Back
Lesson 1 of 5

Troubleshooting Approaches

Lab Objectives

  • Compare three troubleshooting approaches: bottom-up, top-down, and divide-and-conquer, and apply each to isolate network faults.
  • Practice specific IOS show/debug commands and interpret their output to locate and fix connectivity problems in the provided topology.

Lab Tasks (Try It Yourself First!)

Complete these tasks WITHOUT looking at the solution below. Use ? and show commands to figure it out.

ASCII topology (use this exact topology for all tasks — all interface IPs are shown):

                    [Internet]
                   203.0.113.1
                        |
                   R1 (Gateway)
                  Gi0/0: 10.10.10.1
                  Gi0/1: 10.10.20.1
                  Gi0/2: 10.10.30.1
                  /     |     \
               R2      R3      R4
   Gi0/0: 10.10.10.2   Gi0/0: 10.10.20.2   Gi0/0: 10.10.30.2
   Gi0/1: 10.10.40.1    |                    |
              /  \      |                    |
           S1    S2    S3                   |
          /  \    |   /  \                 ...
        PC1  PC2 PC3 PC4  PC5

IP addressing reference (use these exact networks/addresses when applicable):

  • R1: Gi0/0 = 10.10.10.1, Gi0/1 = 10.10.20.1, Gi0/2 = 10.10.30.1
  • R2: Gi0/0 = 10.10.10.2, Gi0/1 = 10.10.40.1
  • R3: Gi0/0 = 10.10.20.2
  • R4: Gi0/0 = 10.10.30.2
  • Networks: 10.10.10.0/24, 10.10.20.0/24, 10.10.30.0/24, 10.10.40.0/24
  • VLANs: VLAN 10 = 192.168.1.0/24, VLAN 20 = 192.168.2.0/24, VLAN 30 = 192.168.3.0/24
  • Public Internet simulation: 203.0.113.0/24

Task 1: Bottom-up troubleshooting

Starting from the physical layer, systematically test toward the network layer to locate why PC1 (192.168.1.10) cannot reach PC3 (192.168.2.20). Document each check and result.

Task 2: Top-down troubleshooting

Begin at the application/network perspective (attempt an end-to-end ping/traceroute) and work down into device configuration to find the fault between PC1 and PC3.

Task 3: Divide-and-conquer troubleshooting

Use the divide-and-conquer strategy: test connectivity to midpoint devices (PC gateway, upstream router, R1) to quickly narrow the failing segment between PC1 and PC3.

Think About It: Why might you pick one approach over another in a production datacenter where downtime costs are high? Which approach gives fastest isolation when you have limited time?

Lab Solution

Task 1 Solution: Bottom-up troubleshooting

What we are doing: Bottom-up starts at the physical and data-link layers and ascends to the network layer. We confirm interfaces are up, VLANs/trunks exist, MAC learnings are correct, and finally routing is present.

Step A — Verify switch physical/interface status (example on S1)

show interfaces status

What it does: lists switch ports, their VLAN, duplex, speed, and status. Why it matters: a down/no-connect or wrong VLAN will block traffic before IP routing occurs.

Verify expected output (example):

Port      Name               Status       Vlan       Duplex  Speed Type
Gi0/1                        connected    10         full    1000 10/100/1000BaseTX
Gi0/2                        connected    10         full    1000 10/100/1000BaseTX
Gi0/3                        trunk        1          full    1000 10/100/1000BaseTX

Explanation: Ports to PC1/PC2 should be in VLAN 10 and show "connected". The trunk toward R2 should be trunking (or access depending on design).

Step B — Verify VLAN and MAC learning (S1)

show vlan brief
show mac address-table dynamic

What they do: show vlan brief confirms VLANs exist and assigned ports; show mac address-table dynamic shows MAC entries learned per VLAN. Why they matter: If VLAN 10 is missing or MACs not learned, Layer 2 is broken.

