The parent task T196665 is for replacing bast2001 with bast2002.
This has happened in puppet. The new host has the same role and has been added to network::constants.
It can be used as a jump host to get to other servers just fine.
But.. it can not connect to the mgmt network.
This has been reported by @Papaul and i could also confirm it with the test host cobalt.mgmt.eqiad.wmnet.
If i proxy via bast2001 i can get there, if i proxy via bast2002 i can NOT connect.
This does not seem to be anything i can influence in puppet as opposed to the ferm rules that already changed.
Please check in router ACLs and allow bast2002 the same as exisiting rules for 2001.
You can add it in parallell or also just replace 2001 with 2002 since we want to decom the old host anyways.