We're migrating from UniFi switches to Aruba Instant On switches. The current design includes stacks of Aruba 1960 switches, 1930 switches connected over fiber, and 10 Gb uplinks between parts of the building. The replacement topology is intended to match the existing one as closely as possible.
The Aruba switches work normally when staged on a separate management network. A laptop can receive an address and access the Internet, and the switches may show healthy for days. However, when production connections are moved from the UniFi switches to the Aruba network, the Aruba cloud health degrades and clients either fail to obtain DHCP addresses or receive an address but cannot resolve DNS or reach basic sites such as Google.
I've tried different migration sequences, including removing the firewall uplink from the UniFi network and connecting it only to the Aruba switches. The symptoms make me suspect a Layer 2 problem, possibly involving VLAN tagging, spanning tree, an unexpected loop, or mismatched native/untagged VLAN settings. What is the best way to isolate the problem and verify the uplinks between the 1960 and 1930 switches?
3 Answers
This sounds more like a Layer 2 failure than a DNS problem. Start with the smallest possible topology: firewall, one 1960 stack, one 1930, and a laptop. Confirm DHCP, DNS, and Internet access there, then reconnect the remaining switches one at a time. As soon as the problem returns, inspect that link and its configuration.
For every uplink, compare the allowed VLANs, native or untagged VLAN, and management VLAN on both ends. Also check RSTP: make sure the intended switch is the root bridge and watch for a sudden increase in topology changes when production links are connected.
Check that the VLAN configuration is actually identical between the two switch platforms. Even when the physical layout matches, a trunk on one side may be treated as an access or hybrid link on the other. Verify tagged VLANs, the untagged/native VLAN, management VLAN, DHCP scope, and the firewall’s expected interface VLANs.
Look for a Layer 2 loop, especially if wireless access points or other dual-connected devices are present. Temporarily disconnect APs and redundant links, then bring up only one path between switches. If the topology-change counter starts climbing immediately after a link is connected, investigate that segment and confirm RSTP is enabled and consistent everywhere.
Thanks, I was already suspecting VLAN tagging. I’ll strip the design down and verify each uplink before adding the other switches back.