◇ OpenCyber Academy
Technical · Chapter 13 · English

Chapter 13 — Network and communications security: troubleshooting

Open, free learning for anyone who wants to protect people and technology. No account is required to read this text or its worked answers.

Chapter 13 — Network and communications security: troubleshooting

Lesson map

Lesson 13 published. Map, example, EX049.

flowchart TD
  N0["Learning outcomes"]
  N1["13.1 Start with a precise problem"]
  N2["13.2 Use the logs"]
  N3["13.3 Layer by layer"]
  N4["13.4 Fix narrowly and record"]
  N5["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5
  N5 --> EX["Worked example"]
  EX --> Q["Exercise EX049"]

Logical drawing

flowchart LR
  N0["Learning outcomes"]
  N1["13.1 Start with a precise problem"]
  N2["13.2 Use the logs"]
  N3["13.3 Layer by layer"]
  N4["13.4 Fix narrowly and record"]
  N5["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> Q["EX049"]

[Learning outcomes]
    |
    v
[13.1 Start with a precise problem]
    |
    v
[13.2 Use the logs]
    |
    v
[13.3 Layer by layer]
    |
    v
[13.4 Fix narrowly and record]
    |
    v
[Synthesis]
    |
    v
[Worked example] --> [Exercise EX049]

Learning outcomes

You will (1) troubleshoot connectivity methodically; (2) use logs; (3) fix narrowly.

13.1 Start with a precise problem

When a field officer reports "the VPN doesn't work", Amina asks precise questions: which device, where, since when, what error and does it happen to others? The answers narrow the problem: one laptop, from home, since this morning, error about authentication, colleagues fine. A precise description points to likely causes, such as the user's account or second factor, rather than the VPN gateway. Precise problem statements are the most effective troubleshooting step, and they cost nothing. She writes the answers in the ticket before investigating.

13.2 Use the logs

Central logs show what the VPN gateway saw. Amina, with Rosa's approval, searches for the user's account around the reported time and finds repeated failures with a reason indicating the second factor was rejected. The user had a new phone and the authenticator app had not been moved. The fix is the documented lost-phone process. Without logs, troubleshooting would have involved guessing and possibly unnecessary changes to the gateway. She records the search used so others can repeat it, and Rosa confirms the user can now connect from home.

13.3 Layer by layer

For other problems, Amina works through layers: is the device connected, does it have an address, can it reach its gateway, does DNS resolve the name, is the traffic allowed by the firewall, does the service respond? Each step either passes or points to the fault. For a printer at the branch that stopped receiving scans, she finds DNS resolving correctly but the firewall denying the scan traffic, because the new rule used the wrong port. A narrow correction fixes it.

13.4 Fix narrowly and record

Fixes should address the cause precisely. Removing rules or allowing broad access may make the problem disappear but undoes security. Amina's printer fix changes one port number in one rule. She records the problem, cause, fix and verification in the shared log, and adds a note to the verification checklist to confirm ports for scan flows. Recording each case builds a history that makes similar problems faster to solve next time. The log entry links to the rule change record and the test that confirmed the fix.

Worked example

The VPN problem is traced to a new phone; the scan problem to a wrong port; both are fixed narrowly and recorded.

Synthetic case. Cases are synthetic.

Errors and limits

Broad changes made under pressure to fix one user's problem often weaken controls for everyone.

Exercises

Synthesis

Precise questions, logs and layer-by-layer checks lead to narrow, recorded fixes.

Continue studying — chapter 13 of 18

← Chapter 12 (draft) · Course chapter index · Chapter 14 (draft) →