NSX VM's on same segment can only ping tier 1 gateway nothing else
Update: SOLVED: Edge TEP and Host TEP networks had to be on separate VLAN's due to using the same distributed switch as NSX.
​
I just deployed NSX for the first time using the official VMware guide.
My setup is as follows:
3x ESXi 8.0.1 hosts, vCenter 8.0.1, NSX 4.1
MTU set to 1900 in OPNsense for parent interface and all NSX VLAN's
MTU set to 1800 for distributed switch and all NSX components
MTU set to max (9216) on physical switch for all ports
NSX Management VLAN: 70 ([10.7.70.0/24](https://10.7.70.0/24))
NSX Overlay VLAN: 71 ([10.7.71.0/24](https://10.7.71.0/24))
VLAN for Traffic between Tier0 GW and physical router: 72 ([10.7.72.0/24](https://10.7.72.0/24))
Tier0 Gateway HA VIP: 10.7.72.7
D-NSX-all-vlans: port group on distributed switch with VLAN trunk (0-4094)
D-NSX-MGMT: port group on distributed switch with VLAN 70
External-segment-1-OPN - VLAN 72, nsx-vlan-transportzone
segment-199: connected to Tier1 GW, [192.168.199.0/24](https://192.168.199.0/24)
Gateway in OPNsense: [10.7.72.7](https://10.7.72.7), shows as up, can ping from OPNsense side
Static route in OPNsense: Gateway: [10.7.72.7](https://10.7.72.7) | Network: [192.168.199.0/24](https://192.168.199.0/24)
Static route in Tier0 GW: Network: 0.0.0.0/0 | Next hops: [10.7.72.1](https://10.7.72.1)
Firewall rules in OPNsense allow everything for all NSX VLAN's
Diagram: [https://imgur.com/cUJsMET](https://imgur.com/cUJsMET)
​
I have 2 test VM's attached to "segment-199." VM1 has static IP of [192.168.199.15](https://192.168.199.15), GW [192.168.199.1](https://192.168.199.1). VM2 is [192.168.199.16](https://192.168.199.16).
I am unable to ping the VM's from each other. I can only ping the gateway of [192.168.199.1](https://192.168.199.1). I have no internet access and cannot ping [8.8.8.8](https://8.8.8.8). Result to [192.168.199.16](https://192.168.199.16) from [192.168.199.15](https://192.168.199.15) is Destination host unreachable.
Tracert to [192.168.199.16](https://192.168.199.16) from [192.168.199.15](https://192.168.199.15) yields "Reply from [192.168.199.15](https://192.168.199.15): Destination host unreachable"
Tracert's don't go any further than 192.168.199.1, [192.168.199.15](https://192.168.199.15) to .16 doesn't try to route through anything as expected.
​
I have not changed any of the default firewall rules in NSX.
Under Hosts, it shows all 3 as having 2 tunnels up, and 2 tunnels down. I believe this is because some of the hosts have unused physical NIC ports.
​
Any insight would be greatly appreciated, thanks!!
​
EDIT: I was a complete idiot and had to create a rule on Windows to allow ICMP (even with network discovery enabled). Ping now works between the VM's, but my tunnels between edge nodes and hosts are still down.