VM no network connection after migration to another host

[pelzi71]

Hi,

I have a strange problem on my ESX 5.5 enviroment. I use 2 nearly identical servers as esx hosts. There is only a little differenz on network configuration. The esx1 has only one vSwitch conneted with 8 1 GB nics with ip-hash tunk to our cisco sg500x switch stack. The esx2 has a second vSwitch2 connecting via vpn to a automation network the rest of the 8 nics is also connected to the office lan the same way like esx1. I don't know since when this happens, but after I migrate a virtual machine from esx1 to esx2 the vm gets no access to the network through the vSwitch.

Inside the vm everything looks fine, a connected lan adapter is shown. But I get no ip from dhcp or can't ping to other pc or vm when a static ip is set. Inside the vm I can ping the static ip-address and the loopback device.

So it seems the vSwitch is not passing the network traffic for the vm. If I migrate back to esx1 everything works fine again. There should enough ports on the vSwtich (120 configured) when 10 vm's are connected.

I have no idea how to find the problem. What can I do to find and eliminate the problem?

[Kisan_VMware]

Hi,

Check if you have selected correct Vlan or n/w when machine moved to 2nd esxi host, also check working compare working VM network settings and migrated vm n/w setting matching. If it is windows VM check windows firewall is off.

[pelzi71]

Hi Kisan,

I compared all network settings with other working vm. The windows firewall is disabled, but no network connetion.

[AmzSannegowda]

Hi pelzi,

Right click on the VM which is not showing any network.

Click on edit settings

go to network adapters.

In network connection drop down see if its blank.If so please select your configured network from the drop down.

Let me know if it solves or answers your query.

Thanks,

Amz

[pelzi71]

Hi AmzSannegowdaAmzSannegowda,

In network connection drop down see if its blank.If so please select your configured network from the drop down.

of course I checked that. It is a "strange" problem.

Yesterday I renamed the network connection names on vSwitch1 from VM Network to ESX1-Office and ESX2-Office.

Then I migrated the problematic vm back to esx1, changed the nic to connect to ESX1-Office and started the vm. Everything worked fine.

I' migrated it back to esx2 and changed the nic to connect to ESX2-Office network.But still no connection.

It seems that the esx-firewall on esx2 is blocking that nic, but I don't know in the moment how to disable that.

[Rajesh Petchimuthu]

You may need to check for the VLAN configurations in the physical switch. Try if you can mark the ports where esx2 is connected to trunk port.

Check for the physical nic stats(sent and receive packets/bytes)  using below command

#esxcli network nic stats get -n vmnicX

Also refer to some of the useful KBs -http://kb.vmware.com/kb/1003728 and VMware KB: Troubleshooting network and TCP/UDP port connectivity issues on ESX/ESXi

[pelzi71]

Hi,

thank you for your suggestion.

The problem is due to the physical switch. I've found the following in my swich log:

2147366351     2015-Sep-16 12:05:02    Warning     %2SWPORT-W-LOCKPORTACTIVE: A packet with source MAC 00:50:56:ab:25:9a tried to access through port Po2 which is locked, aggregated (1)

The MAC is the address of the virtual machine not getting the network connection.

At this time I don't know what to do with this informatoin. If you know what the problem is and how to solve would be nice to give me an idea on this.

I try to ask google for an answer.

[pelzi71]

I've found out that there is a newer firmware for my cisco switch available.

I also created a ticket at cisco support.

Let's see what happens.

[Kisan_VMware]

Hi,

Assign a MAC Address to a Virtual Machine Manually

You can assign a MAC address manually if you need to ensure that the same MAC address is always assigned to the virtual network adaptor for a virtual machine.

  

Assign a MAC address manually instead of allowing VMware Fusion to assign it to be sure that the following situations occur:

■	The same MAC address is always assigned to the virtual network adaptor for a given virtual machine, even if the virtual machine is moved.
■	A unique MAC address for each virtual machine within a networked environment

When a physical machine is converted to a virtual machine, the MAC address of the network adapter is changed. For software in which the licensing is linked to the MAC address, this can be a problem. Manually assigning the correct MAC address is the solution.

Prerequisites

Shut down or power off the virtual machine. You cannot change the setting while the virtual machine is powered on or suspended.

Procedure

1	From the VMware Fusion menu bar, select Window > Virtual Machine Library.
2	Select a virtual machine and click Settings.
3	Under Removable Devices in the Settings window, select Network Adapter.
4	Click Advanced options .
5	Enter a new MAC address. ■ Type a known MAC address. or ■ Click Generate for VMware Fusion to create a unique address.

[Kisan_VMware]

Hi

Ignroe previous post follow the below to generate or change mac address on VM.

Change the MAC Address for a Virtual Machine

  

You can use advanced virtual network adapter settings to assign a new MAC address to a virtual machine.

Note

You cannot configure advanced virtual network adapter settings for a shared or remote virtual machine.

Procedure

1	Select the virtual machine and select VM > Settings.
2	On the Hardware tab, select the virtual network adapter and click Advanced.
3	Type a new MAC address in the MAC Address text box, or click Generate to have Workstation generate a new address.
4	Click OK to save your changes.

[pelzi71]

Thank you Kisan,

just before I had contact to cisco support. The problem on my switch could be caused by a firmware bug. Changing the MAC of the vm could also solve the problem, but first I will install the latest firmware an my switch and see if this is the main solution.

The vm was working on this host and this mac before - may be the last firmware-update of the switch - and there should be no reason to change the mac.

I will see what will happen tomorrow.

[Kisan_VMware]

Ok, that's great, hope firmware update will fix the issue, in case not work out, you can try this option.

[bansne]

Did you checked if that VLAN is allowed at host profile over Virtual Connect?

[pelzi71]

Hi,

this morning I could fix my problem by myself using the well known search engine.

I've found this:

PORT-W-LOCKPORTACTIVE- Sw ESW 520 | LAN, Switching and Routing | Cisco Support Community | 6016 | 11662891

The whole descrption is to find here, but it is in german:

http://www.administrator.de/content/detail.php?id=283025&token=713#comment-1039572

So I will give a little summary in my poor english.

It seems like this. If you create a lag trunk on that switch (cisco sg500x),  a dynamicly port security policy is generated automaticly.:smileyshocked:

You can see that if you going to Security -> Port Security  and set the filter to the LAG ports.

By default the ports are generated with standard values:

2 LAG 2 Locked Limited Dynamic Lock 10 Discard Enabled 60

3 LAG 3 Locked Limited Dynamic Lock 10 Discard Enabled 60

Where 10 and Limited Dynamic means that the port closes after 10 dynamicly learned MAC addresses. So if this threshold is reached all new MAC's are  blocked. That was the problem in my case.

I did a test by disabling the policy for LAG2 and suddenly a network connection of my problematic vm was possible. So I thought disabling is not a good bractise and I re- enabled the rule and increased the number of MAC to 25 - a good value for my setup.

2 LAG 2 Locked Limited Dynamic Lock 25 Discard Enabled 60

3 LAG 3 Locked Limited Dynamic Lock 25 Discard Enabled 60

After I had re-enabled that rule, I migrated another vm with the same problem before.

With the new value everything works fine now.:smileyhappy::smileyhappy:

[bansne]

Hmm this is interesting! Thanks for the share..Probably have to study on this :smileyhappy:

[Kisan_VMware]

Good, So finally issue resolved!

[sagarmaru]

Even i face the same issue.