Common Issues¶
A symptom-to-cause reference for the faults that come up most often. Work through these bottom-up by OSI layer — confirm the cable and link before chasing a routing problem.
| Symptom | Likely Cause | Where to Look |
|---|---|---|
| No link light on a port | Bad cable, wrong port, port shut down | show interfaces status; confirm no shutdown — Cisco IOS CLI Reference |
| Link up, but device can't reach anything | VLAN mismatch, missing default gateway | show interfaces status for VLAN assignment — VLANs & Inter-VLAN Routing |
| Intermittent connectivity, CRC errors climbing | Bad cable, connector, or interference | show interfaces counters — Interface Management |
| Poor performance despite link being up | Duplex mismatch (late collisions) | Check speed/duplex on both ends — Interface Management |
| Device doesn't get an IP | DHCP server unreachable, DHCP Snooping blocking a legitimate server, no ip helper-address across VLANs |
DHCP Fundamentals; confirm the port isn't wrongly untrusted — DHCP Snooping |
| Can't reach the internet, LAN is fine | Netgate WAN down, firewall rule blocking, NAT misconfigured | Netgate troubleshooting; NAT & Private IP Ranges |
| Wireless clients can't connect | AP not powered (PoE), AP not joined to controller, wrong VLAN on AP's switchport | PoE; Ruckus AP & WLAN Administration |
| PoE device won't power on | Port set to power inline never, switch PoE budget exceeded, bad cable |
PoE |
| Port stuck in blocking, never forwards | STP working as designed on a redundant path, or a misbehaving device triggering BPDU Guard | Spanning Tree Protocol; check for a shut port from BPDU Guard |
| Switch suddenly missing VLANs after a swap | A newly connected switch had a higher VTP revision number and overwrote the domain's VLAN database | VTP — check show vtp status before ever trunking in an unfamiliar switch |
| Can SSH from one subnet but not another | ACL restricting management access to a specific source range | SSH Management Only |
| ARP/DHCP traffic being dropped unexpectedly | DAI or DHCP Snooping treating a legitimate port as untrusted | Dynamic ARP Inspection |
General Approach¶
- Confirm the symptom precisely — "no internet" could mean no link, no IP, no DNS, or no route; each has a different fix
- Work bottom-up — physical link, then VLAN/switching, then IP/routing, then the application itself (see OSI Model)
- Check one thing changed — if it worked yesterday and doesn't today, what changed? A config push, a cable move, a device swap
- Use diagnostic commands, don't guess — see Diagnostic Commands for the toolkit