CCNA Break/Fix: The ACL That Blocks Too Much

Archive lab

Troubleshoot a branch network where an ACL intended to block Telnet ended up blocking everything because it was never applied, and the branch router also lacks a route to the server. Diagnose from the client’s perspective, verify hop-by-hop reachability, and then place the ACL where it will see the traffic while preserving the intended deny. Finish by restoring end-to-end connectivity for all traffic except Telnet to the server.

Learning objectives

• Trace packet flow from a client through a router and understand where an ACL should be applied to affect a given flow
• Interpret extended ACL logic and ordering to preserve intended denies while permitting other traffic
• Validate routing tables and add only the missing static route required for the destination
• Confirm both security and connectivity outcomes from the end host’s perspective

Troubleshooting focus

• Client reaches the transit neighbor but not the server; verify the branch router’s routing table includes a path to the server address per the addressing plan
• A security review reports Telnet should be blocked but is not; inspect whether the ACL exists, where it is applied, and in which direction it processes the flow
• If reachability still fails after adjustments, confirm return-route symmetry on the edge and check ACL counters to ensure the correct ACE is matching