Complete CCNA 200-301 v1.1 Course

Welcome to the Course

A computer network lets devices exchange information and share services. The internet, an office network and a home Wi-Fi network follow the same fundamental principles at different scales.

How to use this course

1. Read one concept at a time.
2. Explain it aloud using your own words.
3. Recreate each topology in Cisco Packet Tracer.
4. Type commands instead of copying them.
5. Complete the review questions without checking the answers.

Recommended laboratory equipment

• Cisco Packet Tracer
• A computer with at least 8 GB RAM
• A text editor for configuration notes
• Optional: Wireshark for packet analysis

1. Network Fundamentals

Network fundamentals explain how devices connect, identify one another, exchange data and select paths. This chapter starts with the physical devices that make networking possible.

1.1 Network Components

Router

A router connects different IP networks. It examines the destination IP address of each packet, checks its routing table and selects an appropriate path toward the destination.

Basic router verification commands:

Router> enable
Router# show ip interface brief
Router# show ip route
Router# show running-config

Layer 2 Switch

A Layer 2 switch connects devices inside a LAN. It learns source MAC addresses and records them in its MAC address table. It forwards Ethernet frames using the destination MAC address.

Switch> enable
Switch# show mac address-table
Switch# show interfaces status
Switch# show vlan brief

Layer 3 Switch

A Layer 3 switch combines high-speed Ethernet switching with routing capabilities. It can route traffic between VLANs by using switched virtual interfaces, commonly called SVIs.

Switch(config)# ip routing

Switch(config)# interface vlan 10
Switch(config-if)# ip address 192.168.10.1 255.255.255.0
Switch(config-if)# no shutdown

Switch(config)# interface vlan 20
Switch(config-if)# ip address 192.168.20.1 255.255.255.0
Switch(config-if)# no shutdown

Next-Generation Firewall and IPS

A traditional firewall permits or blocks traffic using information such as source address, destination address, protocol and port. A next-generation firewall can additionally identify applications, inspect content and apply identity-based policies.

An intrusion prevention system, or IPS, analyzes traffic for malicious behavior and can automatically block detected threats.

Wireless Access Point

An access point connects wireless clients to a wired network. It bridges IEEE 802.11 wireless frames and IEEE 802.3 Ethernet frames.

Wireless LAN Controller

A wireless LAN controller centrally manages multiple access points. It can manage WLAN configuration, security, radio parameters and client roaming.

Network Controller

A network controller provides centralized visibility and policy management. Instead of configuring every device manually, administrators can express intended outcomes and let the controller coordinate implementation.

Endpoints

Endpoints are devices that consume or provide network data. Examples include laptops, phones, printers, cameras, sensors and IP telephones.

Servers

A server provides a service to other devices called clients. One physical or virtual server may provide several services.

Power over Ethernet

Power over Ethernet, or PoE, sends electrical power and network data over the same Ethernet cable. It is commonly used for access points, IP phones and security cameras.

Switch# show power inline

Interface  Admin  Oper       Power  Device
Gi1/0/1    auto   on         15.4W  IP Phone
Gi1/0/2    auto   on         22.0W  Access Point
Gi1/0/3    auto   off         0.0W  Not detected

1.2 Network Topology Architectures

Two-Tier Architecture

A two-tier campus design uses an access layer and a combined distribution/core layer. It is often called a collapsed-core design.

• Access layer: connects users and endpoint devices.
• Collapsed distribution/core: aggregates access switches, routes between networks and connects to external services.

Three-Tier Architecture

A traditional three-tier campus design contains three distinct layers:

1. Access: connects endpoints.
2. Distribution: aggregates access switches and provides routing and policy boundaries.
3. Core: transports large volumes of traffic quickly between distribution blocks.

Spine-Leaf Architecture

Spine-leaf is commonly used in data centers. Every leaf switch connects to every spine switch. Servers connect to leaf switches. Leaf switches do not normally connect directly to other leaf switches.

WAN

A wide area network connects geographically separated locations. WAN services may use internet VPNs, leased circuits, broadband connections, cellular networks or provider-managed services.

Small Office/Home Office

A SOHO design normally combines routing, Ethernet switching, wireless access, DHCP, NAT and basic firewall functions in one device.

On-Premises and Cloud

1.3 Physical Interfaces and Cabling

The physical layer carries bits between devices. CCNA requires you to understand copper Ethernet, single-mode fiber, multimode fiber and common interface problems.

Copper Ethernet

Twisted-pair Ethernet cables transmit data using electrical signals. Four pairs of insulated copper wires are twisted to reduce electromagnetic interference.

Straight-Through and Crossover Cables

Traditional Ethernet interfaces used different transmit and receive wire pairs. The cable type depended on the connected devices.

Fiber-Optic Cabling

Fiber carries information as light rather than electrical signals. It supports longer distances, high bandwidth and resistance to electromagnetic interference.

Shared Media and Point-to-Point Connections

On shared media, multiple devices compete for access to the same transmission medium. Collisions were possible on older Ethernet hubs.

A point-to-point Ethernet link connects exactly two interfaces, such as a computer connected directly to a switch port. Modern switched full-duplex Ethernet links do not experience collisions.

1.4 Interface and Cable Problems

Interface Status

Switch# show interfaces status

Port      Name        Status       Vlan  Duplex  Speed  Type
Gi0/1     PC-A        connected    10    a-full  a-1000 10/100/1000BaseTX
Gi0/2     Printer     notconnect   10    auto    auto   10/100/1000BaseTX
Gi0/3     Uplink      connected    trunk a-full  a-1000 10/100/1000BaseTX

Common Physical Problems

Duplex and Speed Mismatch

Full duplex permits simultaneous transmission and reception. Half duplex permits communication in only one direction at a time and uses collision detection.

Switch# show interfaces gigabitEthernet 0/1

GigabitEthernet0/1 is up, line protocol is up
  Full-duplex, 1000Mb/s
  5 minute input rate 45000 bits/sec
  5 minute output rate 68000 bits/sec
  12 input errors, 8 CRC, 0 frame
  0 output errors, 0 collisions

Important Error Counters

1.5 TCP and UDP

Applications use transport-layer protocols to communicate between processes. TCP and UDP both use port numbers, but they provide different services.

Transmission Control Protocol

TCP is connection-oriented and provides:

• Connection establishment
• Sequence numbers
• Acknowledgements
• Retransmission of missing data
• Flow control
• Error detection

TCP Three-Way Handshake

User Datagram Protocol

UDP is connectionless. It has a smaller header and does not establish a session, acknowledge delivery, reorder data or retransmit missing data.

Port Numbers

An IP address identifies a host interface. A port number identifies an application or process on that host.

1.6 OSI and TCP/IP Models

Networking models divide communication into layers. Each layer performs a specific job and provides services to the layer above it. This makes designing and troubleshooting networks easier.

The OSI Seven-Layer Model

TCP/IP Model

The TCP/IP model describes the protocol suite used by modern networks and the internet. It is commonly represented using four layers.

1.7 Encapsulation and Decapsulation

Encapsulation occurs when each networking layer adds control information to data before transmission. The receiving device removes that information through decapsulation.

1. The application creates data.
2. TCP or UDP adds a transport header.
3. IP adds a network-layer header.
4. Ethernet adds a header and trailer.
5. The physical layer transmits the frame as bits.

1.8 Ethernet Frames

Ethernet is the main LAN technology used in wired networks. It places data inside frames for delivery across a local network segment.

