NSX-T 3.1 nested lab: Can't ping e/w between VMs on same segment on different hosts

[DSeaman]

TL;DR: I have two Windows VMs on two different NSX-T 3.1 enabled hosts and they can't ping each other, but both can ping the same default gateway. Both Windows VMs are on the SAME segment and their IPs are 10.12.0.100 and 10.12.0.101. The gateway is 10.12.0.1. I am NOT trying to route, just a simple layer-2 ping between the VMs. 

Details:

I'm building up a new NSX-T 3.1 nested lab on vSphere 7.0 U1. The nested lab is on a single ESXi 7.0 u1 host, and I have deployed two virtual ESXi hosts which were successfully added as host transport nodes. I then created a transport zone for the two hosts and added a WebTier segment (10.12.0.0/24). Two Windows VMs were created and powered on, one on each nested ESXi host. The VMs were connected to the 'webTier' segment in vCenter.

NSX-T manager shows both host transport nodes as "UP" and one tunnel is up as well. I also tested large TEP packets between the two TEPs via:

vmkping -I vmk10 -S vxlan 10.13.2.39 -d -s 1600 -c 10

Large TEP pings are a success. 

However, inside each Windows VMs I can't ping the other Windows VMs. But both VMs can ping the configured gateway. I'm at a loss as to where to go from here for troubleshooting. TIA!

[DSeaman · Accepted solution]

Apparently the Windows guests had ping's blocked via a guest firewall. Once I disabled that, everything worked. But I first used the NSX-T Traceflow, and that was successful. So then suspected it could be a guest OS issue.