Troubleshooting NSX Tier-0 Gateway Uplink and BGP/BFD Connectivity Issues

Products

• VMware NSX

Issue/Introduction

This article addresses connectivity failures for Tier-0 (T0) Gateway uplinks in VMware NSX environments, specifically during new deployments or upgrades. Symptoms typically include dynamic routing failures where BGP sessions fail to establish or fast-convergence path detection (BFD) fails despite established BGP sessions.

Environment

VMware NSX

Cause

The issue typically stems from configuration mismatches or network-level blockages at different protocol layers:

1. BGP Layer (TCP 179): The BGP finite state machine cycles between Active and Connect when the Edge node initiates the TCP handshake but receives no response. This indicates Layer 3 reachability issues, incorrect neighbor parameters (AS numbers, IPs), or a firewall/ACL blocking TCP port 179.
2. BFD Layer (UDP 3784/4784): BFD failures despite established BGP sessions occur when UDP control packets are dropped or misconfigured. This is often caused by mismatched BFD timers/multipliers or intermediate firewalls blocking UDP port 3784 (single-hop) or 4784 (multi-hop).

Resolution

1. Verify BGP Neighbor Status

Log in to the NSX Edge node CLI and verify the status of the Tier-0 Service Router (SR):

           get logical-router
           # Identify the T0-SR VRF ID, then enter the VRF context:
           vrf <vrf ID>
           get bgp neighbor summary

• If State is Active/Connect: Proceed to Section 2 (BGP Troubleshooting).
• If State is Established but BFD is DC/DW: Proceed to Section 3 (BFD Troubleshooting).

2. Troubleshoot BGP Connectivity (Active/Connect State)

• Layer 3 Reachability: Perform a ping from the Edge uplink interface to the remote BGP peer IP.
• Confirm that the following parameters match exactly on both the NSX Edge and the physical ToR:
  • Neighbor IP address
  • Local and Remote Autonomous System (AS) numbers
  • BGP Password/MD5 authentication (if used)
• Port Validation: Ensure that no physical firewalls or router ACLs are blocking TCP port 179.

3. Troubleshoot BFD Connectivity (DC/DW State)

• Peer Configuration: Verify that BFD is explicitly enabled on the physical ToR interfaces facing the NSX Edges.
• Timer Alignment: Ensure BFD timers (Receive, Transmit, and Multiplier) are identical or compatible across both ends.
• UDP Port Validation: Confirm that UDP port 3784 (for single-hop BFD) or UDP port 4784 (for multi-hop BFD) is permitted through all intermediate network segments.

Additional Information

 Troubleshooting NSX BGP