MAC Addresses

A MAC address is 48 bits long and normally written as 12 hexadecimal digits. For example:

00:1A:2B:3C:4D:5E
001A.2B3C.4D5E
00-1A-2B-3C-4D-5E

• The first 24 bits traditionally identify the manufacturer.
• The remaining 24 bits identify a particular interface.
• A hexadecimal digit represents four binary bits.

1.9 How a Switch Learns and Forwards

A switch dynamically builds its MAC address table by examining the source MAC address of incoming frames.

1. A frame enters a switch port.
2. The switch reads the source MAC address.
3. It records that address against the incoming port and VLAN.
4. It checks the destination MAC address.
5. It forwards, floods or filters the frame.

Forwarding Decisions

Switch# show mac address-table

          Mac Address Table
-------------------------------------------
Vlan    Mac Address       Type        Ports
----    -----------       --------    -----
  10    00aa.aaaa.aaaa    DYNAMIC     Gi0/1
  10    00bb.bbbb.bbbb    DYNAMIC     Gi0/2
  20    00cc.cccc.cccc    DYNAMIC     Gi0/3

1.10 Same-Network and Remote-Network Delivery

A host uses its subnet mask to determine whether a destination is local or remote.

• Local destination: The sender creates a frame addressed directly to the destination host's MAC address.
• Remote destination: The sender creates a frame addressed to its default gateway's MAC address.

1.11 ARP

The Address Resolution Protocol maps an IPv4 address to a MAC address on the local network.

1. The sender checks its ARP cache.
2. If no mapping exists, it sends a broadcast ARP request.
3. The device using the requested IPv4 address sends an ARP reply.
4. The sender stores the IP-to-MAC mapping temporarily.

PC> arp -a

Interface: 192.168.10.20
  Internet Address      Physical Address      Type
  192.168.10.1          00-11-22-33-44-55     dynamic

Router# show arp

Protocol  Address         Age  Hardware Addr   Type  Interface
Internet  192.168.10.1      -  0011.2233.4455  ARPA  Gi0/0
Internet  192.168.10.20     2  00aa.bbcc.ddee  ARPA  Gi0/0

1.12 IPv4 Addressing

An IPv4 address is a 32-bit logical address assigned to a network interface. It is written as four decimal octets separated by periods.

192.168.10.25

Binary:
11000000.10101000.00001010.00011001

Each octet contains eight bits and has a value between 0 and 255.

Network and Host Portions

A subnet mask identifies which IPv4 bits represent the network and which represent the host.

• A subnet-mask bit of 1 represents the network portion.
• A subnet-mask bit of 0 represents the host portion.

Address:       192.168.10.25
Subnet mask:   255.255.255.0
Prefix:        /24

Network part:  192.168.10
Host part:                 25
Network ID:    192.168.10.0
Broadcast:     192.168.10.255

Important Address Types

1.13 Public, Private and Special IPv4 Addresses

Private IPv4 Ranges

Private addresses are used inside organizations and are not routed across the public internet. Network Address Translation commonly translates them into public addresses.

Other Special Addresses

1.14 Subnet Masks and Prefix Lengths

Subnetting Formulas

If $h$ bits remain for hosts:

$$\text{Total addresses} = 2^h$$

For a conventional subnet:

$$\text{Usable hosts} = 2^h - 2$$

If $s$ host bits are borrowed:

$$\text{Number of subnets} = 2^s$$

1.15 The Block-Size Method

The block-size method quickly finds subnet boundaries without writing all 32 bits in binary.

1. Locate the interesting octet—the first mask octet that is not 255 or 0.
2. Calculate $256 - \text{mask value}$.
3. List multiples of that block size.
4. Find the range containing the given address.

Worked Example: 192.168.10.70/26

Prefix:           /26
Mask:             255.255.255.192
Interesting octet: fourth octet
Block size:       256 - 192 = 64

Subnet boundaries:
0, 64, 128, 192

70 falls between 64 and 127.

Worked Example: 172.16.77.130/20

Prefix:            /20
Mask:              255.255.240.0
Interesting octet: third octet
Block size:        256 - 240 = 16

Third-octet boundaries:
0, 16, 32, 48, 64, 80, 96...

77 falls between 64 and 79.

1.16 Selecting a Subnet Size

Choose enough host bits to support the required devices, including reasonable growth.

Example: Department Requiring 50 Hosts

/27 provides 30 usable hosts — too small
/26 provides 62 usable hosts — sufficient
/25 provides 126 usable hosts — sufficient but wastes more addresses

Best fit: /26

Example: Department Requiring 500 Hosts

/24 provides 254 usable hosts — too small
/23 provides 510 usable hosts — sufficient

Best fit: /23

1.17 Fixed-Length and Variable-Length Subnetting

Fixed-Length Subnet Masking

FLSM gives every subnet the same prefix length. It is simple but can waste addresses when departments have very different requirements.

Variable-Length Subnet Masking

VLSM uses different prefix lengths based on actual requirements. Allocate the largest subnet first to prevent address overlap.

VLSM Worked Example

Divide 192.168.10.0/24 for these requirements:

• Sales: 100 hosts
• Engineering: 50 hosts
• Support: 20 hosts
• Router link: 2 hosts

1.18 Configuring IPv4 Addresses

Router Interface

Router> enable
Router# configure terminal
Router(config)# interface gigabitEthernet 0/0
Router(config-if)# description Office LAN
Router(config-if)# ip address 192.168.10.1 255.255.255.0
Router(config-if)# no shutdown
Router(config-if)# end

Router# show ip interface brief

Layer 2 Switch Management Address

Switch> enable
Switch# configure terminal
Switch(config)# interface vlan 10
Switch(config-if)# ip address 192.168.10.2 255.255.255.0
Switch(config-if)# no shutdown
Switch(config-if)# exit
Switch(config)# ip default-gateway 192.168.10.1

Verification Commands

Router# show ip interface brief
Router# show interfaces gigabitEthernet 0/0
Router# show ip route
Router# show arp
Router# ping 192.168.10.10
Router# traceroute 192.168.20.10

IPv4 Subnetting Practice

1.19 IPv6 Fundamentals

IPv6 uses 128-bit addresses, providing a much larger address space than 32-bit IPv4. IPv6 also supports automatic addressing, simpler headers and improved multicast-based network operations.

IPv6 Address Format

An IPv6 address contains eight groups of four hexadecimal digits. Each group represents 16 bits.

2001:0db8:0000:0000:0000:00ab:0000:1234

Hexadecimal digits represent these decimal and binary values:

1.20 Shortening IPv6 Addresses

Rule 1: Remove Leading Zeros

Leading zeros in each 16-bit group may be removed.

Original:
2001:0db8:0000:0001:00ab:0000:0000:1234

After removing leading zeros:
2001:db8:0:1:ab:0:0:1234

Rule 2: Compress One Continuous Zero Sequence

One continuous sequence of all-zero groups may be replaced with ::.

2001:db8:0:0:0:0:0:10
2001:db8::10

Expanding an IPv6 Address

Short address:
2001:db8:12::5

There are three written groups before :: and one after it.
Eight groups are required, so :: represents four zero groups.

Expanded:
2001:0db8:0012:0000:0000:0000:0000:0005

1.21 IPv6 Prefixes

IPv6 uses prefix notation. A typical LAN uses a /64 prefix, leaving 64 bits for the interface identifier.

Address: 2001:db8:10:20:abcd:1234:5678:9abc/64

Network prefix:
2001:db8:10:20::/64

Interface identifier:
abcd:1234:5678:9abc

1.22 IPv6 Address Types

Global Unicast Address

A global unicast address is routable across IPv6 networks. The currently allocated global unicast range is contained within 2000::/3.

