Fabric segmentation for a hospital access migration
Metro Health has two data centers and five clinical buildings. The data-center core is a pair of VSP 7400 switches running Extreme Fabric Connect; 80 VLANs support clinical, imaging, and guest devices. The five buildings use X465 access switches running ExtremeXOS. The hospital wants to remove spanning tree from the access-core links, extend Layer 2 segments for medical devices that cannot be re-addressed, and keep guest traffic separate. Twelve access switches connect to legacy building routers and cannot run VOSS. The fabric team proposes making every X465 a Fabric Attach client and mapping all 80 VLANs to one I-SID to simplify operations. Clinical engineering requires that a broadcast storm in one VLAN not affect another. The migration window is four hours per building.
1. Evaluate the proposal to map all 80 VLANs to one I-SID. What is the risk, and what would you recommend?
Read the worked answer
Mapping all 80 VLANs to one I-SID would defeat the segmentation requirement. An I-SID is a fabric service instance; devices in the same I-SID share a Layer 2 flooding domain. If clinical, imaging, and guest VLANs are all mapped into one I-SID, a broadcast storm or loop in guest traffic can flood into clinical segments. That directly violates the clinical engineering requirement and creates a security boundary problem.
Use one I-SID per VLAN where isolation is required, or group only VLANs that are explicitly allowed to share a broadcast domain. Keep guest traffic in its own I-SID and apply policy at the fabric edge. If 80 I-SIDs feels operationally heavy, use a documented naming and numbering scheme and automate provisioning; do not collapse the security model to reduce clicks.
Before the migration, confirm the VSP and XOS release support the required number of I-SIDs and Fabric Attach assignments, and validate that the legacy routers can be placed behind a proxy without merging guest and clinical traffic.
2. Choose Fabric Attach client versus proxy for the X465 switches and legacy routers. Justify placement.
Read the worked answer
Use Fabric Attach clients on X465 switches where the release and license support it, because the access switch can signal its VLAN-to-I-SID needs directly to the fabric and remove STP from the access-core link. Use a Fabric Attach proxy on the VSP pair for the twelve legacy routers that cannot run Fabric Attach. The proxy aggregates their attachment requests and presents them to the fabric; it does not turn the legacy router into a fabric node.
Avoid making every device a proxy. A proxy adds a translation and troubleshooting point, so place it where the legacy device genuinely cannot signal for itself. For the X465 buildings, a client is simpler and gives clearer per-switch state. For the legacy routers, document which proxy port maps to which VLAN and I-SID, and verify that guest traffic is never proxied into a clinical I-SID.
Confirm that the X465 hardware and ExtremeXOS release support Fabric Attach client mode before committing the design.
3. Outline a four-hour migration for one building that preserves medical device connectivity and provides rollback.
Read the worked answer
Pre-stage everything before the window. Create the I-SIDs, Fabric Attach assignments, and VLAN mappings on the VSP pair; confirm IS-IS adjacencies and fabric health; document the current STP topology and the exact rollback commands. Identify a small pilot VLAN, such as a non-critical imaging VLAN, and a clinical sponsor.
In the window, migrate the pilot VLAN first. Attach the access switch as a Fabric Attach client or proxy, verify the I-SID is up, test medical device connectivity, and confirm that broadcast traffic stays inside the intended I-SID. Only then migrate the remaining VLANs in small groups. Disable STP on the migrated access-core links after the fabric path is verified, not before.
Keep out-of-band console access and a rollback trigger: if a clinical device loses connectivity or a storm crosses I-SIDs, remove the Fabric Attach assignment and restore the prior STP path. At the end, verify device health, MAC learning, and failover by disabling one fabric link. Do not migrate a second building in the same four-hour window.