Follow the evidence.
Isolate the failing layer.

Record what happened.
Then choose the next check.

Completion marks record your review, not a verified pass. Record evidence, outcomes and exceptions in your incident or change system.

Symptoms guide priority

A timeout does not prove a firewall block. A refusal may come from a listener, proxy or explicit reject rule. Authentication failures do not automatically justify opening more ports. Follow the actual error and logs.

Transport tests have limits

Ping and traceroute can be filtered while the application works. TCP reachability does not establish TLS or successful login. UDP has no TCP-style handshake; use an authorized, protocol-aware request and corroborating logs.

Keep changes controlled

Inspect policy and packet evidence before changing it. Do not disable firewalls or bypass certificate validation as a fix. Repeat the original application request after an approved, targeted change.