2001:db8:10:20::25/64

Link-Local Address

Every IPv6-enabled interface requires a link-local address. Link-local addresses begin within FE80::/10 and are used only on the local link.

fe80::21a:2bff:fe3c:4d5e

Link-local addresses are used for:

• Neighbor Discovery
• Router discovery
• Next-hop routing information
• Communication limited to the local link

Unique Local Address

Unique local addresses use FC00::/7, with locally assigned addresses commonly beginning with FD. They are intended for private internal use and are not normally routed on the public internet.

fd12:3456:789a:10::25/64

Loopback and Unspecified Addresses

IPv6 Multicast

IPv6 multicast sends traffic to a group of interested interfaces. IPv6 does not use broadcast addresses.

Anycast

An anycast address is assigned to multiple interfaces, normally on different devices. Routing delivers traffic to the nearest instance according to the routing table.

1.23 IPv6 Address Configuration Methods

Static Configuration

Router> enable
Router# configure terminal
Router(config)# ipv6 unicast-routing
Router(config)# interface gigabitEthernet 0/0
Router(config-if)# ipv6 address 2001:db8:10:1::1/64
Router(config-if)# no shutdown

The ipv6 unicast-routing command enables the router to forward IPv6 packets between interfaces.

Manual Link-Local Address

Router(config)# interface gigabitEthernet 0/0
Router(config-if)# ipv6 address fe80::1 link-local

EUI-64

Modified EUI-64 can create a 64-bit interface identifier from a 48-bit MAC address.

1. Split the MAC address into two 24-bit halves.
2. Insert FFFE between the halves.
3. Invert the universal/local bit in the first byte.
4. Combine the result with the 64-bit IPv6 prefix.

EUI-64 Worked Example

MAC address:
00:1A:2B:3C:4D:5E

Split:
001A2B | 3C4D5E

Insert FFFE:
001A:2BFF:FE3C:4D5E

Invert the U/L bit:
00 becomes 02

Interface identifier:
021A:2BFF:FE3C:4D5E

With prefix 2001:db8:10:1::/64:
2001:db8:10:1:021A:2BFF:FE3C:4D5E/64

Router(config)# interface gigabitEthernet 0/0
Router(config-if)# ipv6 address 2001:db8:10:1::/64 eui-64

SLAAC

Stateless Address Autoconfiguration allows a host to create its own global IPv6 address after receiving prefix information from a router advertisement.

1. The host creates a link-local address.
2. The host listens for or requests a router advertisement.
3. The router advertises a network prefix and configuration flags.
4. The host creates an address using the advertised prefix.
5. The host checks that the address is not already in use.

DHCPv6

1.24 Neighbor Discovery Protocol

IPv6 Neighbor Discovery uses ICMPv6. It replaces several IPv4 functions, including ARP and router discovery.

Solicited-Node Multicast

Each IPv6 unicast address has a corresponding solicited-node multicast address. Neighbor Discovery uses this address instead of broadcasting to every host.

Duplicate Address Detection

Before using an IPv6 address, a host can perform Duplicate Address Detection to confirm that another interface is not already using it.

1.25 Verifying IPv6

Router# show ipv6 interface brief

GigabitEthernet0/0     [up/up]
    FE80::1
    2001:DB8:10:1::1

GigabitEthernet0/1     [up/up]
    FE80::1
    2001:DB8:10:2::1

Router# show ipv6 interface gigabitEthernet 0/0
Router# show ipv6 route
Router# show ipv6 neighbors
Router# ping 2001:db8:10:1::20
Router# traceroute 2001:db8:10:2::20

IPv6 Practice Questions

1.26 Wireless Networking Fundamentals

Wireless LANs use radio waves instead of physical Ethernet cables. A wireless client connects to an access point using an SSID and an authentication method.

Important Wireless Terms

Wireless Bands

Wireless Interference

Wireless performance can be affected by:

• Other access points using overlapping channels
• Microwave ovens and cordless devices
• Concrete walls, metal structures and glass
• Too many clients on one access point
• Excessive distance from the access point
• Non-Wi-Fi radio interference

Wireless Encryption and Authentication

1.27 Virtualization

Virtualization abstracts computing resources from the physical hardware. Multiple virtual machines can run on one physical server through a hypervisor.

Network Virtualization

Network virtualization creates logical networks independently of the underlying physical topology. Examples include virtual switches, VLANs, virtual routers and virtual firewalls.

1.28 VRF

Virtual Routing and Forwarding creates separate routing tables on one router or Layer 3 switch. Each VRF can contain overlapping IP address spaces while keeping traffic logically separated.

Router(config)# vrf definition CUSTOMER_A
Router(config-vrf)# address-family ipv4
Router(config-vrf-af)# exit

Router(config)# interface gigabitEthernet 0/1
Router(config-if)# vrf forwarding CUSTOMER_A
Router(config-if)# ip address 192.168.1.1 255.255.255.0

1.29 Containers

Containers package an application and its dependencies while sharing the host operating system kernel. They are generally lighter and faster to start than full virtual machines.

1.30 Switching Concepts

Collision Domains

A collision domain is a network segment where devices could potentially compete to transmit at the same time. Each switch port creates a separate collision domain.

Broadcast Domains

A broadcast domain is the set of devices that receive a Layer 2 broadcast. Routers and Layer 3 boundaries separate broadcast domains. Each VLAN is normally a separate broadcast domain.

MAC Address Table Aging

Dynamic MAC address entries are removed after a period of inactivity. This allows the switch to adapt when a device moves to another port.

Switch# show mac address-table aging-time
Vlan    Aging Time
----    ----------
All     300 seconds

Store-and-Forward Switching

In store-and-forward switching, the switch receives the entire frame, verifies its FCS and then forwards it. Corrupted frames are discarded.

Full Duplex

Full-duplex Ethernet allows simultaneous transmission and reception on a point-to-point link. Collision detection is unnecessary on a properly operating full-duplex link.

Network Fundamentals Summary

Network Fundamentals Final Review

Review Questions

2. Network Access

Network access covers how switches connect devices, separate traffic with VLANs, carry multiple VLANs over trunks, prevent Layer 2 loops and provide wireless connectivity.

2.1 VLANs

A VLAN, or Virtual Local Area Network, logically separates devices on a switch. Each VLAN is a separate broadcast domain.

Creating and Naming VLANs

Switch> enable
Switch# configure terminal
Switch(config)# vlan 10
Switch(config-vlan)# name USERS
Switch(config-vlan)# exit

Switch(config)# vlan 20
Switch(config-vlan)# name VOICE
Switch(config-vlan)# exit

Switch(config)# vlan 30
Switch(config-vlan)# name GUESTS
Switch(config-vlan)# exit

Assigning an Access Port

Switch(config)# interface gigabitEthernet 0/5
Switch(config-if)# description Employee-PC
Switch(config-if)# switchport mode access
Switch(config-if)# switchport access vlan 10
Switch(config-if)# spanning-tree portfast

An access port normally carries traffic for one VLAN. It is commonly used for PCs, printers, cameras and other endpoint devices.

Verifying VLANs

Switch# show vlan brief

VLAN Name                             Status    Ports
---- -------------------------------- --------- -------------------------------
1    default                          active    Gi0/1, Gi0/2
10   USERS                            active    Gi0/5, Gi0/6
20   VOICE                            active    Gi0/7
30   GUESTS                           active    Gi0/8

2.2 Trunk Ports

A trunk carries traffic for multiple VLANs over one physical link. VLAN identification is added using IEEE 802.1Q tagging.

