HA Pair Does Not Fail Over After a Trunk VLAN Change
Two Citrix ADC MPX 8905 appliances run in high availability as node1 (primary) and node2 (secondary) in INC mode. The failover interface set contains VLAN 10 (management) and VLAN 20 (data). A network engineer moves node1's VLAN 20 uplink from an access port to a new 802.1Q trunk. The trunk is missing VLAN 20 on the switch side. Node1 still shows as primary, but users behind VLAN 20 lose connectivity; node2 does not take over. Heartbeats on VLAN 10 remain up. The ADC shows no failover, and show ha node still lists node1 as primary. The change window ends in 30 minutes. You need to restore service and prevent a repeat. The HA pair uses INC mode because each node has different SNIPs.
1. Explain why node1 remained primary when its data VLAN failed.
Read the worked answer
HA monitors the failover interface set, not application reachability. If VLAN 20's physical interface stays up but the switch trunk is not passing VLAN 20, the ADC may still see the link as up; the failure is a Layer 2 VLAN membership problem, not an interface-down event. Heartbeats on VLAN 10 remain healthy, so node1 keeps the primary role. INC mode allows each node to keep independent network configuration, but it does not make HA detect a missing VLAN on a trunk. If the interface is in the failover set but HA monitoring is disabled, or the VLAN is not correctly bound, failover will not trigger. That is why show ha node still shows node1 primary while users fail.
2. What checks and immediate actions would you take within the 30-minute window?
Read the worked answer
Check show interface, show vlan, show ha node, and the failover interface set configuration. On the switch, verify the trunk allows VLAN 20 and that the port is not err-disabled. If node2 has a working VLAN 20 path, force failover from node1 to node2 to restore service within the window; do not wait for automatic failover. After failover, validate with a client on VLAN 20 and with show ha node. If node2 shares the same broken trunk, fix the trunk first. Do not simply reboot node1; that may cause an unnecessary double failover and does not fix the VLAN. Record whether the data interface stayed link-up during the outage, because that determines whether HA could ever have detected it.
3. How would you make HA more resilient to this class of failure?
Read the worked answer
Make HA detect this failure: include the correct data interfaces and VLANs in the failover interface set, enable HA monitoring on them, and avoid a single trunk as the only path. Use redundant links or LACP with VLAN 20 on both members, and test by shutting a member link or removing a VLAN in a maintenance window. Review whether INC mode is required; if both nodes can share SNIPs, normal HA is simpler. Add switch-side monitoring for allowed VLANs and a runbook that checks show vlan after trunk changes. Finally, schedule a forced failover test after every network change that touches HA interfaces, so a link-up but VLAN-down condition is caught before users are affected.