ExamFinch.com My Study

Study guide

2.7 Network Access Troubleshooting

Practice this exam

Cisco Certified Network Associate CCNA

Track your progress as you read

Finished sections get a check mark.

1 Introduction

About the CCNA 200-301 Exam Domains and Weights Study Strategies and Tips

2 Chapter 1: Network Fundamentals (20%)

1.1 Network Components 1.2 Network Topology Architectures 1.3 Physical Interfaces and Cabling 1.4 TCP vs. UDP 1.5 IPv4 Addressing and Subnetting 1.6 IPv6 Addressing and Prefix 1.7 Wireless Principles 1.8 Virtualization Fundamentals 1.9 Switching Concepts 1.10 OSI and TCP/IP Reference Models 1.11 Verifying IP Parameters on Client Operating Systems

3 Chapter 2: Network Access (20%)

2.1 VLANs — Configuration and Verification 2.2 Trunking and 802.1Q 2.3 Layer 2 Discovery Protocols (CDP and LLDP) 2.4 EtherChannel (Link Aggregation) 2.5 Spanning Tree Protocol (STP) and RSTP 2.6 Wireless Architectures and AP Modes 2.7 Network Access Troubleshooting 2.8 Inter-VLAN Routing — Deep Dive

4 Chapter 3: IP Connectivity (25%)

3.1 Routing Table Components 3.2 Router Forwarding Decisions 3.3 IPv4 and IPv6 Static Routing 3.4 Single-Area OSPFv2 — Concepts 3.5 Single-Area OSPFv2 — Configuration 3.6 First Hop Redundancy Protocols (FHRP) 3.7 Troubleshooting IP Connectivity 3.8 OSPF Troubleshooting Scenarios

5 Chapter 4: IP Services (10%)

4.1 NAT (Network Address Translation) 4.2 DHCP and DNS 4.3 NTP, SNMP, and Syslog 4.4 QoS Fundamentals 4.5 TFTP/FTP and Remote Access 4.6 IP Services — Comprehensive Review

6 Chapter 5: Security Fundamentals (15%)

5.1 Key Security Concepts 5.2 Device Access Control and Password Policies 5.3 VPN Fundamentals 5.4 Access Control Lists (ACLs) 5.5 Layer 2 Security Features 5.6 Network Security Best Practices and Hardening 5.7 Threat Mitigation and Incident Response

7 Chapter 6: Automation and Programmability (10%)

6.1 Impact of Automation on Network Management 6.2 Controller-Based and Software-Defined Architectures 6.3 AI and Machine Learning in Network Operations 6.4 REST-Based APIs 6.5 Configuration Management Tools 6.6 JSON-Encoded Data 6.7 Automation and Programmability — Comprehensive Review

2.7 Network Access Troubleshooting

Key Takeaways Explain This Topic AI

Same-VLAN hosts that fail across switches usually have a VLAN missing from the trunk allowed list; verify with show interfaces trunk.

A native VLAN mismatch puts untagged traffic in the wrong VLAN; CDP flags it and show interfaces trunk reveals it.

Speed/duplex mismatch produces late collisions, runts, and CRC errors with degraded throughput; check show interfaces.

EtherChannel members in (s) suspended state have a config mismatch (speed, duplex, VLAN, trunk, or native VLAN).

When a DHCP server is on another subnet, the client VLAN gateway needs ip helper-address pointing at the server.

Last updated: June 2026

A Methodical Layer 2 Approach

Network-access troubleshooting on the CCNA is mostly about reading show output and matching symptoms to causes. Work bottom-up: confirm the physical link ( show interfaces status ), then VLAN assignment, then trunking, then STP, then upper layers. The single most common test trap is treating a Layer 2 problem (wrong VLAN) as a Layer 3 problem (routing/NAT) — same-VLAN hosts never need a router.

VLAN and Trunk Faults

Use this symptom-to-cause table; it covers the majority of access simlets:

  • Symptom Likely cause Verify with
  • Host can't reach gateway, others on switch can Port in wrong access VLAN show interfaces sw
  • Same-VLAN hosts on different switches can't talk VLAN pruned from trunk allowed list show interfaces trunk
  • Intermittent wrong-VLAN delivery, CDP warning Native VLAN mismatch show interfaces trunk
  • Trunk won't come up DTP mismatch (e.g., both auto) show interfaces sw

For the second row, if VLAN 10 is missing under "VLANs allowed and active," run switchport trunk allowed vlan add 10 . For a native VLAN mismatch, align both ends with switchport trunk native vlan 999 .