Expected output excerpts:

VLAN Name                             Status    Ports
10   Sales                            active    Gi0/1, Gi0/2

          Mac Address Table
Vlan    Mac Address       Type        Ports
----    -----------       ----        -----
  10    0050.56aa.bbb1    DYNAMIC     Gi0/1
  10    0050.56aa.bbb2    DYNAMIC     Gi0/2

Step C — Verify router interface toward switch (R2)

show ip interface brief
show interfaces GigabitEthernet0/1

What they do: show ip interface brief shows interface IPs and up/down state; show interfaces provides detailed counters and line protocol. Why they matter: If R2 Gi0/1 is down/no-ip, hosts in VLAN 10 cannot reach beyond S1.

Expected:

Interface              IP-Address      OK? Method Status                Protocol
GigabitEthernet0/1     10.10.40.1      YES manual up                    up

Step D — Verify routing on R2 and upstream

show ip route

What it does: displays routing table. Why it matters: If R2 lacks routes to 192.168.2.0 network (VLAN 20) or default route to R1, inter-VLAN or inter-router traffic will fail.

Expected (excerpt):

C    10.10.10.0/24 is directly connected, GigabitEthernet0/0
C    10.10.40.0/24 is directly connected, GigabitEthernet0/1
S    192.168.1.0/24 [1/0] via 10.10.40.254

Explanation: Static/connected routes must point to the correct next-hops.

Tip: Bottom-up is like checking the foundation of a house before inspecting the rooms — if the cables/power are down, nothing above will work.

Task 2 Solution: Top-down troubleshooting

What we are doing: Start with an end-to-end test, then inspect devices for where the traffic fails.

Step A — Attempt end-to-end ping from PC1 to PC3 (simulated from R2 or router shell)

ping 192.168.2.20

What it does: sends ICMP echo to destination. Why it matters: confirms end-to-end reachability or provides hint of where packet loss occurs (no response).

Expected output when failing:

Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 192.168.2.20, timeout is 2 seconds:
.....
Success rate is 0 percent (0/5)

Step B — Run traceroute to see last reachable hop

traceroute 192.168.2.20

What it does: shows path and where packets stop responding. Why it matters: pinpoints the hop where packets are dropped.

Expected:

Type escape sequence to abort.
Tracing the route to 192.168.2.20
  1 10.10.40.1 1 msec 1 msec 1 msec
  2 10.10.10.1 2 msec 2 msec 2 msec
  3 * * *

Explanation: If traceroute reaches R1 but not beyond, problem likely on R1-to-R3/R4 segment or destination network.

Step C — Inspect device configs where traceroute stopped (example R1)

show ip route 192.168.2.0

What it does: displays whether a route exists to the target network. Why it matters: missing route on R1 would stop traffic for 192.168.2.0.

Expected:

Routing entry for 192.168.2.0/24
  known via "static", distance 1, metric 0
  * 192.168.2.0 is directly connected, GigabitEthernetX/X

Warning: Top-down is efficient when application-level tests are fast — but if many devices are unreliable, you may need to combine with bottom-up checks.

Task 3 Solution: Divide-and-conquer troubleshooting

What we are doing: Ping intermediate hops to bisect the network and quickly locate the failing segment.

Step A — Ping gateway of PC1 (assume gateway 192.168.1.1)

ping 192.168.1.1

What it does: verifies host-to-default-gateway connectivity. Why it matters: If gateway unreachable, problem is local L2/L1.

Expected:

Success rate is 100 percent (5/5)

Step B — Ping upstream router R2 (10.10.40.1)

ping 10.10.40.1

What it does: checks path from R2 toward R1. Why it matters: confirms the next hop toward the destination.

Expected:

Success rate is 100 percent (5/5)

Step C — Ping R1 (10.10.10.1)

ping 10.10.10.1

What it does: confirms connectivity to the network core. Why it matters: If this ping fails, the fault lies between R2 and R1.

Expected:

Success rate is 100 percent (5/5)


