Competition Checklist · 05 · Cisco / Networking
Cisco & Networking Checklist
Review interfaces, VLANs, trunks, Layer 3 addressing, routing, ARP, ACLs, VTY access, SSH, port security, logging, and required reachability in a deliberate troubleshooting order.
Network problems are often caused by a lower layer than the one that first looks suspicious. Check physical and switching state before rewriting routing or security policy.
Quick Use
Network rule
Troubleshoot from the lower layers upward
If a host cannot reach a destination, do not jump directly to ACLs or routing. Confirm interface state, VLAN membership, trunking, and Layer 3 addressing first.
Opening pass
Understand the network before changing it
Read the network mission before changing interfaces, VLANs, trunks, routes, ACLs, or management access.
Required connectivity, management paths, VLAN membership, routing, and allowed services may be explicitly defined by the scenario.
Record the expected topology and required reachability.
You need a trusted picture of which devices, VLANs, subnets, and services must communicate before troubleshooting.
Capture the current running configuration and interface state.
A baseline lets you compare before and after changes and preserves evidence if a configuration needs to be reversed.
Confirm management access requirements.
SSH, console, VTY restrictions, and management VLAN access should match the mission before you tighten them.
Check physical and data-link state before changing routing.
A routing problem can actually be a shutdown interface, wrong VLAN, trunk issue, or access-port mismatch.
Prioritize broken required connectivity and broad security exposure first.
A failed required path, unrestricted management access, or overly broad ACL deserves attention before cosmetic cleanup.
Interfaces
Start with physical and interface state
Interface summary
show ip interface brief
show interfaces status
Required interfaces are up, expected addresses are present, and shutdown state matches the design.
Interface details
show interfaces
Review errors, duplex, speed, line protocol, drops, and unusual traffic before changing configuration.
Switchport mode
show interfaces switchport
Access and trunk modes match the intended topology.
Description and ownership clues
show running-config | section interface
Descriptions, addresses, VLAN settings, and shutdown state align with the mission.
VLANs & trunks
Confirm Layer 2 segmentation and transport
VLAN database
show vlan brief
Required VLANs exist and access ports are assigned correctly.
Trunk state
show interfaces trunk
Trunk links are operational and carry every VLAN required by the scenario.
Access-port membership
show interfaces switchport
Endpoints are in the correct access VLAN and no unexpected dynamic behavior is present.
Native VLAN
show interfaces trunk
Native VLAN settings are consistent across both sides of a trunk when required.
Routing
Verify Layer 3 paths after Layer 2 is healthy
Routing table
show ip route
Required networks have expected connected, static, or learned routes.
Layer 3 interfaces
show ip interface brief
show running-config | section interface
SVIs or router subinterfaces have the correct addresses and are operational.
ARP table
show ip arp
Layer 2 and Layer 3 neighbor information is consistent with expected hosts.
Reachability tests
ping <destination>
traceroute <destination>
Test one hop at a time and use failures to narrow the problem instead of guessing.
ACLs
Review policy order, placement, direction, and counters
Configured ACLs
show access-lists
show ip access-lists
ACL entries match the intended policy and broad permits or denies are investigated carefully.
ACL placement
show running-config | include access-group
show running-config | section interface
The correct ACL is applied to the correct interface and direction.
ACL counters
show ip access-lists
Counters help prove which rules are actually matching traffic.
Rule order
show running-config | section access-list
Specific required policy is not shadowed by an earlier broad permit or deny.
Management access
Protect VTY and SSH without losing approved administration
VTY configuration
show running-config | section line vty
Remote management methods and access restrictions match the mission.
SSH status
show ip ssh
SSH is enabled and configured appropriately when remote management is required.
Local users
show running-config | include username
Only approved local management users remain.
AAA configuration
show running-config | include aaa
Authentication policy is understood before changes are made.
Port security
Understand violations before recovering access ports
Port security summary
show port-security
Protected ports and violation state match the intended endpoint policy.
