VMware NSX IPsec VPN Tunnel Fails to Establish When Using Loopback Interface as Responder

Products

• VMware NSX

Issue/Introduction

An IPsec VPN tunnel fails to establish in VMware NSX when the local endpoint is configured on a loopback interface and the NSX Edge is set to responder mode.

Symptoms:

• IPsec VPN tunnel status remains down.
• No active IKE or IPsec security associations (SA) are visible in the CLI outputs (get ipsecvpn ikesa and get ipsecvpn ipsecsa).
• Packet captures on the NSX Edge node uplink show no incoming IKE traffic from the remote peer.
• VPN session status shows as "No IKE negotiation"
• Tunnel would come up if the IPSec VPN is configured to be also initiator

Environment

VMware NSX

Cause

The tunnel failure is caused by a lack of initiation from the remote peer. When migrating an existing IPsec VPN configuration from a Virtual IP (VIP) to a loopback interface as the local endpoint, the remote peer may fail to initiate the IKE negotiation if the configuration update results in a mismatch or stale phase 1 parameters.

 

Resolution

To resolve this issue, ensure that the remote peer is correctly configured to initiate the IKE negotiation toward the new loopback address of the NSX Edge.

1. Verify Configuration: Ensure the local endpoint IP on the NSX Edge is correctly set to the loopback interface IP.
2. Review Remote Peer Configuration: Confirm the remote peer is configured to use the loopback IP as its destination for the IKE negotiation.
3. Force Re-negotiation: Manually trigger the remote peer to re-initiate the IKE Phase 1 negotiation.
4. Validate Connectivity: Run the following commands on the NSX Edge CLI to monitor the status:
    

   get ipsecvpn ikesa
   get ipsecvpn ipsecsa

5. Confirm Traffic: Perform a packet capture on the NSX Edge uplink to verify that IKE packets are arriving from the peer.

Additional Information

Troubleshooting IPsec VPN in VMware NSX