Switch(config)# interface gigabitEthernet 0/24
Switch(config-if)# description Trunk-to-SW2
Switch(config-if)# switchport mode trunk
Switch(config-if)# switchport trunk allowed vlan 10,20,30

Native VLAN

The native VLAN carries untagged frames on an 802.1Q trunk. Both ends of a trunk should use the same native VLAN.

Switch(config)# interface gigabitEthernet 0/24
Switch(config-if)# switchport trunk native vlan 999

Trunk Verification

Switch# show interfaces trunk

Port        Mode         Encapsulation  Status        Native vlan
Gi0/24      on           802.1q         trunking      999

Port        Vlans allowed on trunk
Gi0/24      10,20,30

Port        Vlans allowed and active in management domain
Gi0/24      10,20,30

2.3 Inter-VLAN Routing

Devices in different VLANs cannot communicate through Layer 2 switching alone. A router or Layer 3 switch must route between the VLANs.

Router-on-a-Stick

Router-on-a-stick uses one physical router interface with multiple subinterfaces. Each subinterface represents one VLAN.

Router(config)# interface gigabitEthernet 0/0
Router(config-if)# no shutdown

Router(config)# interface gigabitEthernet 0/0.10
Router(config-subif)# encapsulation dot1Q 10
Router(config-subif)# ip address 192.168.10.1 255.255.255.0

Router(config)# interface gigabitEthernet 0/0.20
Router(config-subif)# encapsulation dot1Q 20
Router(config-subif)# ip address 192.168.20.1 255.255.255.0

Router(config)# interface gigabitEthernet 0/0.30
Router(config-subif)# encapsulation dot1Q 30
Router(config-subif)# ip address 192.168.30.1 255.255.255.0

Layer 3 Switch Inter-VLAN Routing

Switch(config)# ip routing

Switch(config)# vlan 10
Switch(config-vlan)# name USERS

Switch(config)# interface vlan 10
Switch(config-if)# ip address 192.168.10.1 255.255.255.0
Switch(config-if)# no shutdown

Switch(config)# vlan 20
Switch(config-vlan)# name SERVERS

Switch(config)# interface vlan 20
Switch(config-if)# ip address 192.168.20.1 255.255.255.0
Switch(config-if)# no shutdown

2.4 Voice VLANs

An IP phone and a computer can share one switch port. The phone uses the voice VLAN, while the attached computer uses the data VLAN.

Switch(config)# interface gigabitEthernet 0/10
Switch(config-if)# switchport mode access
Switch(config-if)# switchport access vlan 10
Switch(config-if)# switchport voice vlan 20
Switch(config-if)# spanning-tree portfast

2.5 VLAN Troubleshooting

Review Questions

2.6 EtherChannel

EtherChannel combines multiple physical Ethernet links into one logical link. This increases bandwidth and provides redundancy. Cisco commonly uses Port Aggregation Protocol (PAgP) or the open standard Link Aggregation Control Protocol (LACP).

LACP Modes

An EtherChannel forms when at least one side is active. Passive/passive does not form a channel.

LACP Configuration

Switch1(config)# interface range gigabitEthernet 0/1 - 2
Switch1(config-if-range)# channel-group 1 mode active
Switch1(config-if-range)# exit

Switch1(config)# interface port-channel 1
Switch1(config-if)# switchport mode trunk
Switch1(config-if)# switchport trunk allowed vlan 10,20,30

Configure the matching channel on the second switch:

Switch2(config)# interface range gigabitEthernet 0/1 - 2
Switch2(config-if-range)# channel-group 1 mode active
Switch2(config-if-range)# exit

Switch2(config)# interface port-channel 1
Switch2(config-if)# switchport mode trunk
Switch2(config-if)# switchport trunk allowed vlan 10,20,30

Verifying EtherChannel

Switch# show etherchannel summary

Group  Port-channel  Protocol    Ports
------+-------------+-----------+----------------
1      Po1(SU)       LACP        Gi0/1(P) Gi0/2(P)

Switch# show interfaces port-channel 1
Switch# show lacp neighbor
Switch# show interfaces trunk

2.7 Layer 2 Loops

A Layer 2 loop occurs when redundant switch paths allow Ethernet frames to circulate indefinitely. Ethernet frames do not contain a hop-count field, so loops can cause severe network problems.

Effects of Layer 2 Loops

• Broadcast storms
• Multiple copies of the same frame
• MAC address table instability
• High CPU usage
• Duplicate frames received by endpoints
• Network-wide connectivity loss

2.8 Spanning Tree Protocol

Spanning Tree Protocol, or STP, prevents Layer 2 loops by placing redundant interfaces into a blocking state while maintaining an alternate path for failure recovery.

Bridge ID

STP elects one switch as the root bridge. The bridge with the lowest bridge ID wins. The bridge ID is based on bridge priority and MAC address.

Switch(config)# spanning-tree vlan 10 priority 24576

Lowering the priority makes a switch more likely to become the root bridge. The default priority is commonly 32768, subject to the extended system ID.

STP Port Roles

STP Port States

2.9 Rapid Spanning Tree Protocol

Rapid PVST+ improves convergence by using a separate spanning-tree instance per VLAN and transitioning ports more quickly after a topology change.

Switch(config)# spanning-tree mode rapid-pvst
Switch(config)# spanning-tree vlan 10,20,30 priority 24576

STP Verification

Switch# show spanning-tree

VLAN0010
  Spanning tree enabled protocol rstp
  Root ID    Priority    24586
             Address     0011.2233.4455
             This bridge is the root

Interface        Role Sts Cost      Prio.Nbr Type
---------------- ---- --- --------- --------- ----------------
Gi0/1            Desg FWD 4         128.1     P2p
Gi0/2            Desg FWD 4         128.2     P2p

Switch# show spanning-tree vlan 10
Switch# show spanning-tree root
Switch# show spanning-tree blockedports

2.10 PortFast

PortFast allows an access port connected to an endpoint to enter the forwarding state immediately instead of waiting through normal STP transitions.

Switch(config)# interface gigabitEthernet 0/5
Switch(config-if)# spanning-tree portfast

2.11 BPDU Guard

BPDU Guard protects PortFast ports. If a BPDU arrives, the switch assumes an unexpected switch has been connected and places the interface into an err-disabled state.

Switch(config)# interface gigabitEthernet 0/5
Switch(config-if)# spanning-tree portfast
Switch(config-if)# spanning-tree bpduguard enable

It can also be enabled globally for PortFast interfaces:

Switch(config)# spanning-tree portfast bpduguard default

2.12 Root Guard and Loop Guard

Root Guard

Root Guard prevents a designated port from becoming a root port because of unexpected superior BPDUs. It is useful at boundaries where another switch must not become the root bridge.

Switch(config)# interface gigabitEthernet 0/24
Switch(config-if)# spanning-tree guard root

Loop Guard

Loop Guard prevents a port that unexpectedly stops receiving BPDUs from moving incorrectly into forwarding. It places the port into a loop-inconsistent state until BPDUs return.

Switch(config)# interface gigabitEthernet 0/23
Switch(config-if)# spanning-tree guard loop

2.13 STP Troubleshooting

Switch# show interfaces status err-disabled
Switch# show errdisable recovery
Switch# show spanning-tree detail
Switch# show logging

Network Access Review

2.14 Wireless LAN Architecture

Enterprise wireless networks separate the wireless access function from centralized management. Access points provide radio connectivity, while a wireless LAN controller manages configuration, security and mobility.

Autonomous and Lightweight Access Points

2.15 Access Point Modes

2.16 WLAN Components

SSID and WLAN Policy

A WLAN profile associates an SSID with security, VLAN and traffic policies. Different user groups can receive different access policies.

