I85PREP
⌘ K
Aruba Switching Expert (Written) study materials
Aruba Switching Expert (Written) study resources

Inter-VLAN Routing Failure After Distribution Change

Aruba Switching Expert (Written) · Put your knowledge to work in context.

All case studies

Inter-VLAN Routing Failure After Distribution Change

A distribution switch pair serves VLANs 10 (users), 20 (servers), and 99 (management). Users in VLAN 10 can reach servers in VLAN 20. After a change window where a new SVI for VLAN 20 was added and the old one removed on the active distribution switch, users report they can ping some VLAN 20 servers but not others, and cannot reach the VLAN 99 management SVI at all. The standby distribution switch still has the old VLAN 20 SVI configured. First-hop redundancy (VRRP) is in use, with the active switch as master.

1. List the most likely causes of partial VLAN 20 reachability and total VLAN 99 unreachability, and how to isolate each.

Read the worked answer

Partial reachability points to inconsistent L2/L3 state, not a total routing failure:

  • SVI mismatch between active and standby: the standby still has the old VLAN 20 SVI. If VRRP virtual IP/MAC or the SVI addressing differs, some hosts ARP to a stale gateway and fail. Check show vrrp and SVI IPs on both switches.
  • VLAN allowed/trunk pruning: the new SVI is fine but VLAN 20 may not be allowed on the trunk to some servers' access switches. Check show interfaces trunk allowed/active lists.
  • ARP/neighbor staleness: after removing the old SVI, stale ARP entries can persist. Check show arp for VLAN 20.
  • VLAN 99 unreachable entirely: likely the VLAN 99 SVI was inadvertently removed or shut, or VLAN 99 is not allowed on the uplink trunk, or an ACL/VRRP change affected it. Check SVI state (show ip interface brief), trunk allowed list, and any ACL applied to the SVI.

Isolate by comparing active vs standby configs, trunk allowed lists per path, and ARP/VRRP state.

2. Describe the safe remediation sequence and how to prevent recurrence.

Read the worked answer

Remediate in a controlled order:

  1. Restore consistency first: make the standby match the active (correct VLAN 20 SVI, VRRP config, VLAN 99 SVI) so failover behavior is predictable. Do not leave asymmetric SVIs.
  2. Verify L2: confirm VLAN 20 and 99 are allowed and active on all relevant trunks (show interfaces trunk).
  3. Verify L3: confirm SVI up/up, correct IPs, VRRP master/backup states, and ARP resolution for affected hosts.
  4. Clear stale state (ARP/neighbor) only after config is correct.
  5. Test from a VLAN 10 host to a previously failing VLAN 20 server and to the VLAN 99 SVI.

Prevention: change-management review that requires active/standby parity for SVIs and VRRP, a pre/post checklist covering trunk allowed lists, and a rollback plan. Use configuration comparison (diff) between pair members before committing.