{id: 1423, pr: normal, remote endpoint ids:[<Edge-UUID>], ... peer-ep: ssl-tcp://###.###.###.###:36714, ...} Status:Down
YYYY-MM-DDTHH:MM:SS.MS+HH:MM Z #### NSX 73414 - [nsx@6876 comp="nsx-manager" subcomp="appl-proxy" tid="73414" >level="INFO"] TnConnMgr: OnServerConnectionUpDown: ConnInfo:{id: 1469, pr: normal, remote endpoint ids:[Edge-UUID>]... peer-ep: ssl-tcp:////###.###.###.###:33686, ...} Status:Up

Environment

VMware NSX 9.x
VMware NSX 4.x
VMware NSX-T Data Center 3.x

Cause

An iptables connection limit (connlimit) rule on the NSX Manager firewall restricts incoming traffic to a maximum of 10 concurrent connections per source IP address.

When a monitoring tool or proxy appliance is positioned between the NSX Edges and NSX Managers, it forwards all Edge requests using its own source IP rather than preserving the original Edge IP addresses. As a result, the 10-connection limit is exceeded, causing the firewall to drop incoming TCP SYN packets on port 1234 (LOG_DROP2).

This can also be caused by NAT being performed.

Resolution

Using a proxy appliance for Edges or host transport nodes to connect to NSX Managers is unsupported. NAT is also not supported on the management network.

Validate with the vendor of the monitoring / proxy appliance if any preserve client IP setting is available, which would forward the Edge management IP to the NSX manager instead of the monitor appliance's source IP.

Note:
It is not recommended to restart the NSX Managers as workaround. Restarting NSX Managers will cause all connected Transport Nodes to reconnect on port 1234, which will result in the connection limit being reached again.

Subscribe to this article to be updated on future enhancements. See How to subscribe to Knowledge Base Articles.