zNetLaB › Guided labs › Enterprise
Troubleshoot — the web server is up and nobody can reach it
Enterprise Intermediate 5 devices 3 checked tasks 100 points Plan lab
The server is running, the routing is right, ping works — and the browser times out. Something in the path is blocking port 80 specifically. Find the list, find where it is applied, and fix it without opening everything. You build it in a browser, type real commands at each device, and every task below is
checked against the running configuration — so you find out it is wrong before anybody else does.
Open this lab in the simulator
The simulator runs in your browser with nothing to install. This lab is part of the full simulator: open it free for 7 days with a new account, then with a plan. It needs an account, which keeps your progress.
The scenario
The server is running, the routing is right, ping works — and the browser times out. Something in the path is blocking port 80 specifically. Find the list, find where it is applied, and fix it without opening everything.
Your role: a network engineer on the enterprise team. Level: Intermediate Done when: all 3 goals show as passed (100 points).
Network status
Devices: 1 router, 1 switch, 2 PCs, 1 server, cabled as drawn. No Layer 1 or Layer 2 faults: every link is connected and up. R1 starts with addresses (G0/0 10.0.1.1/24, G0/1 10.0.2.1/24) and an ACL already configured. PC1 is a host with 10.0.1.11/24, gateway 10.0.1.1. PC2 is a host with 10.0.1.12/24, gateway 10.0.1.1. Server is a host with 10.0.2.10/24, gateway 10.0.2.1. SW1 starts with an empty configuration. Known problems
The network worked and now does not: the scenario above says what users report. The cause is a configuration fault, not a cable. Find it with show commands (interfaces, routes, neighbours, running-config) before you change anything; fix only what is wrong. Goals
The blocking ACL is no longer applied to the server interface (40 pts) PC1 can fetch the web page (40 pts) Ping still works (nothing else changed) (20 pts) The activity, in order
The blocking ACL is no longer applied to the server interface Why: This is the task that checks your configuration directly: the line must really be there, not just look right. Verify with: show running-config PC1 can fetch the web page Why: Each goal is a state the lab can check on the running device. Verify with: show running-config Ping still works (nothing else changed) Why: A ping needs a route in BOTH directions. This is the end-to-end proof that everything before it worked. Verify with: ping 10.0.2.10 Tips
Work in the order given: later goals depend on the earlier ones. After every change, run the verify command before moving on; do not guess. Stuck? Read the verify output first. It names the interface, neighbour or route that is wrong. Common mistake: Deleting the whole ACL and exposing the network Common mistake: Changing the server when the filter is the problem Common mistake: Looking at the inbound list when it is applied outbound Why this matters
An ACL can silently break one service while ping, DNS and everything else works. Finding it means asking where traffic is filtered: show access-lists (with match counters) and show ip interface name the list and the direction.
What you will be able to do
Find which ACL is applied where and in which direction
Use match counters to see which line is dropping the traffic
Remove or fix the entry without opening everything
The network
ISR 2911, Catalyst 2960-24TT, PC, Server — 5 devices in all, already cabled.
Fa0/1 Fa0 Fa0/2 Fa0 Gi0/1 Gi0/0 10.0.1.1/24 Gi0/1 10.0.2.1/24 Fa0 R1 SW1 PC1 10.0.1.11/24 · gw 10.0.1.1 PC2 10.0.1.12/24 · gw 10.0.1.1 Server 10.0.2.10/24 · gw 10.0.2.1 Drawn from this lab: devices, cables, ports and the addresses already set. Device Model Address already set
R1 ISR 2911 configure it SW1 Catalyst 2960-24TT configure it PC1 PC 10.0.1.11 / 255.255.255.0 gw 10.0.1.1 PC2 PC 10.0.1.12 / 255.255.255.0 gw 10.0.1.1 Server Server 10.0.2.10 / 255.255.255.0 gw 10.0.2.1
Cabling
SW1 Fa0/1 ↔ PC1 Fa0 SW1 Fa0/2 ↔ PC2 Fa0 SW1 Gi0/1 ↔ R1 Gi0/0 R1 Gi0/1 ↔ Server Fa0
What is configured at the start
These are already configured when the lab opens — including, where this is a troubleshooting lab, the fault itself:
R1 interface g0/0
ip address 10.0.1.1 255.255.255.0
no shutdown
exit
interface g0/1
ip address 10.0.2.1 255.255.255.0
no shutdown
exit
ip access-list extended WEB-BLOCK
deny tcp any host 10.0.2.10 eq 80
permit ip any any
exit
interface g0/1
ip access-group WEB-BLOCK out
exit Tasks, and how each one is checked
Every task is decided by reading the live network — a neighbour in FULL, a ping that succeeds, a line in the running configuration — not by looking for a keyword you typed. The same command shows you what the lab sees.
# Task Pts How to verify it yourself
1 The blocking ACL is no longer applied to the server interface 40 On R1: show running-config contains the line(s) matching interface GigabitEthernet0/1 … ip access-group \S+ out must not . 2 PC1 can fetch the web page 40 From PC1, fetching http://10.0.2.10 must work (the browser, or curl http://10.0.2.10). 3 Ping still works (nothing else changed) 20 On PC1: ping 10.0.2.10 must succeed.
Stuck? Ask the coach
Tell the coach what you see or what you tried. It gives you a hint, not the answer, the way a senior engineer would. Included with a free trial or any plan.
Ask the coach
Common mistakes
Deleting the whole ACL and exposing the network
Changing the server when the filter is the problem
Looking at the inbound list when it is applied outbound
Reference solution
Try it yourself first — the lab checks your work either way. This is one configuration that makes every task pass, device by device:
R1 interface g0/1
no ip access-group WEB-BLOCK out
exit Where this is examined
CCNA (ACLs), CCNP ENARSI (troubleshooting), Network+ (firewall and ACL issues).
This lab practises these topics in the zNetLaB certification courses:
Related labs
Where to start
The lessons all guided labs plans
CCNA®, CCNP® and Cisco® are trademarks of Cisco Systems, Inc. zNetLaB is not affiliated with or endorsed by Cisco.