CAPWAP

Control and Provisioning of Wireless Access Points, or CAPWAP, is used between lightweight access points and wireless LAN controllers.

AP Discovery

An access point must discover a controller before it can obtain centralized configuration. Discovery may use DHCP information, DNS, broadcast or a statically configured controller address, depending on the deployment.

2.17 Wireless Security

Personal Authentication

Personal wireless networks use a shared passphrase. Every authorized user receives the same secret.

SSID: Home-WiFi
Security: WPA2-Personal
Passphrase: Shared secret

Enterprise Authentication

Enterprise WLANs use 802.1X. A client authenticates through an access point and controller to a centralized authentication server, commonly RADIUS.

2.18 Wireless Channel Planning

Access points should use channel assignments that minimize co-channel and adjacent-channel interference. Channel planning considers location, power, coverage, client density and regulatory restrictions.

2.4 GHz Example

In many regulatory domains, channels 1, 6 and 11 are commonly selected because they do not overlap with one another in the 2.4 GHz band.

Signal and Coverage

2.19 Wireless Troubleshooting

Client Cannot See the SSID

1. Confirm the access point is powered and operational.
2. Check whether the SSID is hidden.
3. Verify the client supports the configured frequency and security.
4. Check channel utilization and radio configuration.
5. Confirm the WLAN is enabled on the controller.

Client Sees SSID but Cannot Authenticate

1. Check the passphrase for personal authentication.
2. Verify the client certificate or credentials for enterprise authentication.
3. Check RADIUS reachability and shared secret configuration.
4. Confirm date and time where certificates are used.
5. Review controller and authentication-server logs.

Client Authenticates but Has No IP Address

1. Confirm the client is mapped to the correct VLAN.
2. Verify DHCP service and DHCP relay configuration.
3. Check the trunk between the AP/controller and switch.
4. Confirm the VLAN exists and is allowed on trunks.
5. Check the default gateway and DHCP scope.

Useful Commands

Switch# show vlan brief
Switch# show interfaces trunk
Switch# show power inline
Switch# show mac address-table dynamic
Switch# show cdp neighbors
Switch# show lldp neighbors

Network Access Final Review

3. IP Connectivity

IP connectivity explains how routers learn networks, choose paths and forward packets between different subnets.

3.1 How a Router Forwards Packets

1. Receives an Ethernet frame on an active interface.
2. Removes the Layer 2 header and examines the destination IP address.
3. Searches its routing table.
4. Selects the best matching route.
5. Decrements the IPv4 TTL or IPv6 Hop Limit.
6. Creates a new Layer 2 frame for the outgoing interface.
7. Forwards the packet to the next hop.

3.2 The Routing Table

A routing table contains network destinations, prefix lengths, next hops and outgoing interfaces. Routes may be learned as connected, static or dynamic routes.

Router# show ip route

Codes: C - connected, S - static, O - OSPF, L - local

C    192.168.10.0/24 is directly connected, GigabitEthernet0/0
L    192.168.10.1/32 is directly connected, GigabitEthernet0/0
O    192.168.20.0/24 [110/2] via 10.0.0.2, 00:00:18, GigabitEthernet0/1
S*   0.0.0.0/0 [1/0] via 10.0.0.1

3.3 Longest-Prefix Match

When several routes match a destination, the router chooses the route with the longest prefix—the most specific route.

3.4 Route Selection

If routes to the same destination have different administrative distances, the route with the lower administrative distance is preferred.

If routes come from the same routing source, the routing protocol's metric determines the preferred path.

3.5 Connected Routes

When an interface has an IP address and is operational, the router installs a connected route for the subnet and a local host route for the interface address.

Router(config)# interface gigabitEthernet 0/0
Router(config-if)# ip address 192.168.10.1 255.255.255.0
Router(config-if)# no shutdown

Router# show ip route connected
C    192.168.10.0/24 is directly connected, GigabitEthernet0/0
L    192.168.10.1/32 is directly connected, GigabitEthernet0/0

3.6 Static Routes

A static route is manually configured by an administrator. It does not change automatically when the topology changes unless tracking or another mechanism is used.

Next-Hop Static Route

Router(config)# ip route 192.168.20.0 255.255.255.0 10.0.0.2

Exit-Interface Static Route

Router(config)# ip route 192.168.20.0 255.255.255.0 gigabitEthernet 0/1

Fully Specified Static Route

Router(config)# ip route 192.168.20.0 255.255.255.0 \
  gigabitEthernet 0/1 10.0.0.2

IPv6 Static Route

Router(config)# ipv6 route 2001:db8:20::/64 2001:db8:12::2

3.7 Default Routes

A default route matches destinations for which no more specific route exists. It is also called the gateway of last resort.

IPv4 Default Route

Router(config)# ip route 0.0.0.0 0.0.0.0 203.0.113.1

IPv6 Default Route

Router(config)# ipv6 route ::/0 2001:db8:ffff::1

3.8 Floating Static Routes

A floating static route is a backup route configured with a higher administrative distance than the primary route.

! Primary static route
Router(config)# ip route 192.168.20.0 255.255.255.0 10.0.0.2 1

! Backup floating route
Router(config)# ip route 192.168.20.0 255.255.255.0 10.0.1.2 200

3.9 Routing Table Verification

Router# show ip route
Router# show ip route 192.168.20.0
Router# show ip cef
Router# show ip protocols
Router# ping 192.168.20.10
Router# traceroute 192.168.20.10

IP Connectivity Review

3.10 OSPFv2 Fundamentals

Open Shortest Path First version 2, or OSPFv2, is a link-state routing protocol for IPv4. Routers exchange link-state information, build a common topology database and calculate shortest paths using the SPF algorithm.

Why Use OSPF?

• Automatically learns remote networks
• Converges after topology changes
• Supports hierarchical areas
• Uses cost as its path metric
• Supports classless IPv4 prefixes and VLSM
• Uses authentication options

OSPF Single Area

A small network can place all OSPF interfaces in area 0. Area 0 is also called the backbone area.

3.11 OSPF Neighbour Relationships

OSPF routers become neighbours before exchanging routing information. Neighbour formation requires compatible settings.

OSPF Neighbour States

3.12 Configuring OSPF

Classic OSPF Configuration

R1(config)# router ospf 1
R1(config-router)# router-id 1.1.1.1
R1(config-router)# network 192.168.10.0 0.0.0.255 area 0
R1(config-router)# network 10.0.12.0 0.0.0.3 area 0

The number after router ospf is locally significant. It does not need to match on neighbouring routers.

Interface-Based OSPF Configuration

R1(config)# interface gigabitEthernet 0/0
R1(config-if)# ip ospf 1 area 0

R1(config)# interface gigabitEthernet 0/1
R1(config-if)# ip ospf 1 area 0

Example: Three-Router OSPF Network

! R1
R1(config)# router ospf 1
R1(config-router)# router-id 1.1.1.1
R1(config-router)# network 192.168.10.0 0.0.0.255 area 0
R1(config-router)# network 10.0.12.0 0.0.0.3 area 0

! R2
R2(config)# router ospf 1
R2(config-router)# router-id 2.2.2.2
R2(config-router)# network 10.0.12.0 0.0.0.3 area 0
R2(config-router)# network 10.0.23.0 0.0.0.3 area 0

! R3
R3(config)# router ospf 1
R3(config-router)# router-id 3.3.3.3
R3(config-router)# network 10.0.23.0 0.0.0.3 area 0
R3(config-router)# network 192.168.30.0 0.0.0.255 area 0

3.13 OSPF Router ID

Every OSPF router requires a unique router ID. The selection order is:

1. Manually configured router ID
2. Highest loopback interface address
3. Highest active physical interface address

Router(config)# router ospf 1
Router(config-router)# router-id 10.10.10.10

If the router ID changes after OSPF is already running, restart the OSPF process or reload the router as appropriate.

