AVS Gen 2 HCX Configurations - Issues

Question

Question

Answer 1

Anonymous

Hello Shaik Nagulameera,

Thank you for sharing the detailed information about your environment.

Based on the case description, this behavior is typically associated with gaps in underlay connectivity or routing validation, which are critical for successful Service Mesh deployment.

Key considerations for Azure VMware Solution (AVS)

Networking within AVS is isolated from Azure IaaS constructs. Components such as Network Security Groups (NSGs) and Azure Firewall do not apply in the AVS private cloud. Traffic control within AVS is managed through NSX-T.
HCX Service Mesh tunnel establishment requires full bidirectional IP connectivity between:
- On-premises HCX appliance interfaces
- AVS HCX appliance management and uplink interfaces
This connectivity must be established over ExpressRoute with proper routing configured on the on-premises network.

Points to validate

Even when ICMP and HTTPS checks succeed, HCX tunnels may still fail if the following are not fully aligned:

ExpressRoute routing:- Ensure that: a. Routes to HCX Management and Uplink subnets in AVS are correctly advertised to on-premises b Return paths are properly configured so traffic from AVS can reach on-premises and complete the round trip HCX port requirements HCX relies on multiple TCP and UDP ports beyond standard management connectivity. Please verify that all required ports are allowed end-to-end across any on-premises firewalls or security appliances in the ExpressRoute path.
HCX Network Profile configuration Confirm that: a. Network Profiles defined in HCX Cloud Manager match the deployed AVS subnets exactly b. Management and Uplink networks are correctly separated and used as per design guidance AVS-specific design considerations AVS (including Gen2) operates within a managed private cloud model with specific design constraints. Tunnel establishment depends on correct upstream (on-premises to AVS) connectivity rather than Azure-side security controls.

At this time, there are no known AVS Gen2 limitations that would prevent HCX Service Mesh deployment when using dedicated /24 subnets, assuming all documented requirements are satisfied.

Recommendations

Revalidate ExpressRoute routing for both HCX Management and Uplink networks
Ensure all required HCX ports are permitted across the entire network path
Run HCX built-in diagnostics for Site Pairing and Service Mesh to identify the failing check
If the issue persists, please collect HCX diagnostic logs and proceed with opening a Microsoft Support request for further investigation

References:

Shaik Nagulameera 0 Reputation points

2026-04-17T16:21:06.59+00:00
Hello,

Thank you for your response and for outlining the key validation points.

Yes, we have followed the Microsoft best practices for Azure VMware Solution Gen2 HCX deployment. As per the Gen2 HCX networking requirements, we created two additional /24 subnets within the same Azure VNet where the AVS private cloud was deployed using a /22 address space. These two /24 networks were designated for HCX Management and HCX Uplink during the HCX deployment process.

In our case, connectivity between the on-premises environment and Azure is established using a Site-to-Site VPN. Since this is an AVS Gen2 deployment, the AVS private cloud is deployed directly within an Azure VNet, and therefore we are not using the ExpressRoute Gateway and Global Reach model that is typically required for AVS Gen1 connectivity.

After enabling HCX, we observed that a new Tier-1 gateway was automatically created in NSX, which appears to be dedicated for HCX traffic. The two /24 subnets that were created in the Azure VNet are now mapped to segments under this newly created HCX T1 gateway in NSX.

Additionally, the following HCX appliances were deployed successfully:

IX-R1 (Interconnect appliance)

NE-R1 (Network Extension appliance)

These appliances are connected to the segments associated with the HCX-specific T1 gateway.

However, we noticed that the HCX Manager appliance is deployed under the default T1 gateway subnet, rather than the HCX-specific T1 gateway.

Because of this, we are currently observing the following connectivity behavior:

We cannot ping the IX-R1 and NE-R1 appliances from the HCX Manager.

We cannot ping the IX-R1 and NE-R1 appliances from the HCX Connector deployed on-premises.

However, we are able to reach the HCX Manager from the on-premises HCX Connector without any issues.

Due to this lack of connectivity to the IX and NE appliances, the HCX Service Mesh configuration fails with a "connection timed out" error during the validation stage.

Since the HCX Manager and HCX Interconnect appliances appear to be deployed behind different T1 gateways, we would like to confirm the following:

Whether this behavior is expected in AVS Gen2 HCX deployments.

Whether additional routing between the default T1 and the HCX-specific T1 gateway is required for appliance communication.

If there are any specific routing or NSX configuration checks within AVS that we should validate to allow connectivity between these HCX components.

Please let us know if there are any additional diagnostics or logs that would help further investigate this issue.

Thank you.Hello,

Thank you for your response and for outlining the key validation points.

