VM Connectivity Issues Due to Incorrect Traffic Filtering Rules

Products

• VMware vSphere ESXi

Issue/Introduction

• Virtual machines lose network connectivity intermittently.
• Packet drops occur for essential non-IP traffic (e.g., ARP, ICMP).
• ICMP echo requests are randomly not answered by a virtual machine
• Packet traces/captures at VM switchport point confirm ARP replies are sent by the VM and being dropped before arriving at the team uplink/vmnic.
• Looking at the port config via "net-dvs -l" command on the ESXi host you see the option "dvfilter-generic-vmware.ruleset" set

Environment

VMware vSphere ESXi

Cause

Traffic filtering rules on the Distributed Port Group are configured only for IPv4.
Essential MAC based communication (required for ARP) is blocked.

Resolution

• Review and update the traffic filtering and marking policy for the VM's port group.
  Example UI location (Navigate to vDS -> portgroup -> Configure -> Traffic filtering and marking):
  
• Ensure both MAC, IPv4 and other rules are applied to allow the needed traffic.
• Use packet captures to confirm ARP and traffic are processed and not dropped by the filter.
  
  

Additional Information

Using Packet capture on ESXi using the pktcap-uw tool
What is Traffic Filtering and Marking Policy