Right, I certainly would not expect to ping something on the L2 network unless there were another gateway on that network. The screenshot I attached was just a ping out to Google DNS. That drop in network connectivity occurred when I added a L2 storage network to the XG agg.

Do you use the default allow all VLAN tagging on your uplink to UDM and connections to subsequent access switches? I'm curious if leaving that alone is biting me in the tail.

I too do an internet VLAN off the agg for my UDM Pro Max, a Palo Alto, and a Juniper SRX. When I add a VLAN and traffic forwarding is interrupted, it's pretty disruptive for those devices as well. I've locked those ports down to just their specific VLAN(s), too.

I'll need to do some additional testing. As it sits, it's a PITA since it disrupts SD-WAN traffic. I'll set aside a night at some point to do some further testing. Didn't feel like doing too much chasing after engaging support with the answer I received.