Physical-Layer Errors: Duplex and Speed

A duplex mismatch (one side full, one half) is a silent killer: throughput collapses under load and you see late collisions on the half-duplex side plus CRC/FCS errors and runts . Speed mismatch usually drops the link entirely. The fix is to hard-set both ends identically or let both auto-negotiate. Read counters with show interfaces gi0/1 — focus on input errors, CRC, collisions, and late collisions.

  • Counter Meaning Common cause
  • Late collisions Collision after 512 bit-times Duplex mismatch
  • CRC / FCS errors Frame checksum failed Bad cable, duplex mismatch, EMI
  • Runts Frame under 64 bytes Collisions, faulty NIC
  • Input drops / overruns Buffer exhausted Congestion, speed mismatch
  • Err-Disabled Ports and STP

A port in err-disabled state forwards nothing. Common triggers: BPDU Guard caught a BPDU on a PortFast port, or port security saw a violation. show interfaces status err-disabled and show errdisable recovery reveal the reason. Recover by fixing the cause, then shutdown / no shutdown . If a port that should forward is blocking , check show spanning-tree — STP may have made it an alternate port, or a lower-priority switch may have unexpectedly become root.

EtherChannel and DHCP

In show etherchannel summary , a member flagged (s) is suspended due to a configuration mismatch — verify identical speed, duplex, VLAN, native VLAN, and trunk mode across all members. Independent (I) ports mean incompatible negotiation modes (e.g., LACP one side, PAgP the other).

Finally, the cross-subnet DHCP case: a client gets no address because its DHCP DISCOVER is a broadcast that routers do not forward. The fix is ip helper-address on the client VLAN's gateway SVI, pointing to the DHCP server's IP. This turns the broadcast into a unicast relay. Without it, clients on a routed VLAN fall back to a 169.254.x.x APIPA address — a tell-tale sign in any DHCP-relay scenario.

Wireless Access Troubleshooting

Layer 2 access troubleshooting on CCNA now includes basic wireless faults. The most common ones map to clear causes. A client that associates but gets no IP usually means the WLAN's VLAN is not trunked to the WLC or the DHCP scope/relay is missing — the same ip helper-address logic as wired. A client that cannot authenticate points to a wrong pre-shared key or a RADIUS server unreachable on UDP 1812. An AP that never comes online typically cannot reach the WLC: check DHCP, the CAPWAP path on UDP 5246/5247, Option 43/DNS discovery, and a software-version mismatch.

Poor coverage or roaming problems are RF issues (channel overlap, low power) handled by the WLC's RF management.

Reading the Right show Command

Matching the symptom to the correct verification command is half the battle. Keep this map handy:

  • Question Command
  • Is the port up and in the right VLAN? show interfaces status / switchport
  • Which VLANs cross this trunk and what is the native VLAN? show interfaces trunk
  • Is a port err-disabled and why? show interfaces status err-disabled; show errdisable recovery
  • Is STP blocking a port that should forward? show spanning-tree
  • Did the EtherChannel bundle correctly? show etherchannel summary
  • Are there CRC/late-collision errors? show interfaces
  • Does the Layer 3 device know the VLAN subnets? show ip route; show ip interface brief
  • Top Troubleshooting Traps

Internalize the patterns examiners reuse. Same-VLAN failure across switches is a trunk allowed-list problem, not routing. Wrong-VLAN delivery of untagged traffic with a CDP warning is a native VLAN mismatch . Late collisions plus CRC errors equal a duplex mismatch . A 169.254 client address equals a missing DHCP relay . An EtherChannel (s) member equals a config mismatch , and an (I) member equals a negotiation-mode mismatch . A port stuck in err-disabled after a host plugs in usually means BPDU Guard or port security fired — fix the cause, then shutdown / no shutdown (or enable errdisable recovery).

Always isolate the layer first: confirm physical and VLAN before blaming routing, because most "network access" faults never leave Layer 2.