LEARN. PRACTICE. GROW.1. Reconstruct the effective path
A fictional reconciliation batch fails after moving subnets. Start with actual source, destination, protocol, ports and time; separate name resolution from transport and application response. Confirm the table associated with the subnet, not merely a similarly named table. A more specific route can divert traffic from the default route. IPv4 and IPv6 have separate entries: validating 0.0.0.0/0 does not validate::/0. Draw forward and return paths, including address translation and inspection points. A permissive security rule creates no route, and an existing route grants no application authorization. Record the hypothesis and evidence that could refute it before changing several components.
2. Distinguish tracked sessions and stateless return paths
AWS security groups can use connection state for responses to allowed traffic. Removing a rule does not immediately interrupt every already-tracked connection. Untracked flows also exist and depend directly on rules for continuity; avoid claiming that no session drops. Network ACLs require their own permission for the response direction. In the worksheet, the client uses port 53000 and the server 443: the response destination is 53000. Evaluate rules by ascending number and first match. An allow rule numbered after a matching deny does not override it. These AWS behaviors must not be presented as executed Cisco firewall configuration.
3. Read records without inventing coverage
The worksheet separates forward ACCEPT, return REJECT and SKIPDATA in another interval. Allowing a flow does not mean the server replied or a payment was processed. SKIPDATA denotes a capture gap and can represent several flows; it does not equal NODATA. Confirm interface, direction and interval before concluding no traffic occurred. Documented exclusions, such as queries to Amazon-provided DNS and IMDS traffic, require another evidence source. Interface fields and original packet addresses can differ on translated or mediated paths. Preserve record format so columns are not confused during investigation. A synthetic worksheet helps reasoning but is not evidence collected from an AWS account.
4. Separate configuration analysis from execution
Reachability Analyzer builds a configuration model; it sends no packets and does not directly observe the data plane. A reachable result establishes neither target health, TLS response nor application authentication. Read relevant limitations, including IPv4 scope and unsupported components, before using the analysis in a change committee. When analysis identifies one blocker, others may remain further along. Correct by hypothesis and analyze again, then perform an authorized synthetic-data test. Under-load failures may need connection-tracking capacity and application metrics to explain symptoms a correct route cannot explain. Do not confuse a configuration inventory with service measurement or assume the model covers every path.
5. Close the change with per-flow evidence
Prepare a matrix with flow, owner, direction, expected policy, observed result and rollback. Include a new connection, a persistent connection where applicable, return traffic, a denied destination and an external dependency. Test the IP family clients use and behavior after an egress NAT source changes. Urgent containment must consider whether existing sessions remain active and which services share the subnet. The worksheet contains six planned cloud trials that have not been executed. Summary: routes, filters, connection state, observability and application outcomes are different evidence. RUN handover must identify what was obtained and what remains pending without treating an isolated ACCEPT as business success.
Client 53000 → server 443 is allowed; server 443 → client 53000 is denied by the return ACL. Opening destination 443 both ways does not cover this response.
Common pitfalls
ACCEPT as application success; SKIPDATA as no traffic; Reachability Analyzer as packet capture; changed rule as immediate termination of every session.
Related topics: Cloud security and segmentation · Observability and diagnosis · Change and containment
Diagnosis must follow forward and return paths and declare each evidence source’s limits.
Reference: Subnet route tables · 350-701 SCOR v2.0, effective 2026-08-27; core component of CCNP Security