Two inside hosts using the same source port left an ASAv PAT as 198.18.60.1:7113 and :40000. Only show xlate tied each outside Zeek flow to its inside host. An ASA clock fault then broke a 5-second time-window join while traffic kept working.
FreeRADIUS returned Filter-Id = "BLOCK-WEB.in" and the IOSv-L2 switch applied its local ACL to the 802.1X session: HTTP/80 denied, ICMP and HTTP/8080 allowed. A missing Filter-Id failed open with full access; a misspelled one failed closed.
A Linux bridge with STP on sent one 802.1D BPDU into a PortFast access port on IOL-L2. BPDU Guard logged SPANTREE-2-BLOCK_BPDUGUARD and err-disabled the port, proven by the capture and syslog. Storm control was rejected by the parser.
Six IKEv2 authorization faults on a FlexVPN hub and spokes. A missing hub authorization reference left Tunnel0 up/down with no SA. A missing export prefix or spoke reference left the SA READY but routes missing. Two show commands split them.
On GRE over IPsec across a 1400-byte provider MTU, ip mtu 1400 and MSS 1360 stalled 2 MB downloads at zero body bytes. The path carried only 1302-byte inner packets. MTU 1302 with MSS 1262 fixed it, verified on the wire.
Adding one LAN to an IPsec VPN: the crypto map needed a permit at each end, and editing an attached crypto ACL flushed the SAs. The static VTI needed one OSPF network statement at site-a, with the same wildcard selectors and SPIs.
A WAN-to-self ZBF policy meant to restrict management kept SSH working, but OSPF hit its dead timer about 8 seconds later and loopback eBGP followed on hold-time expiry. OSPF pass and BGP inspect on both self zone-pairs fixed it.
VLAN 20 PCs get 0.0.0.0 while VLAN 10 is fine. The ip helper-address on R1 points to the wrong host. Find it in five checks, fix the one line, and verify the lease and cross-VLAN ping. Broken and solution .pkt files included.
A Python script changed an FMC access rule with a PUT that returned 200, printed done, and the FTD still blocked TCP/8080. The rule was saved, not deployed. Version 2 sent deploymentrequests, polled the task and proved the traffic.
The bridge was up, ARP resolved through the FTD and the MAC table learned both hosts, yet ping returned 0/4 and HTTP timed out. One bridge member was in the wrong Switched zone, so the ACP fell to its default block. FMC accepted the change.
The file policy was attached and logging, but a ZIP downloaded in full over HTTP with Files 0 in the connection event. The block rule applied to FTP. Selecting HTTP, saving and deploying reset the ZIP while PDF and TXT stayed intact.
PL-File-Block existed in FMC with a ZIP block rule, but ZIP downloads completed with matching hashes and no file events. Allow-Web had File Policy None. Attaching the policy and deploying reset ZIP downloads; PDF and TXT still passed.