ACL Troubleshooting Capstone: Classic Faults, NAT, Placement

Bundle lab

Advanced ACL and NAT capstone, run as a fault hunt. A branch site was cut over last night and the policy does not behave: the flow that should be blocked gets through, other traffic does not come back at all, and nobody recorded what changed. You get symptoms and the required end state — no fault list. The faults span all three routers and include a shadowed ACE and a policy applied on the wrong side of NAT, so translated addresses hide the very hosts the rules name. Expect fixing the first one to change the symptom rather than clear it.

Learning objectives

• Diagnose an ACL and NAT policy failure from operational state alone, with no list of what was broken
• Recognise a shadowed ACE — a broad permit above a specific deny — that no show command flags as an error
• Reason about ACL placement relative to NAT, where filtering post-translation hides the source addresses the policy matches on
• Distinguish a filtering fault from a routing fault when both are present and produce the same user-visible symptom
• Repair faults on whichever device holds them, across a three-router path

Troubleshooting focus

• HTTP to SRV-WEB01 still gets through and the deny never increments: the policy is not in the forward path. show ip interface Ethernet0/1 must list BRANCH-WEB-POLICY inbound — on the WAN, or applied outbound, an extended ACL never sees client-to-server traffic.
• A broad permit takes the hits instead of the TCP/80 deny: read show access-lists BRANCH-WEB-POLICY in evaluation order.
• An entry matches more or fewer hosts than intended: check the wildcard math. The users subnet wildcard inverts the /24 mask to 0.0.0.255; single-host entries use the host-only wildcard equivalent.
• If SSH fails, confirm your client IP is permitted by VTY-MGMT.