A government agency's vPC pair loses the peer-link, and the peer-keepalive link stays up. What happens to the vPC member ports on the secondary peer, and why?
Select an answer to reveal the explanation.
Short Explanation
The keepalive is the pair of peers still able to shout across the room after the main hallway closes. You suspend the secondary member ports so both sides do not forward the same vPCs and split the world. If you remember the rule backwards, you will leave a loop in place.
Full Explanation
vPC uses the peer-link for data and synchronization and the keepalive to decide whether the peer is alive. When the peer-link fails but the keepalive stays up, both switches know the other is alive and that they can no longer keep a single forwarding view. The secondary suspends its vPC member ports so only the primary keeps forwarding those vPCs. That is dual-active avoidance, and it is the government pair's outcome. The opposite rule is the trap: if the keepalive is also lost, the secondary concludes that the primary is gone and keeps its member ports up. A live keepalive is exactly why the ports are suspended, not why they would stay forwarding. Orphan ports are devices attached to only one peer. A peer-link failure does not relabel member ports as orphans or instruct them to flood BPDUs on every VLAN. HSRP election is independent. Member-port suspension does not wait for an HSRP role change, and the peer-link being down is the reason the suspension happens. Caveat: orphan hosts on the secondary are not protected by this suspension logic and can become unreachable when the peer-link is gone. Operational check: during a controlled peer-link shut, confirm the secondary shows its vPC members suspended while keepalive remains alive, then restore the peer-link and confirm they recover.