Edge to Host Transport Node Overlay Tunnels Down Due to Blocked BFD/Geneve Ports (UDP 3784, 4784, 6081)

Products

• VMware NSX

Issue/Introduction

 

• Overlay tunnels between Edge Transport Nodes and Host Transport Nodes are failing to establish and show a status of DOWN.

• ICMP ping requests between Tunnel End Point (TEP) IP addresses succeed.

• Bidirectional Forwarding Detection (BFD) control traffic fails to traverse bidirectionally between transport nodes.

 

Environment

VMware NSX

Cause

Required NSX overlay traffic ports are blocked by intermediate physical firewalls, routers, or switches sitting between the Host TEP and Edge TEP subnets:

• UDP 6081: Geneve Encapsulation

• UDP 3784: BFD Control

• UDP 4784: BFD Echo

Although ICMP traffic is permitted across the TEP subnets, blocking these UDP ports prevents transport nodes from completing the bidirectional BFD handshake required to form overlay tunnels.

Resolution

physical network and security infrastructure team to ensure that the following UDP ports are explicitly allowed bidirectionally between all Host TEP and Edge TEP subnets:

• UDP 6081 

• UDP 3784 

• UDP 4784