CloudLabBox
Try the free demo

CCNA lab 43 of 46

Troubleshooting IP services and ACLs

Three LANs depend on one edge router for DHCP, DNS and Internet access, and every service has broken in a different way. Find seven faults across exclusions, a relay, a pool option, NAT interfaces and ACL, a DNS record and a filter that blocks name resolution.

Run this lab

It needs Lite: its 6 nodes are set to 6 vCPU and 5,632 MB in total. That fits the free demo too.

In your workspace: Shared, then CCNA 200-301 guided labs, then 43 - Troubleshooting IP services and ACLs

Try it free for 30 minutesRun it on Lite from £3 a day

The free demo needs no card and no email. Every lab plan includes every guided lab.

Level
Advanced
Time
About 60 minutes
Nodes need
6 vCPU, 5,632 MB
Smallest plan
Lite

The scenario

At Larkhill Tutors, the edge router EDGE provides DHCP and DNS for three LANs and translates everything to the Internet (PAT). After an "audit clean-up", calls are coming in from all three LANs:

  • LAN1 (H1): "My laptop gets no address." and later "Websites don't open by name."
  • LAN2 (PC2): "I get an address but can't reach anything outside."
  • LAN3 (PC1): "No address at all."
  • Everyone: "web.isp.lab doesn't load even when the name works."

There are seven faults. The ISP's web server is 198.51.100.1 (web.isp.lab).

Design:

ItemDesign
DHCPEDGE serves LAN1 directly and LAN2/LAN3 through DIST's relay (helper 10.0.12.1 on both DIST LAN interfaces); exclude .1–.20 in each LAN; gateway is .1 in each LAN; DNS 10.43.1.1
DNSEDGE answers for web.isp.lab → 198.51.100.1
NATPAT on EDGE Gi0/0 for 10.43.1.0/24, 10.43.2.0/24 and 10.43.3.0/24; Gi0/1 and Gi0/2 are inside, Gi0/0 outside
FilteringLAN1-IN on EDGE Gi0/1 may block risky traffic, but never DNS or DHCP

What you’ll practise

  • Troubleshoot DHCP servers, relays and pool options
  • Troubleshoot name resolution from the client to the record
  • Troubleshoot NAT inside/outside roles and the NAT ACL
  • Find an ACL entry that blocks a service
  • Work from symptoms to evidence across several services at once

The tasks

  1. LAN1: no address
  2. LAN3: no address
  3. LAN2: address but no Internet
  4. NAT
  5. DNS
  6. Fix everything and prove it

The Lab Tasks pane has the scenario, these tasks, the checks to run, hints and the full solution.

Topology and devices

The network as it opens in EVE-NG, drawn from the lab’s own canvas, and the image each node runs.

Topology of Troubleshooting IP services and ACLs6 nodes, 5 links. Every link is listed as text below the diagram.EDGEDISTISPH1PC2PC1Gi0/2Gi0/0Gi0/1eth0Gi0/2eth0Gi0/1eth0Gi0/0Gi0/0
6 nodes, with the interface names each link uses. On a narrow screen, scroll the diagram sideways.
Every link, as text
  • EDGE Gi0/0 to ISP Gi0/0
  • EDGE Gi0/1 to H1 eth0
  • EDGE Gi0/2 to DIST Gi0/0
  • DIST Gi0/1 to PC2 eth0
  • DIST Gi0/2 to PC1 eth0
Nodes in Troubleshooting IP services and ACLs, with the image each runs and the vCPU and RAM it’s set to
NodeDeviceImage in Add NodeSet to
EDGECisco IOSvvios-adventerprisek9-m.SPA.159-3.M61 vCPU, 1,024 MB
DISTCisco IOSvvios-adventerprisek9-m.SPA.159-3.M61 vCPU, 1,024 MB
ISPCisco IOSvvios-adventerprisek9-m.SPA.159-3.M61 vCPU, 1,024 MB
H1Alpine Linuxclbalpinebase-alpine-base-3-20-31 vCPU, 512 MB
PC2VPCS hostBuilt in to EVE-NGCounted as 1 vCPU, 1,024 MB
PC1VPCS hostBuilt in to EVE-NGCounted as 1 vCPU, 1,024 MB

How to open this lab

  1. Sign in to your workspace at lab.cloudlabbox.com.

  2. In File Manager, open Shared, then the folder CCNA 200-301 guided labs.

  3. Open 43 - Troubleshooting IP services and ACLs and start its nodes, then open Lab Tasks for the scenario and the steps.

The lab is read-only. You can start the nodes and configure the devices, but changes to the topology can’t be saved. To change it, rebuild it in your own folder.

More CCNA labs

All CCNA labs

Related labs in other courses

CloudLabBox is independent of Cisco. The lab follows exam topics and isn’t vendor training material; vendor names identify the exams and the images in the workspace.