<div class="topology-diagram">
<img src="data:image/svg+xml;base64,PD9wbGFudHVtbCAxLjIwMjYuMT8+PHN2ZyB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciIHhtbG5zOnhsaW5rPSJodHRwOi8vd3d3LnczLm9yZy8xOTk5L3hsaW5rIiBjb250ZW50U3R5bGVUeXBlPSJ0ZXh0L2NzcyIgZGF0YS1kaWFncmFtLXR5cGU9Ik5XRElBRyIgaGVpZ2h0PSIyNThweCIgcHJlc2VydmVBc3BlY3RSYXRpbz0ibm9uZSIgc3R5bGU9IndpZHRoOjM3MHB4O2hlaWdodDoyNThweDtiYWNrZ3JvdW5kOiNGRkZGRkY7IiB2ZXJzaW9uPSIxLjEiIHZpZXdCb3g9IjAgMCAzNzAgMjU4IiB3aWR0aD0iMzcwcHgiIHpvb21BbmRQYW49Im1hZ25pZnkiPjxkZWZzLz48Zz48dGV4dCBmaWxsPSIjMDAwMDAwIiBmb250LWZhbWlseT0ic2Fucy1zZXJpZiIgZm9udC1zaXplPSIxMiIgbGVuZ3RoQWRqdXN0PSJzcGFjaW5nIiB0ZXh0TGVuZ3RoPSI3OS4wNDg4IiB4PSIxNy43ODUyIiB5PSIxNi4xMzg3Ij5NYW5hZ2VtZW50PC90ZXh0Pjx0ZXh0IGZpbGw9IiMwMDAwMDAiIGZvbnQtZmFtaWx5PSJzYW5zLXNlcmlmIiBmb250LXNpemU9IjEyIiBsZW5ndGhBZGp1c3Q9InNwYWNpbmciIHRleHRMZW5ndGg9IjkxLjgzNCIgeD0iNSIgeT0iMzAuMTA3NCI+MTkyLjE2OC4xLjAvMjQ8L3RleHQ+PHRleHQgZmlsbD0iIzAwMDAwMCIgZm9udC1mYW1pbHk9InNhbnMtc2VyaWYiIGZvbnQtc2l6ZT0iMTIiIGxlbmd0aEFkanVzdD0ic3BhY2luZyIgdGV4dExlbmd0aD0iNzcuNzU5OCIgeD0iMTkuMDc0MiIgeT0iMTMyLjkxMjEiPkxhYl9OZXR3b3JrPC90ZXh0Pjx0ZXh0IGZpbGw9IiMwMDAwMDAiIGZvbnQtZmFtaWx5PSJzYW5zLXNlcmlmIiBmb250LXNpemU9IjEyIiBsZW5ndGhBZGp1c3Q9InNwYWNpbmciIHRleHRMZW5ndGg9IjY4LjkyOTciIHg9IjI3LjkwNDMiIHk9IjE0Ni44ODA5Ij4xMC4wLjAuMC8yNDwvdGV4dD48cmVjdCBmaWxsPSIjRTJFMkYwIiBoZWlnaHQ9IjUiIHN0eWxlPSJzdHJva2U6IzE4MTgxODtzdHJva2Utd2lkdGg6MTsiIHdpZHRoPSIxMTAuMDcwMyIgeD0iMTAxLjgzNCIgeT0iMTYuNDY4OCIvPjxyZWN0IGZpbGw9IiNFMkUyRjAiIGhlaWdodD0iNSIgc3R5bGU9InN0cm9rZTojMTgxODE4O3N0cm9rZS13aWR0aDoxOyIgd2lkdGg9IjI2MC40Mzc1IiB4PSIxMDEuODM0IiB5PSIxMzMuMjQyMiIvPjxwYXRoIGQ9Ik0xNTguODY5MSwyMS40Njg4IEwxNTguODY5MSw1Ny44NzExIiBmaWxsPSJub25lIiBzdHlsZT0ic3Ryb2tlOiMxODE4MTg7c3Ryb2tlLXdpZHRoOjE7Ii8+PHRleHQgZmlsbD0iIzAwMDAwMCIgZm9udC1mYW1pbHk9InNhbnMtc2VyaWYiIGZvbnQtc2l6ZT0iMTEiIGxlbmd0aEFkanVzdD0ic3BhY2luZyIgdGV4dExlbmd0aD0iNzMuNDc2NiIgeD0iMTIyLjEzMDkiIHk9IjQwLjk3OCI+MTkyLjE2OC4xLjEwPC90ZXh0PjxwYXRoIGQ9Ik0xNTQuODY5MSwxMzguMjQyMiBMMTU0Ljg2OTEsMTc0LjY0NDUiIGZpbGw9Im5vbmUiIHN0eWxlPSJzdHJva2U6IzE4MTgxODtzdHJva2Utd2lkdGg6MTsiLz48dGV4dCBmaWxsPSIjMDAwMDAwIiBmb250LWZhbWlseT0ic2Fucy1zZXJpZiIgZm9udC1zaXplPSIxMSIgbGVuZ3RoQWRqdXN0PSJzcGFjaW5nIiB0ZXh0TGVuZ3RoPSI0NS40ODI0IiB4PSIxMzIuMTI3OSIgeT0iMTU3Ljc1MTUiPjEwLjAuMC4xPC90ZXh0PjxwYXRoIGQ9Ik0yNDguNDYyOSwxMzguMjQyMiBMMjQ4LjQ2MjksMTc0LjY0NDUiIGZpbGw9Im5vbmUiIHN0eWxlPSJzdHJva2U6IzE