diff --git a/files/ansible-playbooks/update-indoor3.yml b/files/ansible-playbooks/update-indoor3.yml
index d5b75fd..1262f04 100644
--- a/files/ansible-playbooks/update-indoor3.yml
+++ b/files/ansible-playbooks/update-indoor3.yml
@@ -173,57 +173,6 @@
           - "dev2_conn_method={{ dev2_conn_method }}"
           - "lldp_dev2_ip={{ lldp_dev2_ip | default('<none>') }}"
 
-    # ------ LLDP IPv6 discovery for tunnel mode (Dev1 → Dev2 link-local) ------
-    - name: Discover DEV2 candidate IPv6 via LLDP on DEV1 (best-effort)
-      when: dev2_conn_method == "tunnel"
-      ansible.builtin.raw: >
-        {{ pathprefix }}
-        DIGITS="{{ dev2_lldp_digits }}";
-        cat /var/run/lldp_server.json 2>/dev/null \
-          | grep "${DIGITS}" -A 15 \
-          | grep 'address_ipv6' \
-          | awk -F'"' '{ print $4 }' \
-          | head -n1
-      register: dev2_lldp_ip6_raw
-      changed_when: false
-      failed_when: false
-
-    - name: Capture LLDP-derived DEV2 IPv6 (if any)
-      when: dev2_conn_method == "tunnel"
-      ansible.builtin.set_fact:
-        lldp_dev2_ip6: "{{ (dev2_lldp_ip6_raw.stdout | default('')) | trim }}"
-      changed_when: false
-
-    - name: Debug LLDP IPv6 candidate for DEV2 (new debug)
-      when: dev2_conn_method == "tunnel" and debugging | bool
-      delegate_to: localhost
-      ansible.builtin.debug:
-        msg:
-          - "LLDP candidate IPv6={{ lldp_dev2_ip6 | default('<none>') }}"
-
-    # Build the remote tunnel target: prefer LLDP IPv6 if present, else 192.168.1.1
-    - name: Build tunnel remote target for DEV2 (prefer LLDP IPv6 when available)
-      when: dev2_conn_method == "tunnel"
-      delegate_to: localhost
-      ansible.builtin.set_fact:
-        dev2_tunnel_target_host: >-
-          {{
-            (lldp_dev2_ip6 is defined and (lldp_dev2_ip6 | string | trim | length > 0))
-            | ternary(
-                '[' ~ (lldp_dev2_ip6 | string | trim) ~ '%' ~ (dev1_iface | string | trim) ~ ']',
-                dev2_host | string
-              )
-          }}
-        dev2_tunnel_target_port: "{{ dev2_port | string }}"
-      changed_when: false
-
-    - name: Debug tunnel remote target for DEV2 (IPv4/IPv6)
-      when: dev2_conn_method == "tunnel" and debugging | bool
-      delegate_to: localhost
-      ansible.builtin.debug:
-        msg:
-          - "dev2_tunnel_target={{ dev2_tunnel_target_host | default(dev2_host) }}:{{ dev2_tunnel_target_port | default(dev2_port) }}"
-
 
 
     # Direct LLDP 10.x login (no tunnel, reusing two-step auth style)
@@ -294,6 +243,65 @@
           - "dev2_passfile_used={{ dev2_passfile_used | default('NONE') }}"
           - "lldp_dev2_ip={{ lldp_dev2_ip | default('<none>') }}"
 
+    - name: Fallback to tunnel if direct LLDP auth failed
+      when: dev2_conn_method == "direct_lldp" and dev2_passfile_used == "NONE"
+      delegate_to: localhost
+      ansible.builtin.set_fact:
+        dev2_conn_method: "tunnel"
+      changed_when: false
+
+    # ------ LLDP IPv6 discovery for tunnel mode (Dev1 → Dev2 link-local) ------
+    - name: Discover DEV2 candidate IPv6 via LLDP on DEV1 (best-effort)
+      when: dev2_conn_method == "tunnel"
+      ansible.builtin.raw: >
+        {{ pathprefix }}
+        DIGITS="{{ dev2_lldp_digits }}";
+        cat /var/run/lldp_server.json 2>/dev/null \
+          | grep "${DIGITS}" -A 15 \
+          | grep 'address_ipv6' \
+          | awk -F'"' '{ print $4 }' \
+          | head -n1
+      register: dev2_lldp_ip6_raw
+      changed_when: false
+      failed_when: false
+
+    - name: Capture LLDP-derived DEV2 IPv6 (if any)
+      when: dev2_conn_method == "tunnel"
+      ansible.builtin.set_fact:
+        lldp_dev2_ip6: "{{ (dev2_lldp_ip6_raw.stdout | default('')) | trim }}"
+      changed_when: false
+
+    - name: Debug LLDP IPv6 candidate for DEV2 (new debug)
+      when: dev2_conn_method == "tunnel" and debugging | bool
+      delegate_to: localhost
+      ansible.builtin.debug:
+        msg:
+          - "LLDP candidate IPv6={{ lldp_dev2_ip6 | default('<none>') }}"
+
+    # Build the remote tunnel target: prefer LLDP IPv6 if present, else 192.168.1.1
+    - name: Build tunnel remote target for DEV2 (prefer LLDP IPv6 when available)
+      when: dev2_conn_method == "tunnel"
+      delegate_to: localhost
+      ansible.builtin.set_fact:
+        dev2_tunnel_target_host: >-
+          {{
+            (lldp_dev2_ip6 is defined and (lldp_dev2_ip6 | string | trim | length > 0))
+            | ternary(
+                '[' ~ (lldp_dev2_ip6 | string | trim) ~ '%' ~ (dev1_iface | string | trim) ~ ']',
+                dev2_host | string
+              )
+          }}
+        dev2_tunnel_target_port: "{{ dev2_port | string }}"
+      changed_when: false
+
+    - name: Debug tunnel remote target for DEV2 (IPv4/IPv6)
+      when: dev2_conn_method == "tunnel" and debugging | bool
+      delegate_to: localhost
+      ansible.builtin.debug:
+        msg:
+          - "dev2_tunnel_target={{ dev2_tunnel_target_host | default(dev2_host) }}:{{ dev2_tunnel_target_port | default(dev2_port) }}"
+
+
     # Set host/port for direct LLDP if auth succeeded
     - name: Set direct LLDP DEV2 SSH host/port
       when: dev2_conn_method == "direct_lldp" and dev2_passfile_used != "NONE"