Router# clear ip ospf process
Reset ALL OSPF processes? [no]: yes

3.14 OSPF Passive Interfaces

A passive interface advertises its connected network into OSPF but does not form OSPF neighbour relationships on that interface.

Router(config)# router ospf 1
Router(config-router)# passive-interface gigabitEthernet 0/0

This is useful on user LANs where no OSPF neighbour should exist.

Router(config)# router ospf 1
Router(config-router)# passive-interface default
Router(config-router)# no passive-interface gigabitEthernet 0/1
Router(config-router)# no passive-interface gigabitEthernet 0/2

3.15 OSPF Metric and Cost

OSPF uses cost as its metric. Lower total cost is preferred. The cost is commonly calculated from reference bandwidth divided by interface bandwidth.

Router# show ip ospf interface gigabitEthernet 0/1

GigabitEthernet0/1 is up, line protocol is up
  Internet Address 10.0.12.1/30, Area 0
  Process ID 1, Router ID 1.1.1.1
  Network Type POINT-TO-POINT, Cost: 10

Changing Interface Cost

Router(config)# interface gigabitEthernet 0/1
Router(config-if)# ip ospf cost 20

Changing Reference Bandwidth

Router(config)# router ospf 1
Router(config-router)# auto-cost reference-bandwidth 100000

3.16 OSPF Network Types

Configuring Point-to-Point Network Type

Router(config)# interface gigabitEthernet 0/1
Router(config-if)# ip ospf network point-to-point

3.17 DR and BDR

On a broadcast multiaccess network, OSPF elects a Designated Router and Backup Designated Router. This reduces the number of full adjacency relationships required.

Router(config)# interface gigabitEthernet 0/1
Router(config-if)# ip ospf priority 100

A priority of zero prevents an interface from becoming DR or BDR.

Router(config-if)# ip ospf priority 0

3.18 OSPF Verification

Router# show ip ospf
Router# show ip ospf neighbor
Router# show ip ospf interface brief
Router# show ip ospf interface gigabitEthernet 0/1
Router# show ip route ospf
Router# show ip protocols

Example Neighbour Output

Router# show ip ospf neighbor

Neighbor ID     Pri   State           Dead Time   Address       Interface
2.2.2.2           1   FULL/ -         00:00:31    10.0.12.2     Gi0/1
3.3.3.3           1   FULL/DR         00:00:32    192.168.1.3   Gi0/0

3.19 OSPF Troubleshooting

Router# show ip interface brief
Router# show ip ospf neighbor
Router# show ip ospf interface
Router# show ip route
Router# show access-lists
Router# show logging

OSPF Review

4. IP Services

IP services provide address assignment, name resolution, time synchronization, monitoring, secure administration and traffic handling.

4.1 Network Address Translation

NAT translates one IP address into another. It commonly translates private internal IPv4 addresses into a public address for internet access.

Static NAT

Static NAT creates a permanent one-to-one mapping between an inside local and inside global address.

Router(config)# ip nat inside source static \
192.168.10.10 203.0.113.10

Router(config)# interface gigabitEthernet 0/0
Router(config-if)# ip nat inside

Router(config)# interface gigabitEthernet 0/1
Router(config-if)# ip nat outside

Dynamic NAT

Dynamic NAT maps inside addresses to addresses from a configured public pool. The mapping exists while the translation is active.

Router(config)# ip nat pool PUBLIC_POOL \
203.0.113.20 203.0.113.30 netmask 255.255.255.0

Router(config)# access-list 1 permit 192.168.10.0 0.0.0.255

Router(config)# ip nat inside source list 1 pool PUBLIC_POOL

PAT Overload

Port Address Translation allows many inside devices to share one public address by distinguishing sessions with transport-layer port numbers.

Router(config)# access-list 1 permit 192.168.10.0 0.0.0.255
Router(config)# ip nat inside source list 1 interface gigabitEthernet 0/1 overload

NAT Verification

Router# show ip nat translations
Router# show ip nat statistics
Router# clear ip nat translation *

4.2 DHCPv4

Dynamic Host Configuration Protocol automatically supplies IPv4 configuration such as address, subnet mask, default gateway and DNS server.

DORA Process

1. Discover: Client broadcasts a request for DHCP servers.
2. Offer: A DHCP server offers an address.
3. Request: The client requests the offered configuration.
4. Acknowledgement: The server confirms the lease.

Router as DHCP Server

Router(config)# ip dhcp excluded-address 192.168.10.1 192.168.10.20

Router(config)# ip dhcp pool USERS
Router(dhcp-config)# network 192.168.10.0 255.255.255.0
Router(dhcp-config)# default-router 192.168.10.1
Router(dhcp-config)# dns-server 192.168.10.5
Router(dhcp-config)# domain-name example.local
Router(dhcp-config)# lease 7

DHCP Verification

Router# show ip dhcp binding
Router# show ip dhcp pool
Router# show ip dhcp conflict

4.3 DHCP Relay

DHCP broadcasts normally do not cross routers. A DHCP relay forwards client requests to a DHCP server located on another network.

Router(config)# interface gigabitEthernet 0/0
Router(config-if)# ip helper-address 192.168.50.10

4.4 DNS

The Domain Name System translates human-readable names into IP addresses.

Client query:
www.example.com

DNS response:
203.0.113.80

Router DNS Lookup

Router(config)# ip name-server 192.168.10.5
Router(config)# ip domain lookup

Router# ping server.example.local
Router# nslookup www.example.com

4.5 NTP

Network Time Protocol synchronizes clocks across network devices. Accurate time is important for logs, certificates, authentication and troubleshooting.

Router(config)# ntp server 192.168.50.10

Router# show clock
Router# show ntp status
Router# show ntp associations

4.6 Syslog

Syslog sends device messages to a centralized logging server. Messages are classified by severity from 0, emergencies, to 7, debugging.

Router(config)# logging host 192.168.50.20
Router(config)# logging trap warnings
Router(config)# service timestamps log datetime msec

4.7 SNMP

Simple Network Management Protocol allows monitoring systems to collect information and receive alerts from network devices.

Router(config)# snmp-server community MONITORING ro
Router(config)# snmp-server host 192.168.50.30 version 2c MONITORING
Router(config)# snmp-server enable traps

4.8 Quality of Service

Quality of Service, or QoS, classifies and prioritizes traffic when network resources are congested.

4.9 Secure Remote Access with SSH

Secure Shell provides encrypted remote administration. It is preferred over Telnet, which sends credentials and commands without strong encryption.

Router(config)# hostname R1
R1(config)# ip domain-name example.local
R1(config)# username admin privilege 15 secret StrongPasswordHere
R1(config)# crypto key generate rsa modulus 2048
R1(config)# ip ssh version 2

R1(config)# line vty 0 4
R1(config-line)# login local
R1(config-line)# transport input ssh
R1(config-line)# exit

SSH Verification

R1# show ip ssh
R1# show users
R1# show running-config | section line vty

4.10 FTP and TFTP

TFTP is a simple file-transfer protocol often used for configuration and image transfers. FTP provides more features and authentication options.

Router# copy running-config tftp:
Router# copy tftp: running-config
Router# copy flash: tftp:
Router# copy tftp: flash:

IP Services Lab

IP Services Review

5. Security Fundamentals

Network security protects confidentiality, integrity and availability. Good security combines people, processes, technology and continuous monitoring.

