AGV Latency and WAN Brownout on a Campus EVPN Fabric
Northline Components runs three stamping buildings across a 1.2 km campus. The network uses 42 Aruba CX 6300 access switches, a pair of CX 8360 cores in VSX, and an EVPN-VXLAN overlay managed by Aruba Central. About 210 automated guided vehicles depend on a 20 ms round-trip budget to a local warehouse controller in building B. The WAN is dual-homed MPLS plus 5G, but during a carrier maintenance window the 5G path took over for 11 minutes. AGVs paused in short bursts, Central showed overlay tunnel flapping, and the plant lost visibility into which path was active. Local IT has no CLI expertise and relies on Central for change approval. The business wants AGVs to keep running through WAN and management-plane outages, but security requires that any local bypass be auditable. The campus has no local firewall except the core.
1. AGV pauses coincided with the 11-minute WAN failover. What evidence would you collect to separate underlay reconvergence, EVPN overlay instability, and management-plane dependence, and what would each pattern imply?
Read the worked answer
Collect a time-aligned set: CX core VSX/ISL and uplink logs, EVPN/BGP neighbor events, VXLAN tunnel and MAC mobility counters, Aruba Central tunnel and heartbeat status, 5G path latency/jitter/loss, AGV controller application logs, and path MTU. If local VLANs and the AGV gateway stay reachable but EVPN routes withdraw or tunnels flap when the WAN path changes, suspect an underlay/overlay interaction, especially if EVPN is extended across the WAN. If AGV traffic stops only when Central loses heartbeat and local forwarding is otherwise healthy, suspect management-plane dependence or a Central-driven policy that is not cached locally. If AGV traffic hairpins to a central firewall, WAN failover changes the return path and breaks stateful sessions. Each pattern leads to a different fix: local underlay isolation and BGP/EVPN tuning; local policy caching and break-glass; or moving AGV gateways and policy to the campus. Do not change segmentation until the timing correlation is proven with packet captures and control-plane logs.
2. Design a local-survivability approach for Aruba Central and WAN outages that keeps AGV traffic local while preserving auditability. State the trade-offs.
Read the worked answer
Keep AGV forwarding local and treat Central as management, not a data-path dependency. Put the AGV controller and its default gateway in building B on a VSX anycast gateway; advertise only the campus summary route to the WAN. Use local DHCP, DNS, NTP, and a local or cached role source for AGV authentication. For a Central outage, maintain a documented break-glass process with TACACS+ local fallback, signed change records, and centralized syslog to an on-premises collector so bypass actions are auditable. For a WAN outage, ensure EVPN-VXLAN stays within the campus and does not require WAN control-plane reachability; use local route reflectors or a fully meshed campus underlay. Test by isolating both WAN links and blocking Central in a maintenance window. Trade-offs include duplicated local policy and configuration drift, extra management effort, and possible split-brain when the WAN returns with stale routes. Mitigate with configuration backups, drift checks, clear route preference, and a tested rollback.
3. Would you enforce AGV segmentation at the CX access switches or at a central firewall? Justify the placement and its trade-offs.
Read the worked answer
Enforce the latency-sensitive AGV-to-controller policy at the CX access or aggregation layer with role-based ACLs, because every packet crossed to a central firewall adds delay and a WAN dependency. Use ClearPass or local roles to assign AGV, controller, and IT zones; permit only the required flows and deny AGV-to-AGV unless the controller requires it. Keep north-south inspection and logging at the central firewall for IT and vendor traffic. The trade-off is distributed ACL management and less deep inspection at the edge; mitigate with a standard role matrix, automated configuration compliance, and sampled traffic mirroring to an IDS. If AGV traffic is encrypted, terminate it at a local gateway rather than at the central firewall. A central-firewall-only design is simpler to audit but conflicts with the 20 ms budget and the WAN-survivability requirement. Document which flows are intentionally allowed so the distributed policy remains reviewable.