Interface port security
show port-security interface <interface>
Maximum addresses, learned addresses, and violation mode are appropriate for the scenario.
Err-disabled interfaces
show interfaces status err-disabled
Investigate the actual cause before re-enabling a port.
MAC address table
show mac address-table
Learned MAC addresses are consistent with expected devices and VLANs.
Logging & neighbors
Use device evidence to validate changes and topology
System logging
show logging
Interface changes, security events, and protocol messages are reviewed before configuration changes erase context.
Configuration changes
show archive log config all
Use when supported to identify recent administrative changes.
CDP neighbors
show cdp neighbors detail
Neighbor information helps confirm topology and connected-device expectations.
LLDP neighbors
show lldp neighbors detail
Use when LLDP is enabled to validate physical relationships.
Troubleshooting order
Follow the path instead of guessing
Physical / interface
Is the interface up? Is the line protocol up? Are there obvious errors or shutdown state?
VLAN / switchport
Is the endpoint in the right access VLAN? Are required VLANs present?
Trunk
Is the trunk operational and carrying the VLAN that needs to cross it?
Layer 3 interface
Does the SVI or router subinterface have the correct address and operational state?
Routing
Does the routing table contain the destination network and the expected next hop?
Policy
Could an ACL, management restriction, or port-security state be blocking the path?
Verify
Retest the exact required path and confirm no other required traffic was broken.
High-priority findings
Correct the smallest confirmed fault
Required VLAN missing from a trunk
Confirm the intended VLAN list on both ends of the link, preserve the current configuration, then add only the missing required VLAN.
Broad permit before intended deny rules
Review ACL order and counters, confirm the required policy, then correct the minimum set of entries needed.
Telnet enabled when SSH is required
Confirm approved management access, verify SSH works, then restrict VTY transport to the required secure method.
Unexpected local management user
Preserve the username and configuration evidence, compare with the approved roster, then remove only if unauthorized.
Err-disabled access port
Determine whether port security, BPDU guard, link flapping, or another cause triggered the state before re-enabling it.
Required route missing
Confirm interface and VLAN state first, then restore only the route required by the network design.
Do not blindly change
Common Cisco competition overreactions
Do not erase or reload a device before preserving the running configuration.
Do not change routing before checking interface, VLAN, and trunk state.
Do not remove ACLs simply because traffic is failing.
Do not permit all traffic just to make a ping succeed.
Do not disable port security without understanding why a violation occurred.
Do not change every trunk to allow all VLANs.
Do not remove management restrictions before confirming the approved administration path.
Do not save an unverified configuration just because one symptom improved.
Verification sweep
Prove the network still satisfies the mission
Interfaces
Required interfaces are up and error state is acceptable.
VLANs
Required VLANs exist and access ports are assigned correctly.
Trunks
Required VLANs cross the intended trunk links.
Routing
Required networks are present in the routing table and next hops are correct.
ACLs
Policy permits required traffic and blocks only what the mission intends.
Management
Approved SSH or console management still works and unauthorized methods are restricted.
Port security
Protected access ports remain usable for approved devices.
Reachability
Required endpoints and services can communicate after every major change.
Cisco & Networking final checklist
Save only after the required paths verify
The network mission and expected topology were reviewed before configuration changes.
The running configuration was preserved before remediation.
Required interfaces are operational.
Required VLANs exist.
Access ports are assigned to the correct VLANs.
Trunks carry all required VLANs.
Layer 3 interfaces and subinterfaces have the expected addressing.
Required routes exist.
ACL order, placement, direction, and counters were reviewed.
Remote management access matches the mission.
Approved local management users match the final configuration.
Port-security state was reviewed on relevant interfaces.
Err-disabled interfaces were investigated before recovery.
Neighbor and MAC information were used to validate topology where helpful.
Required reachability was retested after changes.
The final configuration was saved only after verification.