Ping to ESG Fail – NSX 6.2.x (Back to basic)

If you have problem to ping your ESG (and you are not hitting the bug for the version NSX 6.1.2) please be aware of the firewall rule inside the Edge services gateway.

By default if you didn’t configure your firewall in the deployment of the ESG, the firewall rule will have the following default setting:

  1. To permit any traffic form the vse (ESG) to any destination for any services
  2. And the default Rule that is Any to Any for Any services Denny

So, If you are working in a home lab and you want to receive ping answer, you could add a new firewall rule inside the ESG to accept ICMP traffic or just allow all traffic and services on the ESG initial configuration.

Attach Image with both options:

At the ESG deployment:

  • Check “Configure Firewall default policy”
  • Change the Default Traffic Policy from Deny to Accept

Note: This will allow all the traffic and depend on your environment this may result in a security bridge, since this will allow all type of traffic though the ESG


After the ESG deployment, using the Default firewall configuration on the ESG deployment.

  • On the ESG, select Manage > Firewall
  • Select the green plus sign to add a new firewall rule for the ESG, (rule must before the last rule, which is the default one to deny all traffic)
  • Configure Name, Source and Destination depend on your security needs and for services select ICMP Echo used for ping. 



Leave a Reply

Fill in your details below or click an icon to log in: Logo

You are commenting using your account. Log Out /  Change )

Google photo

You are commenting using your Google account. Log Out /  Change )

Twitter picture

You are commenting using your Twitter account. Log Out /  Change )

Facebook photo

You are commenting using your Facebook account. Log Out /  Change )

Connecting to %s