2.7 Network Access Troubleshooting
Key Takeaways
- VLAN mismatch (host in wrong VLAN) is one of the most common Layer 2 connectivity issues.
- Native VLAN mismatch on trunks causes traffic to be placed in the wrong VLAN — check with 'show interfaces trunk'.
- Duplex/speed mismatch causes late collisions, CRC errors, and degraded performance.
- STP convergence or misconfiguration can block ports that should be forwarding — check with 'show spanning-tree'.
- EtherChannel formation fails if member port settings (speed, duplex, VLAN, trunk) don't match.
Network Access Troubleshooting
Layer 2 issues can be tricky to diagnose because they don't generate the clear error messages that Layer 3 routing problems produce. This section covers the most common Layer 2 problems and how to identify them.
VLAN Troubleshooting
Host Cannot Communicate with Other Hosts
Step 1: Verify the host's VLAN assignment
Switch# show vlan brief
Switch# show interfaces GigabitEthernet0/1 switchport
Step 2: Verify the VLAN exists on all switches in the path
Switch# show vlan brief ! VLAN must exist on each switch
Step 3: Verify the trunk allows the VLAN
Switch# show interfaces trunk ! Check "Vlans allowed" column
Step 4: Verify inter-VLAN routing is configured (if communicating between VLANs)
Router# show ip interface brief ! Check SVI or sub-interface is up/up
Common VLAN Problems
| Problem | Symptom | Fix |
|---|---|---|
| Port in wrong VLAN | Host can't reach expected hosts | Reassign port to correct VLAN |
| VLAN not created on switch | Port goes to default VLAN 1 | Create VLAN on the switch |
| VLAN not allowed on trunk | Traffic doesn't cross trunk | Add VLAN to trunk allowed list |
| SVI is down | Inter-VLAN routing fails | no shutdown on the SVI |
Missing ip routing | Layer 3 switch can't route | Enable ip routing globally |
Trunk Troubleshooting
| Symptom | Possible Cause | Verification |
|---|---|---|
| Trunk not forming | DTP mode mismatch, or non-trunking mode | show interfaces trunk |
| Some VLANs not crossing trunk | VLAN not in allowed list | show interfaces trunk |
| Traffic in wrong VLAN | Native VLAN mismatch | show interfaces trunk → check Native vlan |
| Intermittent issues | Native VLAN mismatch warning | show cdp neighbors detail (reports mismatch) |
EtherChannel Troubleshooting
If EtherChannel is not forming, check:
- Same speed on all member ports
- Same duplex on all member ports
- Same VLAN assignments (for access) or allowed VLANs (for trunk)
- Same trunk mode on all member ports
- Same native VLAN on all member ports (for trunk)
- Compatible channel modes (LACP active + passive or PAgP desirable + auto)
Switch# show etherchannel summary ! Check channel status flags
Switch# show etherchannel detail ! Detailed troubleshooting
Flags to watch for:
- (P) — Bundled in port-channel (good)
- (s) — Suspended (configuration mismatch)
- (D) — Down
- (I) — Stand-alone, not in channel
Wireless Troubleshooting
| Issue | Possible Cause | Solution |
|---|---|---|
| No wireless signal | AP powered off, wrong channel | Check AP power, verify channel |
| Slow wireless performance | Co-channel interference, too many clients | Adjust channel plan, add APs |
| Client can't associate | Wrong SSID or security mismatch | Verify SSID name, check WPA2 settings |
| Associated but no IP | DHCP issue on wireless VLAN | Check DHCP scope, ip helper-address |
| Connected but can't reach network | VLAN mapping wrong on WLC | Verify WLAN-to-VLAN mapping |
On the Exam: Troubleshooting scenarios are common. You may be shown a network diagram with specific configurations and asked to identify why a host cannot communicate. Always check VLANs, trunks, and routing systematically.
A host in VLAN 10 on Switch A cannot communicate with a host in VLAN 10 on Switch B. The trunk between the switches is up. What should you check first?
The output of "show etherchannel summary" shows member ports with status "(s)" (suspended). What is the most likely cause?
What is the effect of a native VLAN mismatch on a trunk link?
A user connected to a switch port cannot get an IP address via DHCP. The DHCP server is on a different subnet. What is likely missing?