An office server answers on the admin VLAN. The office subnet has a correct route toward it, yet traceroute from an office PC stops at the firewall, and that firewall has an ACL. Which cause fits?
Select an answer to reveal the explanation.
Short Explanation
The server is home and the map already shows the road, so you look for the gate that is shut. Traceroute from the office dies at the firewall, and that firewall has an access list, which is what is dropping the office subnet. A route that is already correct, a filter on the server the trace never reached, or a dead fiber that is clearly passing other traffic does not fit.
Full Explanation
An access control list on a firewall permits or drops traffic by source subnet. The office PC's traceroute reaches the firewall and stops, the firewall has an ACL, the server answers from the admin VLAN, and the office subnet already has a correct route. The office source is what the firewall list is dropping. A missing route would stop the PC before the firewall. The stem says the route is present, and the trace gets that far. The server's own list is the tempting twin, because something is filtering, and the trace dies at the firewall, not at the server. A filter on the server would show the firewall as a responding hop and then stop later. A swapped fiber pair takes a link down. A link already carrying other traffic is not dark, and it would not single out the office subnet while admin traffic to the same server succeeds. Exam caveat: an ACL can drop only some ports. If the trace is blocked but a permitted application works, read the rule. Operational check: read the firewall ACL, find the rule matching the office subnet, confirm the drop counter increases on a test, and compare it with a working admin-VLAN test.