An administrator is troubleshooting an issue where workloads connected to a Tier-1 Gateway named T1-App can no longer reach external North/South destinations. - The Tier-1 is connected to an…

Question

Options

• AThe overlay network between DR and SR has an MTU mismatch.
• BRoute advertisement from T1-App to T0-Prod for 100.64.x.x/31 is disabled.
• CStatic default route is missing on the Tier-1 DR component.
• DLocalized control plane is enabled on the Tier-1 causing the SR to remain admin-down.

• A
  71% (22)
• B
  10% (3)
• C
  3% (1)
• D
  16% (5)

Explanation

In the NSX multi-tier routing architecture used by VCF, a Tier-1 Gateway is composed of two primary components: the Distributed Router (DR) and the Service Router (SR). The DR runs as a kernel module on every ESXi host in the transport zone, facilitating East-West traffic. The SR resides on the NSX Edge nodes and provides centralized services like North-South connectivity and stateful services. Communication between the DR (on the ESXi host) and the SR (on the Edge node) occurs over a hidden internal segment known as the Router Link. This link is encapsulated in Geneve just like VM- to-VM traffic. When a VM attempts to reach an external destination, the packet is first routed by the DR on the local host. The DR then encapsulates the packet and sends it across the overlay to the TEP (Tunnel Endpoint) of the Edge node hosting the SR. If the MTU (Maximum Transmission Unit) is misconfigured on the physical network or the virtual switches, large encapsulated packets will be dropped. However, small packets (like pings between VMs on the same host) might still succeed. In this scenario, the fact that the VM can ping the local DR but cannot reach the SR--and therefore cannot reach external networks--points to a failure in the transport between the host and the Edge. If the Geneve-encapsulated packet containing the ping request to the SR's internal interface exceeds the physical network's MTU, it will fail. Since VCF 5.x/9.0 requires a minimum MTU of 1600 (ideally 9000) for the overlay to account for the Geneve overhead, a mismatch anywhere in the fabric will break the DR-to-SR "backplane" communication. This prevents the Tier-1 from passing any traffic to its Tier-0 uplink, effectively isolating the workloads from North-South traffic.

No community discussion yet for this question.