To identify why there is no data ingress into a workload domain, an administrator must understand

the specific path external traffic takes. For a workload domain configured with a Tier-0 gateway and a

Tier-1 gateway (Distributed Routing only), the ingress traffic flow follows a hierarchical path from the

physical network through the NSX logical components to the virtual machine.

Ingress Traffic Flow Sequence

The correct sequence of steps for external network traffic to ingress the workload domain and reach

the virtual machine is as follows:

Uplink for the Tier-0 Service Router (SR): Traffic enters the NSX environment from the physical

network through the physical-to-logical interface on the Edge node.

Inter-Tier interface of the Distributed Router (DR) of the Tier-0 gateway: After being received by the

Service Router, the packet is routed internally within the Tier-0 gateway to its distributed

component.

Inter-tier interface of the Distributed Router (DR) on the Tier-1 gateway TEP on the Edge: The Tier-0

gateway routes the packet to the Tier-1 gateway. In this specific scenario, since the Tier-1 is

"Distributed Routing only," this logical transition occurs on the Edge node participating in the

transport zone.

TEP on the destination host: The Edge node encapsulates the packet (typically via Geneve) and

tunnels it across the physical fabric to the specific ESXi host where the target virtual machine is

currently residing.

Downlink interface of the Tier-1 Distributed Router (DR) to the segment to which the workload VM is

attached: On the destination host, the packet is de-encapsulated. The local Tier-1 DR instance

identifies the correct logical segment (VNI) for the destination IP.

NSX portgroup representing the destination segment on the destination host dvfilter and vNic of the

workload VM: The packet is delivered to the virtual switch port, passes through any applied

Distributed Firewall (dvfilter) rules, and finally reaches the virtual machine's network interface card

(vNIC).