AP Networking 3.6: Restored Connections: Fixing a Segmented LAN

When a segmented network breaks, you do not guess. You pull the documentation and diff it against reality: what ipconfig, ping, a signal analyzer, or a power log shows versus what the diagram and address plan say should be true. The mismatch is your root cause.

A segmented LAN fails differently than a home network: a device can be online and still blocked, because crossing segments depends on its gateway, the firewall rules, and a DHCP server with leases left to give. This guide covers the six root causes behind almost every multi-segment fault, the readings that identify each one, and the fix and documentation update that close the case. It is Topic 3.6, the troubleshooting capstone of AP Networking Unit 3, set on the tournament network from 3.1 through 3.5.

• Documentation is your first diagnostic tool
• The Game Day network on paper
• Six root causes and their fingerprints
• Worked walkthrough: the livestream that could not leave
• Worked walkthrough: the deny that ate the scoreboard
• Practice: Fault Tracer
• Three free practice questions
• Auditing an AI diagnosis
• Key terms
• Frequently asked questions

Documentation is your first diagnostic tool

In Unit 2 you scoped a flat network by counting victims and reading status lights. A segmented LAN gives you something better: a written record of how the network should work. Its five parts each answer a troubleshooting question before you touch a cable.

The rule that makes all five useful: update the documentation every time the network changes. A stale diagram sends you diffing against a network that no longer exists, which is why every fix in this topic ends with a documentation update.

The Game Day network on paper

Everything on this page uses the Unit 3 tournament network. Here is its IP plan, the artifact you diff against.

Security notes: traffic between segments is denied by default, with one exception: judges may reach the scoreboard server SCORE-1 (192.168.20.60) on TCP 443. Guests get the internet only. Keep those notes in view; half of this job is telling an intentional block from a broken one.

Six root causes and their fingerprints

Before deep diagnostics, run the common solutions: restart the router, switch, or access point; restart the affected device; disconnect and reconnect; confirm the network name and password. If the problem survives all that, gather evidence. Each root cause leaves a fingerprint one tool can read.

Worked walkthrough: the livestream that could not leave

Ticket. The livestream is down. STREAM-1 reaches the staff file share but nothing outside its segment. Other staff devices reach the internet fine.

Common solutions. Restarting the rig changes nothing. Gather evidence.

Evidence. ipconfig on STREAM-1: IP 192.168.20.50, mask 255.255.255.0, gateway 192.168.10.1. The IP plan says the STAFF gateway is 192.168.20.1, and the static list still shows STREAM-1 on the players segment from an early draft.

The diff. The gateway belongs to a different segment. Traffic inside 192.168.20.0/24 never touches the gateway, which is why the share works; anything leaving the segment is handed to 192.168.10.1, unreachable from the rig's own subnet. The wrong-gateway fingerprint, exactly.

Fix, verify, document. Set the gateway to 192.168.20.1. Verify both legs: the stream reaches the internet and the share still loads. Then move STREAM-1's static entry to the staff segment; the stale entry is what let this misconfiguration hide.

Worked walkthrough: the deny that ate the scoreboard

Ticket. No judge tablet can load the scoreboard, but every judge can reach the internet.

Evidence. From JUDGE-2: ping the judges' gateway, replies. Ping 8.8.8.8, replies. Ping SCORE-1 at 192.168.20.60, times out. All six tablets agree. The ACL: rule 10, DENY ALL between segments; rule 20, ALLOW TCP 443 from 192.168.30.0/24 to 192.168.20.60.

The diff. The security notes allow judges to the scoreboard, so this block is a fault, not the design. ACLs are checked top to bottom and the first match wins: rule 10 swallows the traffic before rule 20 is ever read. Order is the bug.

Fix, verify, document. Move the allow above the deny, then verify both directions: the scoreboard loads from a judge tablet, and a guest phone still cannot touch it. Testing only the side you wanted open is how segments get quietly exposed. Record the required rule order in the security notes.

Practice: Fault Tracer

Now run the diff yourself. Each case hands you documentation and one evidence artifact: an ipconfig readout, a ping matrix, an ACL listing, a signal reading, or a power log. Name the root cause, the fix, and the documentation update. Cases and choices shuffle every time; one case includes an AI diagnosis to audit.

Three free practice questions

Try these before opening the answers. Each pairs a documentation row with a reading, as the AP exam does.

Auditing an AI diagnosis

Paste a ticket into an AI assistant and it produces a plausible cause in seconds, fix attached. But it only knows the ticket text. It cannot see that five of six tablets work, or that the affected one sits on the guest SSID with a 192.168.40.x address.

So audit the diagnosis with one question: would this cause produce exactly these victims and these readings? A broken inter-segment ACL blocks every judge tablet, not one. A dead uplink leaves valid leases, not 169.254 addresses. When the theory fails the check, keep the evidence and drop the theory. When it passes, verify the fix by hand anyway, then update the docs. AI proposes; the evidence decides.

Key terms

Segment

A group of devices sharing an IP range, separated from other groups for performance, management, and security.

APIPA (169.254.x.x)

The address a device gives itself when no DHCP server answers; it only works locally.

DHCP pool

The address range a DHCP server can lease out. When it runs dry, new devices get APIPA.

Default gateway

The router address a device sends traffic to when the destination is off-segment.

ACL (access control list)

An ordered list of firewall rules, checked top to bottom; the first match wins.

dBm

Wireless signal strength. Closer to zero is stronger; below about -70 dBm expect drops.

UPS

Uninterruptible power supply; battery-backed power that rides through dips and brief outages.

Static list

The documented record of every manually addressed device DHCP will never manage.

Frequently asked questions

AP is a trademark of the College Board, which was not involved in the production of, and does not endorse, this resource.