4MTgxODtzdHJva2Utd2lkdGg6MTsiLz48dGV4dCBmaWxsPSIjMDAwMDAwIiBmb250LWZhbWlseT0ic2Fucy1zZXJpZiIgZm9udC1zaXplPSIxMSIgbGVuZ3RoQWRqdXN0PSJzcGFjaW5nIiB0ZXh0TGVuZ3RoPSI0NS40ODI0IiB4PSIyMjUuNzIxNyIgeT0iMTU3Ljc1MTUiPjEwLjAuMC4yPC90ZXh0PjxwYXRoIGQ9Ik0zMjMuNjQ2NSwxMzguMjQyMiBMMzIzLjY0NjUsMTc0LjY0NDUiIGZpbGw9Im5vbmUiIHN0eWxlPSJzdHJva2U6IzE4MTgxODtzdHJva2Utd2lkdGg6MTsiLz48dGV4dCBmaWxsPSIjMDAwMDAwIiBmb250LWZhbWlseT0ic2Fucy1zZXJpZiIgZm9udC1zaXplPSIxMSIgbGVuZ3RoQWRqdXN0PSJzcGFjaW5nIiB0ZXh0TGVuZ3RoPSI1Mi40ODEiIHg9IjI5Ny40MDYiIHk9IjE1Ny43NTE1Ij4xMC4wLjAuMTA8L3RleHQ+PHJlY3QgZmlsbD0iI0YxRjFGMSIgaGVpZ2h0PSIzMy45Njg4IiBzdHlsZT0ic3Ryb2tlOiMxODE4MTg7c3Ryb2tlLXdpZHRoOjAuNTsiIHdpZHRoPSI4MC4wNzAzIiB4PSIxMTYuODM0IiB5PSI1Ny44NzExIi8+PHRleHQgZmlsbD0iIzAwMDAwMCIgZm9udC1mYW1pbHk9InNhbnMtc2VyaWYiIGZvbnQtc2l6ZT0iMTIiIGxlbmd0aEFkanVzdD0ic3BhY2luZyIgdGV4dExlbmd0aD0iNjAuMDcwMyIgeD0iMTI2LjgzNCIgeT0iNzkuMDA5OCI+QWRtaW5fUEM8L3RleHQ+PHJlY3QgZmlsbD0iI0YxRjFGMSIgaGVpZ2h0PSIzMy45Njg4IiBzdHlsZT0ic3Ryb2tlOiMxODE4MTg7c3Ryb2tlLXdpZHRoOjAuNTsiIHdpZHRoPSIzNS45NzI3IiB4PSIxMzguODgyOCIgeT0iMTc0LjY0NDUiLz48dGV4dCBmaWxsPSIjMDAwMDAwIiBmb250LWZhbWlseT0ic2Fucy1zZXJpZiIgZm9udC1zaXplPSIxMiIgbGVuZ3RoQWRqdXN0PSJzcGFjaW5nIiB0ZXh0TGVuZ3RoPSIxNS45NzI3IiB4PSIxNDguODgyOCIgeT0iMTk1Ljc4MzIiPlIxPC90ZXh0PjxyZWN0IGZpbGw9IiNGMUYxRjEiIGhlaWdodD0iMzMuOTY4OCIgc3R5bGU9InN0cm9rZTojMTgxODE4O3N0cm9rZS13aWR0aDowLjU7IiB3aWR0aD0iNDcuMTE3MiIgeD0iMjI2LjkwNDMiIHk9IjE3NC42NDQ1Ii8+PHRleHQgZmlsbD0iIzAwMDAwMCIgZm9udC1mYW1pbHk9InNhbnMtc2VyaWYiIGZvbnQtc2l6ZT0iMTIiIGxlbmd0aEFkanVzdD0ic3BhY2luZyIgdGV4dExlbmd0aD0iMjcuMTE3MiIgeD0iMjM2LjkwNDMiIHk9IjE5NS43ODMyIj5TVzE8L3RleHQ+PHJlY3QgZmlsbD0iI0YxRjFGMSIgaGVpZ2h0PSIzMy45Njg4IiBzdHlsZT0ic3Ryb2tlOiMxODE4MTg7c3Ryb2tlLXdpZHRoOjAuNTsiIHdpZHRoPSI0My4yNSIgeD0iMzA0LjAyMTUiIHk9IjE3NC42NDQ1Ii8+PHRleHQgZmlsbD0iIzAwMDAwMCIgZm9udC1mYW1pbHk9InNhbnMtc2VyaWYiIGZvbnQtc2l6ZT0iMTIiIGxlbmd0aEFkanVzdD0ic3BhY2luZyIgdGV4dExlbmd0aD0iMjMuMjUiIHg9IjMxNC4wMjE1IiB5PSIxOTUuNzgzMiI+UEMxPC90ZXh0Pjw/cGxhbnR1bWwtc3JjIG9vakZvS25DTHdaY0tiMzhJb3FmcG9fQUxsMURwNGpDSnlyRHBJaTEyb2llOUFRYTVBS001b2xPQVlXUE1YaGY2UGZQdzFkZzZVV1JjSVkxZkhySlNaRnB1V0VTNVFBbkFaR3FLOGdyMVlnaUhSQjI5cDRmdFdfQW5oSjNHMHlDdUhPNDZROFEzUDR0WDFZaGUxMFNaYk5VMjJPVnU4blRGem5UakcwMD8+PC9nPjwvc3ZnPg==" alt="Network Topology Diagram" style="max-width:100%;height:auto;background:#fff;padding:16px;border:1px solid #e5e7eb;border-radius:8px;" />
</div>

