You have configured an AOS-CX switch to use UBT with a UBT reserved VLAN.

With User-Based Tunneling and a reserved VLAN, the access switch does not locally place the client into the final user VLAN. Instead, the switch assigns the client to a port-access role that specifies the gateway zone and gateway role. The traffic is tunneled to the gateway, and the gateway role then applies the client’s policy and VLAN assignment. Since VLAN 42 is the client VLAN for the tunneled role, it must be configured in the contractors-gw role on the gateway. It should not be configured on intermediate links or access switch client-facing ports. Configuring it in the switch role would be appropriate for local forwarding, but this scenario uses UBT with gateway-based role enforcement.