Security features are the only thing on a network designed to make traffic fail. That makes the tickets sneaky: the network is doing exactly what it was told, and what it was told is wrong. An ACL silently drops the traffic it was meant to permit, a secured port shuts itself, a management ACL locks out the very engineer trying to fix it. This lab gives you three security tickets on the five-node base topology. It is part of the PingLabz CCNA Troubleshooting Labs, fits Cisco Modeling Labs Free, and every output was captured on Cisco IOS XE.
The topology and healthy state
R1 and R2 share the LAN 10.20.0.0/24 through SW1; R2 is the border to R3 and runs PAT toward the outside. HOST1 hangs off SW1's Et0/2. R1 (10.20.0.1) is the inside host you test from. Healthy, the LAN reaches the internet host 10.255.0.3 and you can manage the routers remotely. These three tickets each break that with a security control that was applied carelessly.
Lab setup: this topology boots with all three faults already in place. Two of them live on R2, and one of those, the LAN ACL in Ticket 1, is applied inbound on the LAN interface, so it blocks everything the LAN sends into R2, including management sessions to R2 itself. That means it masks the VTY fault in Ticket 3: until the ACL is fixed, a telnet to R2 fails for the wrong reason. Fix Ticket 1 first. The port-security fault on SW1 (Ticket 2) is genuinely independent and can be worked any time.
What you will learn
- How to tell an ACL drop from a routing drop by reading the single character in a ping.
- Why an ACL applied inbound blocks on the pre-NAT destination, so a naive source/destination swap is not enough to fix it.
- How to recognize and recover an
err-disabledport from a port-security violation. - How a VTY
access-classlocks out a management subnet, and why a data-plane ACL can hide that symptom entirely.
Ticket 1: "Nobody on the LAN can reach anything"
Reported symptom: "After a security change last night, the whole LAN lost reachability. Routing wasn't touched."
Success criterion: an inside host can reach 10.255.0.3 again.
R1# ping 10.255.0.3 source 10.20.0.1
U.U.U
Success rate is 0 percent (0/5)Read the U. That is an active rejection: a router in the path is administratively refusing the packet, not silently dropping it. Routing drops time out with dots; an ACL deny answers with an unreachable. Find the ACL on R2:
R2# show ip access-lists LAN-FILTER
Extended IP access list LAN-FILTER
10 permit ip 10.30.30.0 0.0.0.3 10.20.0.0 0.0.0.255
R2# show ip interface Ethernet0/0 | include access list
Inbound access list is LAN-FILTER