CCNA Break/Fix: Published Services Nobody Outside Can Open

Archive lab

Lab 8 of 13 in CCNA Break/Fix II: Read the Symptom · ← Previous · Next →

CCNA exam domain: IP Services

A DMZ server was rebuilt onto a new IP last week. Since then, outside users cannot open its three published services, while the server itself can browse out normally. Your job: work from the public address toward the inside, diagnose where the forwarding breaks, and republish all three services on the advertised public IP without disrupting outbound internet access.

Learning objectives

• Diagnose external reachability failures for hosted services published via static port translations
• Trace the flow from an outside client through the provider and edge to the inside host using NAT tables
• Isolate breakpoints between policy (published IP/ports), upstream routing, and inside-to-outside translation behavior
• Verify inbound service reachability from the outside and confirm outbound browsing still works after the repair

Troubleshooting focus

• Start from the public IP and test inbound TCP connectivity for each published port from the outside client. Observe connection success vs. refusal vs. timeout.
• Compare the public address on which services are advertised to what the edge translates to internally. Look for address/port reuse conflicts.
• Inspect NAT translations on the edge during your tests. Confirm that inbound flows create the expected entries pointing at the intended inside server.
• Check the upstream router for a path to the site's delegated public block toward the edge. Absence here causes timeouts before NAT can even see the traffic.
• Validate that outbound PAT remains functional so the server can browse out; avoid repairs that break established outbound behavior.