Troubleshooting NSX Transport Node Degradation and Tunnel Failures Due to VDS Uplink Misconfiguration (VMware NSX)

Products

• VMware NSX

Issue/Introduction

This article outlines the troubleshooting steps for identifying and resolving NSX Transport Node (TN) degradation and vTEP tunnel failures. The issues typically manifest when an ESXi host's NSX TEP (Tunnel Endpoint) interface is assigned to a Distributed Virtual Switch (VDS) that lacks physical uplinks, often following a DVS port group extension or infrastructure reconfiguration.

Symptoms

• NSX Manager: Transport nodes or ESXi hosts report "Degraded" status or "In-active" in the System > Fabric > Nodes dashboard.
• Connectivity: Virtual Machine (VM) overlay networking connectivity is lost or intermittent.
• Tunnel Status: vTEP tunnels display as "Down" when checked via NSX Manager or CLI.    

   

• Errors: Logs may indicate BFD (Bidirectional Forwarding Detection) session timeouts or inability to communicate with peer TEPs.
  
  
• Alarms: TEP:vmk10 of VDS:###-#####-####-###-####-##-vds-## at Transport node:00####-####-####-####-######. Overlay workloads using this TEP will face network outage. View Runtime Details
  
  
  

Environment

VMware NSX

Cause

The TEP VMkernel interface (e.g., vmk10) is incorrectly assigned to a VDS switch that does not possess assigned physical uplinks. While management VMkernels may reside on a correctly configured switch (with uplinks), the NSX TEP traffic fails to egress the host because the host lacks a physical data path on the assigned TEP switch.

Resolution

Step 1: Identify the Affected Switch

1. Access the vCenter UI and navigate to Networking > Switches.
2. Review the VDS configuration for the affected ESXi host.
3. Cross-reference the TEP VMkernel (e.g., vmk10) assignment with the switch uplinks.
4. Confirm if the switch associated with the TEP interface has zero active uplinks configured.

Step 2: Verify Tunnel Reachability (CLI) Log in to the affected ESXi host via SSH and run the following commands to confirm tunnel status:

• Check BFD sessions: nsxdp-cli bfd sessions list (Look for sessions in "Down" state or missing expected peer TEP IPs).
• Test Layer-3 connectivity: vmkping -I vmk  (Replace vmk with the TEP interface ID and  with a peer host's TEP IP).

Step 3: Reconfigure Transport Node

1. Identify the correct VDS: Determine which VDS has active, healthy physical uplinks.
2. Update TEP Mapping: In the NSX Manager, reconfigure the Transport Node to align the TEP interface with the functional VDS switch.
3. Re-synchronize:
   • If configuration changes do not immediately restore connectivity, remove the affected ESXi host from the Cluster.
   • Re-add the host to the cluster to trigger a fresh NSX transport node configuration (ensuring it inherits the correct Uplink Profile and Transport Zone settings from the cluster).

Step 4: Post-Resolution Verification

• Verify that TEP interfaces are showing "Up" in the NSX Manager UI.
• Confirm VM networking is restored by performing a ping test between VMs across different hosts.
• Check that BFD sessions are in the "Up" state via nsxdp-cli bfd sessions list.