Cisco Device Troubleshooting

Host cannot reach its gateway

1. Check host IP, mask, gateway, and duplicate address risk.
2. Check switch interface state and description.
3. Verify static access mode and access VLAN.
4. Verify the VLAN exists and is active.
5. Verify STP is forwarding on the host port and uplinks.
6. Verify the host MAC appears on the expected port and VLAN.
7. Verify the gateway SVI or router subinterface is up.

show interfaces status
show interfaces <port> switchport
show vlan brief
show spanning-tree interface <port> detail
show port-security interface <port>
show mac address-table interface <port>
show interfaces trunk
show ip interface brief

VLAN works on one switch but not another

1. Confirm the VLAN exists on both switches.
2. Confirm the interswitch link is operationally trunking.
3. Check the allowed VLAN list in both directions.
4. Check native VLAN consistency.
5. Check STP state for the affected VLAN.
6. Check EtherChannel state when the trunk uses a port-channel.

show vlan brief
show interfaces trunk
show interfaces <uplink> switchport
show spanning-tree vlan <vlan-id>
show etherchannel summary

STP blocks the wrong path

1. Identify the actual root bridge for the VLAN.
2. Check bridge priorities and root path costs.
3. Check interface cost and port-priority overrides.
4. Confirm the topology matches the intended root placement.
5. Check for root guard or loop guard inconsistency.

show spanning-tree vlan <vlan-id>
show spanning-tree root
show spanning-tree interface <port> detail
show spanning-tree inconsistentports

EtherChannel member is suspended or standalone

1. Compare channel protocol and mode on both ends.
2. Compare speed, duplex, trunk mode, native VLAN, and allowed VLANs.
3. Check whether configuration belongs on the port-channel interface.
4. Check LACP or PAgP neighbor information.

show etherchannel summary
show etherchannel port-channel
show lacp neighbor
show pagp neighbor
show interfaces trunk
show running-config interface port-channel <id>

Route is missing

• The outgoing interface must be operational.
• The next hop must be recursively reachable.
• A floating static route installs only when lower-AD alternatives disappear.
• OSPF must advertise and accept the prefix.
• A more specific route can change the selected path.

show ip route
show ip route <destination>
show ip cef <destination>
show ip protocols
show running-config | include ^ip route

OSPF neighbors do not reach FULL

show ip ospf neighbor
show ip ospf interface <interface>
show ip ospf interface brief
show ip ospf database
show ip protocols
show logging

Inter-VLAN routing fails

1. Verify every VLAN exists.
2. Verify access ports are in the intended VLAN.
3. Verify trunks allow all required VLANs.
4. For router-on-a-stick, verify subinterface VLAN tags.
5. For a multilayer switch, verify ip routing.
6. Verify each SVI or subinterface is up with the correct gateway address.
7. Check ACLs between VLANs.

Asymmetric or intermittent routing

• Run sourced pings from every relevant interface.
• Compare traceroute in both directions.
• Check equal-cost paths and per-flow hashing.
• Check stateful firewalls and NAT for asymmetric paths.
• Check route flaps and interface transitions in logs.

DHCP client gets no address

1. Verify the client VLAN and link.
2. Verify the DHCP pool network, exclusions, and remaining addresses.
3. If the server is remote, verify ip helper-address on the client gateway interface.
4. Verify routing between relay and server.
5. Check DHCP snooping trust on the server-facing path.
6. Check conflicts and bindings.

show ip dhcp pool
show ip dhcp binding
show ip dhcp conflict
show running-config interface vlan <id>
show ip dhcp snooping
show ip dhcp snooping binding

NAT or PAT does not translate

1. Verify the inside and outside interface roles.
2. Verify the NAT ACL matches the real inside source.
3. Verify a route exists to the outside destination.
4. Generate new traffic after clearing only when safe.
5. Check translation and statistics counters.
6. Verify the return traffic reaches the outside interface.

show ip nat statistics
show ip nat translations verbose
show access-lists
show ip route
show running-config | include ip nat

ACL blocks valid traffic

1. Confirm the actual protocol, source, destination, and ports.
2. Read the ACL top to bottom.
3. Check for a broader deny before the intended permit.
4. Check interface and direction.
5. Check counters before and after a controlled test.
6. Remember the implicit deny.

show access-lists
show ip interface <interface>
show running-config interface <interface>

SSH fails

1. Verify IP reachability to the management address.
2. Verify hostname and domain name exist.
3. Verify RSA keys and SSH version 2.
4. Verify a valid local user or AAA method.
5. Verify VTY lines use login local or the intended method.
6. Verify transport input ssh.
7. Check VTY access-class source restrictions.

show ip ssh
show ssh
show users
show running-config | section line vty
show access-lists