Switching And Vlan Design
106 incident problems about Switching And Vlan Design. Start with the reviewed ones.
Read first
When DNS changed but some clients still hit the old backendAn InfraTree guide that lays out the first signals to check, the CLI verification order, common misdiagnoses, and a safe recovery path when the DNS record is updated but resolver cache, HTTP/2 keepalive, or client pools hold on to the old target.Network3 min readWhen firewalld looks open but connections keep getting blockedAn InfraTree guide that lays out the first signals to check, the CLI verification order, common misdiagnoses, and a safe recovery path when a port rule appears to exist but the connection fails because of zone, runtime/permanent drift, source binding, or an upstream firewall.Network3 min readHow to separate timeout and connection refused by network pathAn InfraTree guide that lays out the first signals to check, the CLI verification order, common misdiagnoses, and a safe recovery path when DNS, route, firewall, proxy, and listener states all look like the same connection failure.Network3 min read
Recommended problems
Reviewed problems first, then problems with detailed scenarios.
All problems (106)
NETWORK-1611A trunk link comes up and one VLAN still failsOne VLAN still fails right after a renumbering change.ReviewedNetworkBeginner6 minFreeNETWORK-072LACP bundle never forms after a stack replacementCabling is correct, but the upstream sees a different partner identity and refuses to aggregate the links into the expected bundle.NetworkIntermediate16 minFreeNETWORK-068Port-channel min-links keeps the bundle down after a partial member failureOne physical path still forwards traffic, but the logical interface remains down because the configured minimum bundle size is no longer satisfied.NetworkIntermediate17 minFreeNETWORK-084Spanning-tree guard blocks one hypervisor uplinkThe network configuration is stable, but a host starts sending unexpected bridge protocol units and the protection feature shuts the access port down.NetworkIntermediate17 minFreeNETWORK-080MAC flapping alarms appearThe network is stable, but one mobile workload triggers MAC move alarms and intermittent forwarding loss because the switching design assumes slower host movement.NetworkIntermediate18 minFreeNETWORK-075IPv6 RA guard blocks the real router after a campus template is copied to the uplinkIPv4 still works, but IPv6 clients lose their gateway because the edge protection template was applied to the wrong interface type.NetworkIntermediate15 minFreeNETWORK-087Router-on-a-stick subinterface works for one VLAN but the allowed list omits the new segmentInter-VLAN routing exists overall, but the newly added segment remains isolated because the trunk never allowed that VLAN onto the router link.NetworkIntermediate15 minFreeNETWORK-094VLAN exists on both switches but VTP pruning removes the path users think is activeThe database is correct, yet traffic still disappears because dynamic pruning removed the VLAN from a trunk users assumed was always carrying it.NetworkIntermediate15 minFreeNETWORK-106A QinQ handoff preserves the service VLAN but rewrites the inner PCP bits so voice traffic loses priorityConnectivity remains intact, but quality degrades because the handoff normalizes priority bits the downstream voice design expected to preserve.NetworkIntermediate16 minFreeNETWORK-082Access switch uplink looks up but the native VLAN changed and voice phones never get the right DHCP scopeLink status is healthy, yet phone onboarding fails because the expected voice and management traffic classification changed with the trunk native VLAN baseline.NetworkIntermediate16 minFreeNETWORK-092EtherChannel load-balancing hash sends one chatty flow over the only degraded member linkMost traffic looks normal, but one application suffers because its flow hash repeatedly lands on the weakened physical member of the bundle.NetworkIntermediate16 minFreeNETWORK-103Root guard blocks the intended new spanning-tree root after maintenance and access switches stay pinned to the old pathThe maintenance plan is correct, yet the protection feature prevents the desired root election because the uplink role changed during rewiring.NetworkIntermediate16 minFreeNETWORK-098Stack member replacement keeps the config but loses the DHCP snooping binding table after reloadUser traffic recovers briefly, then fails after reload because the new member does not retain the dynamic trust state the design relied on.NetworkIntermediate16 minFreeNETWORK-070DHCP snooping uplink trust is missing after a switch replacement and clients lose gateway accessAccess ports still look normal, but ARP and DHCP behavior collapses because the new switch never restored the trusted uplink role toward the real infrastructure path.NetworkIntermediate18 minFreeNETWORK-065Root guard errdisables the uplink after temporary loop prevention during maintenanceThe spanning-tree design is mostly correct, but a maintenance path unexpectedly presents a superior BPDU and the protected uplink shuts itself down.NetworkIntermediate19 minFreeNETWORK-074DHCP Option 82 insertion changes and the server policy rejects every client from one access blockClient broadcasts arrive correctly, but the server stops leasing because relay metadata changed after an access switch template rollout.NetworkIntermediate17 minFreeNETWORK-1612A native VLAN mismatch alert stays activeThe mismatch alert stays active after a native VLAN change.NetworkBeginner6 minFreeNETWORK-1622A port-channel is up and one VLAN still failsOne VLAN still fails after a port-channel cleanup.NetworkBeginner6 minFreeNETWORK-1652A port-channel is up and one VLAN still failsOne VLAN still fails after a port-channel cleanup.NetworkBeginner6 minFreeNETWORK-1662A port-channel is up and one VLAN still failsOne VLAN still fails after a port-channel cleanup.NetworkBeginner6 minFree