VPC Subnet creation fails with NSX error 520034 in VCF Automation

Products

• VCF Automation
• VMware NSX

Issue/Introduction

When attempting to create a subnet within a Virtual Private Cloud (VPC) in VCF Automation, the process fails during the Subnet Custom Resource (CR) processing. This typically occurs when using Private TGW access mode with manual CIDR allocation.

The following error is observed in the VCF Automation:
Error occurred while processing the Subnet CR. Please check the config and try again. Error: nsx error code: 520034, message: CIDR #### does not belong to IpAddressBlocks path=[/orgs/default/projects/####/infra/ip-blocks/####]

The IP subnet is also not visible in the NSX Manager UI

Environment

VCF Automation 9.x
VMware NSX 9.x

Cause

The issue is caused because when creating a Private TGW Access Mode in a VPC and the relevant VPC still contains the “Private - VPC” IPv4 CIDRs of the same values. 

Resolution

In order to address the issue, when implementing a subnet with Access Mode = “Private - TGW” remove the subnet CIDRs from the VPCʼs “Private IP CIDR” property and the steps are as mentioned below

• Open the tenant org
• Navigate to Build & Deploy>Network to view the subnet in error. 
• Click the subnet name to view the error details
• Navigate to Manage & Govern>Networking>Virtual Private Clouds
• Edit the relevant VPC.
• Remove any CIDRs in the “Private - VPC IPv4 CIDRs” property. We are no longer using Private VPCs. Press Save to save the changes.
  IMPORTANT: Always test queries or command updates first in a non-production environment. Take a backup before implementing in production. This operation cannot be undone verify every parameter before running.
  
• You now need to assign the subnet CIDRs to the TGW. (Navigate to Manage & Govern | Networking | IP Management)
• The respective TGW needs to have the subnet CIDRs added.