5.1 The CIA Triad

5.2 Common Network Threats

5.3 Device Hardening

Device hardening reduces the attack surface by disabling unnecessary services, enforcing authentication and controlling administrative access.

Basic Secure Configuration

Router(config)# hostname R1
R1(config)# enable secret StrongEnableSecret
R1(config)# service password-encryption
R1(config)# security passwords min-length 12
R1(config)# login block-for 120 attempts 3 within 60

R1(config)# username admin privilege 15 secret StrongAdminSecret
R1(config)# ip domain-name secure.example
R1(config)# crypto key generate rsa modulus 2048
R1(config)# ip ssh version 2

R1(config)# line console 0
R1(config-line)# login local
R1(config-line)# exec-timeout 5 0
R1(config-line)# logging synchronous

R1(config)# line vty 0 4
R1(config-line)# login local
R1(config-line)# transport input ssh
R1(config-line)# exec-timeout 5 0

Disable an Unused Interface

Switch(config)# interface range gigabitEthernet 0/10 - 24
Switch(config-if-range)# shutdown
Switch(config-if-range)# description UNUSED

5.4 Management Plane, Control Plane and Data Plane

5.5 AAA

AAA stands for Authentication, Authorization and Accounting.

Local AAA

Router(config)# username admin privilege 15 secret LocalSecret
Router(config)# aaa new-model
Router(config)# aaa authentication login default local
Router(config)# aaa authorization exec default local

Router(config)# line vty 0 4
Router(config-line)# login authentication default

RADIUS and TACACS+

5.6 Access Control Lists

An ACL is an ordered list of permit and deny statements. Routers process entries from top to bottom and stop at the first match.

Standard IPv4 ACL

A standard ACL filters primarily by source IPv4 address.

Router(config)# access-list 10 deny host 192.168.10.50
Router(config)# access-list 10 permit any

Router(config)# interface gigabitEthernet 0/0
Router(config-if)# ip access-group 10 in

Named Standard ACL

Router(config)# ip access-list standard BLOCK-HOST
Router(config-std-nacl)# deny host 192.168.10.50
Router(config-std-nacl)# permit any

Router(config)# interface gigabitEthernet 0/0
Router(config-if)# ip access-group BLOCK-HOST in

Extended IPv4 ACL

Extended ACLs can filter by source, destination, protocol and port.

Router(config)# ip access-list extended ALLOW-WEB
Router(config-ext-nacl)# permit tcp 192.168.10.0 0.0.0.255 \
host 192.168.20.10 eq 443
Router(config-ext-nacl)# deny ip any host 192.168.20.10
Router(config-ext-nacl)# permit ip any any

Router(config)# interface gigabitEthernet 0/1
Router(config-if)# ip access-group ALLOW-WEB out

ACL Placement

• Standard ACL: place close to the destination because it cannot identify the destination.
• Extended ACL: place close to the source to stop unwanted traffic early.

ACL Verification

Router# show access-lists
Router# show ip interface gigabitEthernet 0/0
Router# show running-config | section access-list

5.7 IPv6 ACLs

IPv6 ACLs are named and use commands beginning with ipv6 access-list.

Router(config)# ipv6 access-list V6-FILTER
Router(config-ipv6-acl)# permit tcp 2001:db8:10::/64 \
host 2001:db8:20::10 eq 443
Router(config-ipv6-acl)# deny ipv6 any host 2001:db8:20::10
Router(config-ipv6-acl)# permit ipv6 any any

Router(config)# interface gigabitEthernet 0/1
Router(config-if)# ipv6 traffic-filter V6-FILTER out

5.8 Layer 2 Security

Port Security

Port security limits which MAC addresses can use a switch port.

Switch(config)# interface gigabitEthernet 0/5
Switch(config-if)# switchport mode access
Switch(config-if)# switchport port-security
Switch(config-if)# switchport port-security maximum 2
Switch(config-if)# switchport port-security mac-address sticky
Switch(config-if)# switchport port-security violation restrict

Switch# show port-security
Switch# show port-security interface gigabitEthernet 0/5

DHCP Snooping

DHCP snooping filters untrusted DHCP messages and builds a binding table. Only trusted ports should connect to legitimate DHCP servers or uplinks.

Switch(config)# ip dhcp snooping
Switch(config)# ip dhcp snooping vlan 10,20

Switch(config)# interface gigabitEthernet 0/24
Switch(config-if)# ip dhcp snooping trust

Dynamic ARP Inspection

Dynamic ARP Inspection validates ARP messages using the DHCP snooping binding table and helps prevent ARP spoofing.

Switch(config)# ip arp inspection vlan 10,20

Switch(config)# interface gigabitEthernet 0/24
Switch(config-if)# ip arp inspection trust

IP Source Guard

IP Source Guard filters traffic using IP-to-MAC bindings learned through DHCP snooping.

Switch(config)# interface gigabitEthernet 0/5
Switch(config-if)# ip verify source

5.9 Wireless Security

• Use WPA2 or WPA3 instead of obsolete WEP.
• Use long, unique passphrases for personal WLANs.
• Use 802.1X and RADIUS for enterprise authentication.
• Separate guest traffic from internal traffic.
• Disable unnecessary management access from guest networks.
• Monitor for rogue access points.

5.10 VPN Concepts

A Virtual Private Network creates a protected logical connection across an untrusted network. Encryption, authentication and integrity protection help secure the traffic.

5.11 Security Monitoring

Security is not complete after configuration. Administrators should monitor logs, authentication events, interface changes, failed access attempts and abnormal traffic.

Router# show logging
Router# show users
Router# show login
Router# show access-lists
Router# show ip ssh
Router# show interfaces counters errors

Security Fundamentals Lab

Security Review

6. Automation and Programmability

Automation uses software to configure, monitor and operate networks. Programmability makes network operations more consistent, repeatable and scalable.

6.1 Traditional and Controller-Based Networking

In traditional networking, an administrator configures each device individually. In controller-based networking, a centralized controller manages policy and communicates with network devices through APIs.

6.2 Software-Defined Networking

Software-defined networking separates the control plane from the data plane. A controller makes policy decisions, while network devices forward traffic according to those decisions.

6.3 Northbound and Southbound APIs

6.4 REST APIs

Representational State Transfer APIs commonly use HTTP methods to manipulate resources.

HTTP Status Codes

Example REST Request

GET https://controller.example/api/v1/devices

Response:
200 OK

6.5 JSON

JavaScript Object Notation is a lightweight data format commonly used by REST APIs.

{
  "device": {
    "hostname": "SW1",
    "management_ip": "192.168.10.2",
    "vlans": [10, 20, 30],
    "enabled": true
  }
}

6.6 YAML

YAML is a human-readable format commonly used by automation tools.

device:
  hostname: SW1
  management_ip: 192.168.10.2
  vlans:
    - 10
    - 20
    - 30
  enabled: true

6.7 Python for Network Automation

Python can connect to devices, collect command output, transform data and apply repeatable configuration.

devices = [
    {"hostname": "R1", "address": "192.168.10.1"},
    {"hostname": "R2", "address": "192.168.20.1"}
]

for device in devices:
    print("Checking", device["hostname"], device["address"])

Simple JSON Processing

import json

data = '''
{
  "hostname": "SW1",
  "vlans": [10, 20, 30]
}
'''

device = json.loads(data)

print(device["hostname"])
print(device["vlans"])

Configuration Generation

hostname = "ACCESS-SW1"
management_ip = "192.168.10.2"

configuration = f"""
hostname {hostname}
interface vlan 10
 ip address {management_ip} 255.255.255.0
 no shutdown
"""

print(configuration)

6.8 Configuration Management

Configuration-management tools describe the desired state of systems and help apply it consistently.

