A new pediatric wing needs devices on the clinical VLAN to communicate with devices on the guest Wi-Fi VLAN without a separate router, using the AOS-CX aggregation switch that already carries both VLANs. What should be configured on that aggregation switch to enable inter-VLAN routing?

Routing between VLANs requires each VLAN to have a Layer 3 gateway, and configuring a switch virtual interface with an IP address for each VLAN gives the aggregation switch exactly that, letting it route traffic between the clinical and guest VLANs without a separate standalone router. A trunk port only extends VLANs at Layer 2, carrying tagged frames between switches — trunking never performs routing on its own, so devices on different VLANs still cannot reach each other through a trunk alone without an SVI or router somewhere handling Layer 3. BPDU guard is a loop-prevention feature for edge ports that shuts a port down if it receives spanning-tree BPDUs; it has nothing to do with enabling communication between VLANs and would not create any Layer 3 path. A second native VLAN does not bridge two segments together — native VLAN only defines which VLAN untagged frames on a specific trunk belong to, and VLANs remain isolated broadcast domains at Layer 2 regardless of how native VLANs are assigned. Caveat: enabling inter-VLAN routing between a clinical and a guest network also raises a security question that a basic ACL or firewall policy should address, since routing alone does not enforce any access restriction. Operational check: verify each SVI shows an 'up' operational state and that a device on one VLAN can reach the other VLAN's gateway IP before declaring routing functional.