Many thanks to John and Rajesh. It turned out that one of our switch's
config was not saved and it lost our test untrusted vlan when we lost
power a week ago. But since I wasn't confident of the CA config we were
looking everywhere for the solution. But now at least we understand CA
and know what the correct settings for it are. Thanks again.
Mark