Example Ansible-Style YAML

---
- name: Configure access VLAN
  hosts: switches
  gather_facts: false

  tasks:
    - name: Create users VLAN
      ios_vlans:
        config:
          - name: USERS
            vlan_id: 10
        state: merged

6.9 Controller-Based Architecture Examples

6.10 Data Analytics and Machine Learning

Network platforms can collect telemetry and use analytics to identify trends, anomalies and likely faults.

6.11 Automation Benefits and Risks

Benefits

• Faster deployment
• Consistent configuration
• Reduced typing errors
• Repeatable changes
• Improved auditability
• Scalability

Risks

• A faulty template can affect many devices quickly.
• Exposed credentials can compromise the network.
• Unvalidated changes may cause outages.
• Automation can amplify mistakes.

Automation Lab

Automation Review

7. Practical CCNA Labs

These labs combine the main CCNA skills. Build each topology in Cisco Packet Tracer, configure it manually and verify every result.

Lab 1: Basic Router and Switch Setup

1. Add one PC, one switch and one router.
2. Connect the devices with copper Ethernet links.
3. Configure the router interface as 192.168.10.1/24.
4. Configure the PC as 192.168.10.10/24.
5. Set the PC default gateway to 192.168.10.1.
6. Configure the hostname and an enable secret.
7. Ping the router from the PC.
8. Verify with show ip interface brief.

Router(config)# hostname R1
R1(config)# enable secret CiscoSecret
R1(config)# interface gigabitEthernet 0/0
R1(config-if)# ip address 192.168.10.1 255.255.255.0
R1(config-if)# no shutdown

Lab 2: VLANs and Inter-VLAN Routing

1. Add one router, one switch and two PCs.
2. Create VLAN 10 for users and VLAN 20 for servers.
3. Assign one PC to each VLAN.
4. Configure the switch-to-router link as a trunk.
5. Create router subinterfaces for VLANs 10 and 20.
6. Configure the correct default gateway on each PC.
7. Ping between the two VLANs.

Switch(config)# vlan 10
Switch(config-vlan)# name USERS
Switch(config)# vlan 20
Switch(config-vlan)# name SERVERS

Switch(config)# interface gigabitEthernet 0/1
Switch(config-if)# switchport mode access
Switch(config-if)# switchport access vlan 10

Switch(config)# interface gigabitEthernet 0/2
Switch(config-if)# switchport mode access
Switch(config-if)# switchport access vlan 20

Switch(config)# interface gigabitEthernet 0/24
Switch(config-if)# switchport mode trunk

Router(config)# interface gigabitEthernet 0/0
Router(config-if)# no shutdown

Router(config)# interface gigabitEthernet 0/0.10
Router(config-subif)# encapsulation dot1Q 10
Router(config-subif)# ip address 192.168.10.1 255.255.255.0

Router(config)# interface gigabitEthernet 0/0.20
Router(config-subif)# encapsulation dot1Q 20
Router(config-subif)# ip address 192.168.20.1 255.255.255.0

Switch# show vlan brief
Switch# show interfaces trunk
Router# show ip interface brief

Lab 3: Static Routing

1. Add two routers and one LAN on each side.
2. Use 192.168.10.0/24 for LAN 1.
3. Use 192.168.20.0/24 for LAN 2.
4. Use 10.0.0.0/30 between the routers.
5. Configure both router interfaces.
6. Add a static route to the remote LAN on each router.
7. Test end-to-end connectivity.

R1(config)# ip route 192.168.20.0 255.255.255.0 10.0.0.2
R2(config)# ip route 192.168.10.0 255.255.255.0 10.0.0.1

Lab 4: OSPF

1. Use the topology from Lab 3.
2. Remove the static routes.
3. Configure OSPF process 1 on both routers.
4. Assign unique router IDs.
5. Advertise LAN and transit networks in area 0.
6. Verify the neighbour relationship.

R1(config)# router ospf 1
R1(config-router)# router-id 1.1.1.1
R1(config-router)# network 192.168.10.0 0.0.0.255 area 0
R1(config-router)# network 10.0.0.0 0.0.0.3 area 0

R2(config)# router ospf 1
R2(config-router)# router-id 2.2.2.2
R2(config-router)# network 192.168.20.0 0.0.0.255 area 0
R2(config-router)# network 10.0.0.0 0.0.0.3 area 0

show ip ospf neighbor
show ip route ospf
show ip ospf interface brief

Lab 5: DHCP and NAT

1. Configure a router with an inside LAN and outside interface.
2. Configure the router as a DHCP server.
3. Exclude the gateway addresses.
4. Configure PAT using the outside interface.
5. Verify that clients receive addresses.
6. Test connectivity to an external simulated server.

R1(config)# ip dhcp excluded-address 192.168.10.1 192.168.10.20
R1(config)# ip dhcp pool USERS
R1(dhcp-config)# network 192.168.10.0 255.255.255.0
R1(dhcp-config)# default-router 192.168.10.1
R1(dhcp-config)# dns-server 8.8.8.8

R1(config)# access-list 1 permit 192.168.10.0 0.0.0.255
R1(config)# ip nat inside source list 1 interface gigabitEthernet 0/1 overload

Lab 6: Secure Device Management

1. Set a hostname and enable secret.
2. Create a local administrator.
3. Generate RSA keys.
4. Enable SSH version 2.
5. Allow SSH only on VTY lines.
6. Set an inactivity timeout.
7. Verify the configuration.

Router(config)# hostname SECURE-R1
SECURE-R1(config)# ip domain-name lab.example
SECURE-R1(config)# username admin privilege 15 secret AdminSecret
SECURE-R1(config)# crypto key generate rsa modulus 2048
SECURE-R1(config)# ip ssh version 2

SECURE-R1(config)# line vty 0 4
SECURE-R1(config-line)# login local
SECURE-R1(config-line)# transport input ssh
SECURE-R1(config-line)# exec-timeout 5 0

Lab 7: Troubleshooting Challenge

Build a network with the following intentional errors:

• One router interface is shut down.
• One PC has an incorrect subnet mask.
• One switch port is assigned to the wrong VLAN.
• One trunk does not allow VLAN 20.
• One PC has the wrong default gateway.
• One OSPF network statement is incorrect.

Use this troubleshooting order:

1. Check physical links and interface status.
2. Check VLAN membership and trunk state.
3. Check IP addresses and subnet masks.
4. Check default gateways.
5. Check routing tables.
6. Check ACLs and security controls.
7. Test with ping, traceroute and protocol-specific commands.

show interfaces status
show vlan brief
show interfaces trunk
show ip interface brief
show ip route
show ip ospf neighbor
show access-lists
ping
traceroute

Lab Completion Checklist

• Every interface has the correct address and mask.
• Every active interface is operational.
• VLANs exist on all required switches.
• Trunks carry the required VLANs.
• Default gateways are correct.
• Routing tables contain all required networks.
• Security controls are verified rather than assumed.
• Configurations are saved after testing.

Router# copy running-config startup-config

8. Final CCNA Quiz

9. CCNA Glossary

Study Plan

1. Read one domain and summarize it without looking at the page.
2. Build the related Packet Tracer lab.
3. Verify every command and record the output.
4. Complete the review questions.
5. Repeat weak topics until you can explain them simply.
6. Use Cisco's current official exam topics to confirm scope.