AdvancedPublished 2026-08-29
CCNA Break/Fix: The ACL That Blocks Too Much
Archive lab
Lab 6 of 7 in CCNA Break/Fix: Diagnose and Repair · ← Previous · Next →
Branch staff cannot reach the server at 172.16.100.100, and they cannot close a day's tickets without it. Policy also requires Telnet from the user LAN to that server be denied while everything else passes, and the security review cannot confirm it is being enforced. Work the path from a client and find what is wrong.
Learning objectives
- Trace a flow from CLIENT01 to 172.16.100.100 and confirm every hop forwards it
- Verify from the forwarding tables that every router in the path has a route to 172.16.100.100
- Distinguish a flow a filter is not seeing from a flow a filter is denying
- Confirm a filter is acting on a flow from its match counts, not from a failed connection
Troubleshooting focus
- CLIENT01 and CLIENT02 both reach their gateway and neither reaches the server —
show ip routeon the routers in the path, against the addressing plan - The security review cannot show a single blocked Telnet attempt —
show ip access-lists 101for entries and match counts - CLIENT01's ping to the server worked a minute ago and now times out —
show ip interfaceon both of RTR-BR1's interfaces to see what is bound where
Topology
Subscribe to preview this lab's topology.
See plansGrade your work
How this lab is graded
- Build it your way. Where a lab lets you choose a value — a VLAN name, an interface description — grading checks that you configured it, not which name you picked. Names that another line has to reference, like an ACL applied with
access-class, are stated in the guide and do have to match. - Addresses, modes and protocol keywords are exact. An IP address, a subnet mask,
switchport mode trunk, an encapsulation — these carry the meaning of the lab, so they are graded as written in the guide. - Grading reads your saved configuration. Export the lab from CML after you have configured it, and make sure anything you set is in the
running-config— a change that only exists in a terminal session never reaches the grader. - You can submit as many times as you like. Your best score stands, and each attempt tells you which checks passed so you can work the gaps.
- Scored something you believe is correct? Use Report an issue on this page — that is exactly how the grading fixes in the changelog got found.
Create a free account to submit your lab for grading.
Create a free accountFound a problem with this lab?
Please sign in to report a problem — tying it to your attempts lets us reproduce and fix it faster.