cisco
configure terminal
ip route 192.168.2.0 255.255.255.0 10.10.20.2
end

What this does: Adds a static route on R1 for 192.168.2.0/24 via R3 (10.10.20.2). Why it matters: Without this route, R1 cannot forward traffic toward VLAN 20.

Verify:

show ip route 192.168.2.0

Expected:

S    192.168.2.0/24 [1/0] via 10.10.20.2

After fix, verify end-to-end:

ping 192.168.2.20

Expected:

Success rate is 100 percent (5/5)

Verification Checklist

  • Confirm physical ports for involved hosts are up (switch show interfaces status).
  • Confirm VLANs exist and hosts' MAC addresses are learned (show vlan brief; show mac address-table).
  • Confirm routing exists on each router for destination networks (show ip route).

Common Mistakes

SymptomCauseFix
PCs in VLAN cannot reach default gatewayPort is in wrong VLAN or VLAN missingAssign correct VLAN or create VLAN on switch and put port into VLAN
Router cannot forward to remote subnetMissing or incorrect routeAdd correct static route or enable dynamic routing
Traceroute stops at core routerCore lacks route to destinationInvestigate routing table on core (show ip route) and add route or fix routing protocol

Tip: Always document each change and revert if it doesn't help; in production networks, an untested change can cause bigger outages.

Challenge Task

Without step-by-step guidance: A user reports intermittent loss between PC4 and the Internet (203.0.113.1). Use divide-and-conquer to isolate whether the issue is local (S3), R4, or R1. Report the commands you run and the single root cause you find. (Do not change configurations automatically; gather evidence first.)

Key takeaways: Bottom-up is thorough for physical/data-link faults, top-down is fast when you suspect application-layer issues, and divide-and-conquer minimizes the search space by bisecting the network. In production networks, choose the method that balances speed and risk — often combining approaches yields the fastest, safest resolution.

Practice with Hands-On Labs

30 step-by-step labs for CCNA, CCNP Enterprise & Security