O'Reilly logo
  • pritam zare thinks this is interesting:

If a match is not found, the Switch Security module sends a request for the entry to the NSX Controller responsible for the VNI

From

Cover of VCP6-NV Official Cert Guide (Exam #2V0-641)

Note

This behavior is similar to MAC Table update. If MAC/ARP table entry is not found in ESXi managed table, NSX controller is checked for the entry. Since ARP Table maintained per ESXI and Per Logical switch it is expected that Logical switch looks into its ARP Table before check with NSX Controller's ARP Table