Yes, we have followed the Microsoft best practices for Azure VMware Solution Gen2 HCX deployment. As per the Gen2 HCX networking requirements, we created two additional /24 subnets within the same Azure VNet where the AVS private cloud was deployed using a /22 address space. These two /24 networks were designated for HCX Management and HCX Uplink during the HCX deployment process.

In our case, connectivity between the on-premises environment and Azure is established using a Site-to-Site VPN. Since this is an AVS Gen2 deployment, the AVS private cloud is deployed directly within an Azure VNet, and therefore we are not using the ExpressRoute Gateway and Global Reach model that is typically required for AVS Gen1 connectivity.

After enabling HCX, we observed that a new Tier-1 gateway was automatically created in NSX, which appears to be dedicated for HCX traffic. The two /24 subnets that were created in the Azure VNet are now mapped to segments under this newly created HCX T1 gateway in NSX.

Additionally, the following HCX appliances were deployed successfully:

IX-R1 (Interconnect appliance)

NE-R1 (Network Extension appliance)

These appliances are connected to the segments associated with the HCX-specific T1 gateway.

However, we noticed that the HCX Manager appliance is deployed under the default T1 gateway subnet, rather than the HCX-specific T1 gateway.

Because of this, we are currently observing the following connectivity behavior:

We cannot ping the IX-R1 and NE-R1 appliances from the HCX Manager.

We cannot ping the IX-R1 and NE-R1 appliances from the HCX Connector deployed on-premises.

However, we are able to reach the HCX Manager from the on-premises HCX Connector without any issues.

Due to this lack of connectivity to the IX and NE appliances, the HCX Service Mesh configuration fails with a "connection timed out" error during the validation stage.

Since the HCX Manager and HCX Interconnect appliances appear to be deployed behind different T1 gateways, we would like to confirm the following:

Whether this behavior is expected in AVS Gen2 HCX deployments.

Whether additional routing between the default T1 and the HCX-specific T1 gateway is required for appliance communication.

If there are any specific routing or NSX configuration checks within AVS that we should validate to allow connectivity between these HCX components.

Please let us know if there are any additional diagnostics or logs that would help further investigate this issue.

Thank you.
Anonymous

2026-04-17T18:23:15.7933333+00:00
Hey Shaik Nagulameera,

Is this expected in AVS Gen2 HCX deployments?

Yes, what you’re seeing is normal behavior in AVS Gen2.

In this setup:

HCX creates its own dedicated gateway (Tier-1) for its service appliances (IX and NE).

The HCX Manager stays connected to the default gateway (Tier-1).

So it’s expected to see:

IX and NE appliances on the HCX gateway

HCX Manager on the default gateway

This separation is by design and doesn’t indicate a problem.

Why are you seeing connectivity failures?

Even though the setup is correct, HCX communication is very sensitive to routing and firewall settings, especially when using a Site-to-Site VPN.

A couple of important points:

Ping (ICMP) is not a reliable test for HCX. Not being able to ping doesn’t necessarily mean something is broken.

HCX uses specific ports, secure (TLS) communication, and proper routing- not simple ping checks.

The most common reason for “connection timed out” during Service Mesh validation is:

Routing issues between components, especially between:

On-prem HCX Connector

HCX Manager

HCX IX / NE appliances

Even though these components sit on different gateways, routing between them should work automatically via the Tier-0 gateway - as long as everything is configured correctly.

What should you check?

Here are the most common areas that resolve this issue:

-> VPN configuration (very common cause)

Make sure HCX Management and Uplink networks are included in VPN traffic selectors (both directions)

Ensure no NAT is applied to HCX traffic

Confirm return routes exist and are symmetric (traffic can go both ways properly)

-> AVS / NSX checks

Verify no firewall rules are blocking traffic (especially NSX Distributed Firewall)

Ensure the HCX gateway is advertising routes correctly

Confirm there is no asymmetric routing caused by custom configurations

-> HCX-specific checks

Make sure all required HCX ports are open end-to-end

Check logs on HCX Manager and IX appliances for timeout or TLS errors (these are much more useful than ping tests)
Shaik Nagulameera 0 Reputation points

2026-04-17T18:30:05.2033333+00:00

Hi Ankit,

Thank you for responding. Unfortunately, I’m unable to see your previous message. Could you please repost your response?
Anonymous

2026-04-20T08:16:46.6133333+00:00

Hello Shaik Nagulameera,

This may be because the reply was posted as a comment under your answer. I have now moved the entire conversation into the comments section below my answer. Please let me know if this helps clarify your query.

AVS Gen 2 HCX Configurations - Issues

Environment

Deployment Overview

Issue

Error Message

Health Check Output

Observations

Question

1 answer

Your answer