2V0-41.24 Question 444
Single answerAn administrator is troubleshooting a connectivity issue in an NSX-T Data Center environment. Virtual machines in a specific segment are unable to communicate with each other. The administrator verifies that the VMs are on the same subnet, and the segment is attached to a Tier-1 Gateway. What should the administrator check next to identify the root cause?
- A
Verify that the segment is attached to the correct logical port group.
- B
Check the firewall rules associated with the Tier-1 Gateway.
- C
Ensure that the Edge Node has a valid BGP configuration.
- D
Verify the Distributed Firewall rules applied to the segment.
Show answer and explanation
Correct answer: D
Explanation
In NSX-T, communication issues between VMs on the same segment often result from Distributed Firewall (DFW) rules. The DFW operates at the vNIC level and can block traffic even within the same subnet or segment. By verifying the DFW rules associated with the segment, the administrator can identify and resolve any rule that might be denying traffic. The other options either do not apply to NSX-T troubleshooting or are not relevant to the described issue.
- A. Incorrect.
Logical port groups are not applicable in NSX-T environments, as they are specific to vSphere Distributed Switches. This option is irrelevant to the scenario.
- B. Incorrect.
Firewall rules on the Tier-1 Gateway do not impact communication between VMs on the same segment. This option does not address the issue.
- C. Incorrect.
BGP configuration on the Edge Node is relevant for external connectivity but not for intra-segment VM communication. This option is not related to the problem.
- D. Correct.
Distributed Firewall rules can block communication even on the same segment. Ensuring that there are no restrictive rules applied to the segment is the correct step to troubleshoot the issue.