Workload Domain Creation Fails at NSX Edge Deployment
A new VI workload domain with four hosts is being created in VCF 5.0. Host commissioning and vCenter deployment succeed. NSX Manager deploys and is reachable, but edge cluster deployment fails after 30 minutes. The SDDC Manager task reports 'Edge node deployment failed: no free IP address in TEP pool'. The network pool's TEP range is 172.16.50.0/29, with .1 as the gateway. The domain is configured for a two-node edge cluster. VLAN 250 is allowed on the top-of-rack switch ports for the edge uplinks, but the edge nodes' VLAN 251 is not in the allowed list. The domain is marked Failed in SDDC Manager, and the customer wants to delete it immediately and start over.
1. Calculate the TEP pool capacity and identify all blockers shown in the setup.
Read the worked answer
A /29 has 8 addresses. Remove the network and broadcast addresses, leaving 6 usable. Because .1 is the gateway, only 5 addresses remain for hosts and edge nodes.
The design needs four host TEP addresses plus two edge-node TEP addresses, for six addresses. The pool provides five, so the edge deployment runs out of addresses. That explains the SDDC Manager error.
There is also a second blocker: VLAN 251 is not allowed on the top-of-rack ports. Even with a larger TEP pool, the edge nodes would fail to deploy or join. Expand the TEP range to at least /28, or add a new range in the same VLAN, and allow VLAN 251 with the required MTU before retrying.
2. What recovery sequence would you follow for the failed domain? Should the customer delete it immediately?
Read the worked answer
Do not delete immediately. First collect the SDDC Manager task logs, NSX Manager logs, and edge deployment logs, and inventory any orphaned NSX Manager, edge VMs, DNS records, and IP allocations. Fix the underlay first: expand the TEP pool, allow VLAN 251, verify MTU, DNS, NTP, and edge uplink reachability.
If SDDC Manager offers a retry for the failed edge deployment, retry after the fixes. If retry is not supported for that failure point, delete the failed domain through SDDC Manager, confirm cleanup of orphaned objects and host return to the free pool, then redeploy. Deleting before collecting evidence and fixing the underlay usually reproduces the same failure.
3. If the edge nodes power on but never join the NSX management plane, what would you check?
Read the worked answer
Check DNS forward and reverse resolution for the edge node names, NTP synchronization, and MTU 9000 on the TEP and uplink paths. Verify TEP reachability between hosts and edge nodes, controller connectivity, and that VLAN 251 is trunked on every required switch port. Confirm certificates are valid and that firewall rules permit the edge-to-controller and edge-to-manager traffic. Also verify the edge nodes received the correct management IP, gateway, and TEP configuration. Powering on is not proof that the data plane or management plane is reachable.