FRYAVSI / PRACTICAL FIELD REFERENCE
Read a network rule and test the boundary
A short exercise with a fictional starting record, a blank test sheet and a worked answer.
Starting evidence
Goal: guests can use the internet, but only authorized administrators can open the camera viewer.
| Source | Destination / service | Required result | Observed before change |
|---|---|---|---|
| Admin VLAN 10 | Camera viewer 10.40.0.20 / TCP 443 | Allow | Viewer opens / rule 10 |
| Guest VLAN 30 | Same viewer / TCP 443 | Deny | Viewer opens / rule 20: allow internal |
| Guest VLAN 30 | Approved internet service | Allow | Works / rule 40 |
Your proposed change
Failing test and matched rule: __________________________________________________
Proposed scope / rule order: ___________________________________________________
Approval, change window and rollback: ___________________________________________
| Source / protocol | Destination / service | Expected | Actual / matched rule |
|---|---|---|---|
| ________________ | ________________ | ________________ | ________________ |
| ________________ | ________________ | ________________ | ________________ |
| ________________ | ________________ | ________________ | ________________ |
| ________________ | ________________ | ________________ | ________________ |
Worked answer
The broad internal rule permits the guest connection. Review the rule ordering and permitted paths, then propose a restriction that preserves the approved administrator path and required guest services. In a controlled lab, record the actual service results and rule matches after the approved change.
Expected: administrator viewer access works; guest viewer access is blocked; guest internet works. Check IPv6 and alternate routes if present. A timeout with an offline destination is inconclusive.
This is a reasoning exercise, not a copy-and-paste firewall configuration. Device rule semantics and dependencies must be checked on the actual platform.