VLT Peer-Link Failure Leaves Single-Homed Appliance Dark
A pair of Dell PowerSwitch S5248F-ON switches, leaf-a and leaf-b, form VLT domain 10. The VLTi is port-channel 100 with two 100G members; the backup link uses management network 192.0.2.0/24. Twenty dual-homed servers use LACP port-channels 1-20 with vlt-peer-lag. A single-homed backup appliance connects only to leaf-b on Ethernet 1/1/49 in VLAN 30. During cable remediation, both VLTi members are removed within 30 seconds. The dual-homed servers keep working through leaf-a. The backup appliance loses all connectivity. On leaf-a, show vlt 10 reports primary; on leaf-b, it reports secondary with VLT port-channels down. The backup link remains up. No orphan ports are configured on either peer. The team wants to restore the appliance without making leaf-b primary and without creating a loop.
1. Why did the dual-homed servers survive while the single-homed appliance failed? Explain what VLT did after the VLTi went down and why the backup link state matters.
Read the worked answer
VLTi loss is not the same as peer failure. Because the backup link stayed up, leaf-a remained primary and leaf-b remained secondary; leaf-b did not promote and create a dual-primary. In VLT, the secondary disables its VLT port-channels so dual-homed servers do not see two active paths; the servers' LACP bundles stay up through leaf-a. The secondary also disables non-VLT ports unless they are explicitly configured as orphan ports. Ethernet 1/1/49 was not an orphan port, so leaf-b shut it and isolated the appliance. The backup link is the heartbeat: if it had also failed, leaf-b could have promoted after timeout, keeping VLT ports up and risking a loop. Verify with show vlt 10, show vlt 10 backup-link, and interface state on both peers.
2. Give the configuration and verification steps to bring the appliance back on leaf-b while preserving loop safety. Include the design caveat for orphan ports.
Read the worked answer
On leaf-b, configure the appliance-facing interface as an orphan port and ensure VLAN 30 is allowed: interface ethernet 1/1/49, switchport mode access, switchport access vlan 30, orphan-port, no shutdown. Orphan status is local, so apply it on the peer that hosts the single-homed device; do not expect VLT to turn it into a dual-homed bundle. Verify show vlt 10, show vlt 10 backup-link, show interface ethernet 1/1/49, and the release-equivalent orphan-port output. Caveat: orphan ports are for devices that cannot be dual-homed. If the appliance is actually a switch connected back into the VLT pair, an orphan port can create a loop; in that case rely on STP and a deliberate topology, not orphan ports. Restore the VLTi before declaring normal.
3. If both VLTi members and the backup link fail, what failure mode occurs and what safeguards would you add?
Read the worked answer
If both VLTi and backup link are lost, each peer can no longer confirm the other's health. After the dual-primary timeout, both may act as primary and keep VLT port-channels up; dual-homed servers then have two active paths and a loop or broadcast storm is possible. This is the VLT split-brain case. Safeguards: put the backup link on a separate management or out-of-band path that does not share fate with the VLTi; monitor show vlt 10 backup-link; use a primary-priority so the intended primary wins; and define an operational procedure to shut one peer's VLT ports or restore the VLTi immediately. If the design cannot guarantee a heartbeat, do not use VLT as the only loop-prevention mechanism; add STP and clear troubleshooting runbooks. Verify after recovery with show vlt 10 mismatch and port-channel state.