An administrator is troubleshooting why workloads in NSX cannot reach the external network 10.100.0.0/16. The Tier-0 Gateway is in Active/Active mode and has the following configuration: - Uplink-1…

Question

Options

• AStatic routes do not support Equal Cost Multi-Pathing (ECMP) in NSX.
• BThe static route Scope is set to only one uplink interface, but the next-hops are on two different
• CThe next-hops should have been configured as the Tier-0's own uplink IPs instead of the routers
• DThe physical routers are missing return routes.

• A
  5% (1)
• B
  82% (18)
• C
  9% (2)
• D
  5% (1)

Explanation

Troubleshooting routing in a VMware Cloud Foundation (VCF) environment requires a deep understanding of how the NSX Tier-0 Gateway processes forwarding entries. In an Active/Active configuration, the Tier-0 gateway is designed to utilize ECMP (Equal Cost Multi-Pathing) to distribute traffic across multiple paths to the physical network. The specific failure described--where a traceroute fails at the Tier-0 with "Destination Net Unreachable" despite the Edge nodes having basic ping connectivity to the routers--points toward a routing table entry error rather than a physical connectivity issue. In NSX, when a static route is created, an administrator has the option to set a "Scope." The Scope explicitly tells the NSX routing engine which interface should be used to reach the defined next-hops. In this scenario, the administrator has defined two next-hops (R1 and R2) but has restricted the scope of the static route to Uplink-1 only. Because R2 (192.168.101.1) is on a different subnet/VLAN (VLAN 101) that is associated with Uplink-2, the Tier-0 gateway cannot resolve the next-hop for R2 via Uplink-1. Furthermore, if the gateway detects an inconsistency between the defined next-hop and the scoped interface, it may invalidate the route or fail to install it correctly in the forwarding information base (FIB) for the service router. According to VMware documentation, the Scope should typically be left as "All Uplinks" or carefully matched to the interfaces that have Layer 2 reachability to the next-hop. By scoping it to only Uplink- 1, the router R2 becomes unreachable for that specific route entry. Even for R1, if the hashing mechanism of the Active/Active Tier-0 attempts to use a component of the gateway not associated with that scope, the traffic will fail. The error "Destination Net Unreachable" at the Tier- 0 hop confirms that the Tier-0 has no valid, functional path in its routing table for the 10.100.0.0/16 network due to this scoping conflict.

No community discussion yet for this question.