When extending a Layer 2 subnet from on-premises to NC2 on AWS, the default gateway often remains at the on-premises location.

For Virtual Machines (VMs) running on the NC2 cluster in AWS to communicate with resources outside their immediate subnet, their traffic must be directed back through the tunnel to the on-premises gateway. This is achieved by configuring arouting policyon the NC2 cluster with aForward action. This policy identifies traffic destined for the gateway and encapsulates it via the VTEP (VXLAN Tunnel Endpoint) using port 4789. Without this forward action policy, the AWS-based VMs would attempt to find a local gateway within the AWS VPC, resulting in a loss of connectivity for any North-South traffic.