Vendor560 problems· 4 reviewed

Cisco

560 incident problems in Cisco environments.

Read first

When DNS changed but some clients still hit the old backendAn InfraTree guide that lays out the first signals to check, the CLI verification order, common misdiagnoses, and a safe recovery path when the DNS record is updated but resolver cache, HTTP/2 keepalive, or client pools hold on to the old target.Network3 min read When firewalld looks open but connections keep getting blockedAn InfraTree guide that lays out the first signals to check, the CLI verification order, common misdiagnoses, and a safe recovery path when a port rule appears to exist but the connection fails because of zone, runtime/permanent drift, source binding, or an upstream firewall.Network3 min read How to separate timeout and connection refused by network pathAn InfraTree guide that lays out the first signals to check, the CLI verification order, common misdiagnoses, and a safe recovery path when DNS, route, firewall, proxy, and listener states all look like the same connection failure.Network3 min read

Recommended problems

Reviewed problems first, then problems with detailed scenarios.

NETWORK-041OSPF neighbors stay in EXSTARTBoth routers can ping each other, but adjacency never reaches full because one side advertises a different interface MTU on the same link.ReviewedNetworkIntermediate21 minFree NETWORK-064ACL shadow rule blocks load balancer health checks from the SNAT poolUser traffic seems permitted on paper, but backends stay marked unhealthy because the firewall never allowed the translated health-check source range.ReviewedNetworkIntermediate18 minFree NETWORK-1611A trunk link comes up and one VLAN still failsOne VLAN still fails right after a renumbering change.ReviewedNetworkBeginner6 minFree NETWORK-1615A BGP session comes up and traffic still exits wrongTraffic still exits the old path after a BGP preference change.ReviewedNetworkBeginner7 minFree NETWORK-019After a BGP route change, only certain ASNs take a detour pathA network operations problem where the global route is alive but only certain carrier networks get an inefficient detour.NetworkAdvanced30 minPro

All problems (560)

NETWORK-064ACL shadow rule blocks load balancer health checks from the SNAT poolUser traffic seems permitted on paper, but backends stay marked unhealthy because the firewall never allowed the translated health-check source range.ReviewedNetworkIntermediate18 minFree NETWORK-041OSPF neighbors stay in EXSTARTBoth routers can ping each other, but adjacency never reaches full because one side advertises a different interface MTU on the same link.ReviewedNetworkIntermediate21 minFree NETWORK-1611A trunk link comes up and one VLAN still failsOne VLAN still fails right after a renumbering change.ReviewedNetworkBeginner6 minFree NETWORK-1615A BGP session comes up and traffic still exits wrongTraffic still exits the old path after a BGP preference change.ReviewedNetworkBeginner7 minFree NETWORK-072LACP bundle never forms after a stack replacementCabling is correct, but the upstream sees a different partner identity and refuses to aggregate the links into the expected bundle.NetworkIntermediate16 minFree NETWORK-107DHCP relay uses the correct helper address but the source interface belongs to the wrong VRF so replies never returnDiscover messages leave the switch, yet offers vanish because the server replies into a routing context that has no path back to the client segment.NetworkIntermediate17 minFree NETWORK-079OSPF virtual link stays downArea IDs still look familiar, but the virtual link cannot form because the transit area assumptions were broken during a partial topology cleanup.NetworkIntermediate17 minFree NETWORK-068Port-channel min-links keeps the bundle down after a partial member failureOne physical path still forwards traffic, but the logical interface remains down because the configured minimum bundle size is no longer satisfied.NetworkIntermediate17 minFree NETWORK-084Spanning-tree guard blocks one hypervisor uplinkThe network configuration is stable, but a host starts sending unexpected bridge protocol units and the protection feature shuts the access port down.NetworkIntermediate17 minFree NETWORK-080MAC flapping alarms appearThe network is stable, but one mobile workload triggers MAC move alarms and intermittent forwarding loss because the switching design assumes slower host movement.NetworkIntermediate18 minFree NETWORK-057Dynamic ARP inspection drops a host after a static IP move without updated bindingsLayer2 connectivity looks normal, but one endpoint stops talking because the protection policy still trusts the old DHCP or ARP binding state.NetworkIntermediate19 minFree NETWORK-033Cross-vendor EtherChannel failsThe bundle comes up on one side only, leaving traffic hashed inconsistently, because the two platforms are not negotiating the channel mode the same way.NetworkIntermediate23 minFree NETWORK-075IPv6 RA guard blocks the real router after a campus template is copied to the uplinkIPv4 still works, but IPv6 clients lose their gateway because the edge protection template was applied to the wrong interface type.NetworkIntermediate15 minFree NETWORK-087Router-on-a-stick subinterface works for one VLAN but the allowed list omits the new segmentInter-VLAN routing exists overall, but the newly added segment remains isolated because the trunk never allowed that VLAN onto the router link.NetworkIntermediate15 minFree NETWORK-094VLAN exists on both switches but VTP pruning removes the path users think is activeThe database is correct, yet traffic still disappears because dynamic pruning removed the VLAN from a trunk users assumed was always carrying it.NetworkIntermediate15 minFree NETWORK-106A QinQ handoff preserves the service VLAN but rewrites the inner PCP bits so voice traffic loses priorityConnectivity remains intact, but quality degrades because the handoff normalizes priority bits the downstream voice design expected to preserve.NetworkIntermediate16 minFree NETWORK-082Access switch uplink looks up but the native VLAN changed and voice phones never get the right DHCP scopeLink status is healthy, yet phone onboarding fails because the expected voice and management traffic classification changed with the trunk native VLAN baseline.NetworkIntermediate16 minFree NETWORK-092EtherChannel load-balancing hash sends one chatty flow over the only degraded member linkMost traffic looks normal, but one application suffers because its flow hash repeatedly lands on the weakened physical member of the bundle.NetworkIntermediate16 minFree NETWORK-069Internal clients cannot reach the public VIPExternal users connect normally, yet internal users fail on the same FQDN because the firewall does not hairpin the connection back to the inside service path.NetworkIntermediate16 minFree NETWORK-103Root guard blocks the intended new spanning-tree root after maintenance and access switches stay pinned to the old pathThe maintenance plan is correct, yet the protection feature prevents the desired root election because the uplink role changed during rewiring.NetworkIntermediate16 minFree