ACL Troubleshooting Capstone: Classic Faults, NAT, Placement

Bundle lab · $29.99

Diagnose and repair an ACL + NAT policy on a small branch-to-DC topology. Implement PAT on the branch edge, correctly place an extended ACL to filter pre-NAT traffic, prove a permitted flow and a denied flow from the end host, and validate with show commands.

Learning objectives

• Place and apply ACLs with the correct type and direction: extended ACL inbound near the source, standard ACLs for NAT match lists.
• Identify and avoid classic ACL faults: wrong wildcard mask, wrong interface/direction, rule order, and missing explicit permits.
• Understand NAT + ACL interaction: filter pre-NAT addresses, verify translations, and ensure the ACL sees the original source.
• Restore the intended selective policy: allow ICMP while denying TCP/80 to the DC server; prove both permit and deny from the client.
• Use show access-lists, show ip interface, and show ip nat translations to verify state and counters.

Troubleshooting focus

• Verify every link's interface status and IP addressing (`show ip interface brief`) and correct any interface that is down or misaddressed.
• Confirm each device's running configuration matches the lab objective, and bring any interface, route, or service that is not in its expected state back to health.
• Trace end-to-end reachability with ping/traceroute and isolate the first hop where forwarding fails.