Water-utility NSX-T overlay on a VLAN goes silent after a spanning-tree reconvergence. The LAN team reports that VLAN in a Blocking state on the ToR toward the transport nodes. Distributed Firewall configuration is unchanged. What should the administrator do?
Select an answer to reveal the explanation.
Short Explanation
Spanning tree is the traffic cop on the copper. If it puts the NSX VLAN in Blocking, overlay packets never leave the parking lot and DFW looks guilty. Get LAN to restore Forwarding on that VLAN; publishing another DFW section will not unblock STP.
Full Explanation
When water-utility NSX-T overlay on a VLAN goes silent after a spanning-tree reconvergence and the LAN team reports that VLAN in a Blocking state on the ToR toward the transport nodes while Distributed Firewall configuration is unchanged, work with LAN engineers to restore a Forwarding spanning-tree state on the NSX VLAN rather than treating it as a DFW misconfiguration. A Blocking VLAN toward transport nodes black-holes overlay regardless of perfect DFW config. Restoring Forwarding returns civic overlay. Publishing a new NSX-T Distributed Firewall section to clear the blocked VLAN fails by concept because DFW publish cannot change spanning-tree state on a physical ToR. Disabling identity firewall so AD logon events no longer participate in spanning tree fails by concept because IDFW has no role in spanning-tree port state. Moving all overlay VMs to Carbon Black Cloud isolation until spanning tree is ignored fails by concept because CBC isolation does not heal a Blocking VLAN and worsens availability. Exam caveat: overlay silence with LAN reporting Blocking on the NSX VLAN is a spanning-tree/LAN issue—coordinate Forwarding restoration, do not rewrite DFW or IDFW. Operational check: with LAN, restore Forwarding on the NSX VLAN toward transport nodes, confirm overlay recovers, keep DFW unchanged, and add STP awareness to the water-utility NSX incident playbook for municipal OT networking.