"Why can't this reach that" has an automated answer.
Config analysis, network-wide scanning, and live packet capture are three different tools.
Reachability AnalyzerOne path, hop-by-hop, names the exact blocker
Network Access AnalyzerScans the whole network for unintended access
Traffic MirroringCopies real packets to an inspection target
Network Access Analyzer does not account for Traffic Mirroring — mirrored traffic never shows up as a connectivity path in its results.