CCNA: Secure Branch Edge Capstone (ACL/PAT/DHCP/SSH)

Today's daily lab

One-branch edge capstone that unifies DHCP for the LAN, PAT overload to an Internet server, an extended ACL that permits HTTP but denies SSH, and SSH-only management. The starting lab intentionally contains multiple faults across DHCP, NAT, and SSH so you must diagnose and repair the edge to achieve full end-to-end verification from the client.

Learning objectives

• Deploy and verify a DHCP pool on the branch edge to serve the LAN
• Configure PAT (NAT overload) to reach an Internet web server
• Author and correctly place an extended ACL to permit HTTP while denying SSH from the LAN
• Harden remote access by enabling SSH-only local authentication on the edge
• Troubleshoot multiple, independent misconfigurations across NAT, ACL, DHCP, and SSH to restore end-to-end service

Troubleshooting focus

• Identify NAT inside/outside role reversals that prevent translations
• Detect a DHCP pool with an incorrect default gateway handed to clients
• Recognize an incomplete SSH management plane (missing RSA keys/domain) that blocks remote login
• Place the extended ACL inbound at the source LAN and order ACEs so required control/management (DHCP, SSH-to-edge) is not broken
• Prove resolution with translation table entries, ACL hit counters, and successful host-initiated tests