Check whether the Tier-1 advertises the connected segment to Tier-0, then check how the physical network routes back to that subnet. A VM reaching its local gateway does not establish either relationship. A Tier-0 default route toward the physical router supplies an outward path; it is not a return route on that router.
This article uses the NSX 4.2 static-routing example in Configure Gateways and Segments. No NSX or physical-network configuration was inspected or changed for this source-only research, and no connectivity test was performed.
Understand the three routing boundaries
A segment is a logical switch to which VMs connect. In the reference design, its subnet gateway belongs to Tier-1. Tier-1 routes between its connected segments, while its linked Tier-0 provides the path toward the physical router.
The 4.2 guide enables All Connected Segments & Service Ports under the Tier-1's Route Advertisement. It separately configures physical-router routes for the workload subnets via Tier-0's external virtual address. Those are distinct control decisions. An existing Tier-1/Tier-0 link does not replace the advertisement choice, and advertisement inside NSX does not configure an unrelated physical router automatically.
Broadcom KB 409841 documents the corresponding symptom: VMs behind a particular Tier-1 cannot reach outside networks when the connected-segment advertisement is missing. That is a specific diagnostic candidate, not an explanation for every failed external connection.
KB 409841 describes the matching symptom as “Cannot ping outside networks or Google DNS from any of the VMs within segments when linked to a specific T1 gateway.” Treat that as a recorded symptom, not a request to send new pings. The route evidence below comes from the network owner’s existing route records; no newly verified Edge CLI command is supplied.
Inspect the intended topology
Prerequisites are authorised read access to the relevant NSX configuration, the exact NSX version, the VM's segment and subnet identity, and an existing physical-routing record from its owner. Use one affected subnet rather than changing every Tier-1.
In NSX Manager, identify the segment's connected gateway. Confirm that the observed VM gateway belongs to the intended subnet, then identify the linked Tier-0 on that Tier-1. Record the Route Advertisement choice under Networking → Tier-1 Gateways without saving any edit.
Compare that configuration with existing route evidence for the same prefix on Tier-0 and the physical router. Keep prefix length and next hop, not just an address that looks familiar. If no current route evidence is available, report that gap. Do not claim the route is installed merely because a desired configuration contains it.
For this static reference design, inspect the Tier-0 default route and the physical router's explicit route to the workload subnet. The guide's example addresses are illustrative; do not copy them into a real deployment. Dynamic routing, VRFs, NAT and overlapping networks introduce other decisions and are outside this article.
Worked diagnosis: find where the prefix disappears
Imagine a fictional segment app-net with subnet 10.60.10.0/24, connected to T1-Apps, which links to T0-Edge. Existing incident evidence shows that a VM reaches its local gateway. Tier-0 has a default route toward the physical router, but the workload prefix is absent from Tier-0's existing route record. The Tier-1 advertisement choice is disabled.
That sequence supports investigating the Tier-1 advertisement boundary. Changing a physical default gateway or broadening an application firewall rule would not explain the missing internal prefix. The proposed correction belongs to the routing design and needs to establish why the advertisement was disabled before changing it.
Now change the evidence: Tier-0 has the intended route to 10.60.10.0/24, but the physical router has no route back through Tier-0. The internal advertisement has done its part. The unresolved boundary is the physical return path. Repeatedly toggling the Tier-1 choice would not create that external route.
A third case has the correct prefix and next hop at every boundary. That does not prove the application works; it simply removes this particular missing-route explanation. Continue with the actual failed packet or service evidence rather than keeping the routing diagnosis after its premise has disappeared.
Plan only the relevant correction
Enabling advertisement changes which routes become reachable upstream. Adding a physical static route changes another device's forwarding decisions. Neither is a read-only test. The appropriate owners must review the intended prefixes, destination topology and impact before either change.
Do not enable every advertisement type or redistribute every route to repair one missing connected subnet. Keep the correction scoped to the diagnosed boundary. The quick-start guide demonstrates a coherent topology, not a universal production configuration to apply wholesale.
Acceptance and reversal
Diagnostic acceptance is a prefix-by-prefix explanation of where the route is present, absent or unverified, together with the effective Tier-1 advertisement and Tier-0 linkage. A separately authorised repair would need the correct route installed at each intended boundary and a controlled bidirectional application check. No such check has been performed here.
Inspection requires no rollback. For a future routing change, retain the previous prefix, next hop and advertisement values. Restoring configuration can remove reachability newly depended upon by other systems, so reversal needs the same topology review. It is not safe to delete an unfamiliar route merely because the original symptom has ended.
Learning notes
- Local gateway reachability does not prove upstream route advertisement.
- NSX advertisement and physical return routing are separate boundaries.
- Correct routes are necessary evidence, not complete application acceptance.
References
- A15-D1: Step 5: Configure Gateways and Segments
- A15-S1: North-South traffic for overlay segments not working via T1 gateway