When a stateful service is enabled for the first time on a Tier-0 Gateway, what happens on the NSX Edge node?

In the NSX architecture, a Tier-0 Gateway consists of two main components: a Distributed Router (DR) and a Service Router (SR). The DR is instantiated on all transport nodes (ESXi hosts and Edge nodes) when the gateway is created, handling distributed routing. However, the SR, which is required for centralized stateful services like NAT, Gateway Firewall, or VPN, is not created by default. When a stateful service is configured on the Tier-0 Gateway for the first time, an SR is instantiated on the NSX Edge node(s). NSX automatically creates an internal link to connect this new SR to the existing DR, enabling traffic to be steered to the SR for stateful service processing.

A. The Distributed Router (DR) is already instantiated when the Tier-0 gateway is created, not when the stateful service is enabled. The primary event is the SR instantiation.
C. The connection between the SR and DR is mandatory. Without this internal link, traffic cannot be passed from the distributed routing plane to the centralized services plane for processing.
D. The Service Router (SR) is instantiated on-demand, but its connection to the Distributed Router (DR) is an automatic, system-managed process. No manual intervention is required.

1. VMware NSX-T Reference Design Guide (Page 31): "A Tier-0 gateway is composed of a distributed router (DR) and a service router (SR). The DR is distributed across all the transport nodes part of an overlay transport zone, while the SR is a centralized component, instantiated on demand on the Edge nodes when a centralized service is enabled on the gateway." This confirms that the SR is instantiated on-demand when a service is enabled.

2. VMware NSX Data Center Administration Guide (Section: Tier-0 Gateways): "A tier-0 gateway has a distributed router and a services router. The distributed router is distributed across all transport nodes that host the tier-0 gateway's logical router ports... The services router is required for services that are not distributed, such as NAT, VPN, and load balancing." This source clarifies that the SR is specifically for these stateful services.

3. VMware NSX Data Center Administration Guide (Section: Tier-0 Gateways, Architecture Diagram): Architectural diagrams in the official documentation consistently show an "internal transit link" or "router link" connecting the DR and SR components on an Edge node. The text explains this link is automatically created. For example, "The DR and SR are always connected with an internal, system-generated link." This confirms the automatic connection.