CCNA 200-301
Deep Learning Handbook

A complete study guide to passing the Cisco CCNA certification and truly understanding modern networking principles. Rewritten from the Cisco public exam blueprint and official documentation, covering network fundamentals, switching, routing, IP services, WAN, security, and automation.

Core Important Awareness　Exam weight tiers

1OSI / TCP-IP Reference Model

Core Understanding the layered model is the foundation of all networking knowledge — it appears in almost every exam and is a prerequisite for every later chapter. If you only "memorize the seven layer names," you have not learned it. You must understand why we layer, what each layer does, and how data flows between layers.

1.1 Why Layering (understand the motivation first)

Networking is extremely complex: from electrical signals to application data, involving countless protocols, devices, and vendors. If all logic were crammed into one blob, any change would ripple everywhere. The essence of layering is divide and conquer:

• Single responsibility per layer: each layer does only its own job and provides a standard interface to adjacent layers — layers are decoupled.
• Vendor interoperability: as long as everyone follows the standard interface at each layer, vendor A's NIC can plug into vendor B's switch and run vendor C's application — this is what "open systems" means.
• Independent evolution: upgrading an application-layer protocol (e.g., HTTP/2) does not require reworking the physical layer; changing fiber media does not affect upper-layer logic.
• Easier troubleshooting: when a fault occurs, you locate it layer by layer, top-down or bottom-up — this is a network engineer's core working method, and both exams and interviews love to ask about it.

Two terms you must distinguish (exams love to split hairs):

• Interconnectivity: being physically and methodologically connected — e.g., "two machines linked by a cable, data can travel from one node to another."
• Interoperability: different vendors, different operating systems, different languages can mutually understand the data — e.g., a program on Windows and one on Linux communicate normally.

1.2 The OSI Seven-Layer Model, Layer by Layer

The OSI (Open Systems Interconnection) model is the de jure standard published by ISO (International Organization for Standardization) in 1984. The real world runs TCP/IP (the de facto standard), but OSI is the "anatomical chart" for understanding network responsibilities — used in both exams and troubleshooting.

1.2.1 Layer-by-layer detail (exam deep-dive)

• Layer 1 Physical: only cares about bits. Defines voltage levels, signal timing, connector shapes, pinouts (T568A/B), max distances. No addressing — it doesn't know "who sends to whom."
• Layer 2 Data Link: groups bits into frames, addresses within the same physical segment (broadcast domain) using MAC addresses. Detects errors (FCS/CRC) and drops damaged frames. Split into LLC and MAC sublayers (see Chapter 2).
• Layer 3 Network: addresses across networks (logical networks) using IP addresses and performs routing — "where does the packet go next." Routers care only about the destination IP, not TCP ports (that's Layer 4's job).
• Layer 4 Transport: uses port numbers to distinguish different applications (processes) on the same host. TCP provides reliability, ordering, flow control; UDP provides best-effort.
• Layers 5-7: Session manages "start/stop of the conversation," Presentation manages "the form of data (encryption/encoding)," Application manages "what service the user gets." In reality these three are usually merged in applications (e.g., HTTP + encryption live together in a browser).

1.3 Encapsulation & De-encapsulation (the life of data)

Encapsulation: as data travels down the sender's stack, each layer adds its own header (and sometimes a trailer, e.g., Ethernet FCS) in front of the previous layer's data. De-encapsulation: the receiver goes up, peeling and checking each layer's header phases and passing the "payload" upward.

A real example — you browse http://www.example.com:

[Application] HTTP request message (GET / HTTP/1.1 + headers)
    ↓ handed to transport
[Transport]  Add TCP header (src port 54321, dst port 80, seq, window...) → Segment
    ↓ handed to network
[Network]    Add IP header (src 192.168.1.10, dst 93.184.216.34) → Packet
    ↓ handed to data link
[Data Link]  Add Ethernet header (src MAC, dst MAC = gateway's MAC) + FCS → Frame
    ↓ handed to physical
[Physical]   Become electrical/optical signals → Bits on the wire

At the far end, de-encapsulation in reverse: Physical receives bits → Data Link strips the MAC header, checks FCS → Network strips the IP header, checks if the destination IP is itself → Transport strips the TCP header and delivers to the process listening on port 80 (the web server).

1.4 Peer-to-Peer Communication

Another meaning of layering: only peers "talk" to each other. The sender's Layer 4 and the receiver's Layer 4 "logically communicate directly" (relayed through lower layers) — this is peer communication. Example: the TCP three-way handshake is a "conversation" between the two endpoints' transport layers; OSPF Hellos are a conversation between two routers' network-layer routing processes. Lower layers are just "couriers" that carry the upper-layer message unchanged.

Conceptually, each layer believes it is "directly connected" to its peer at the far end, relying on the services of the layer below. This is the Service Access Point (SAP) concept — each layer provides services to the layer above through a SAP.

1.5 The TCP/IP Model (the real-world standard)

TCP/IP is the de facto standard — the protocol stack the Internet actually runs. It merges the OSI seven layers into 4 (some textbooks teach 5, splitting the network access layer into data link + physical):

1.6 Device-to-Layer Mapping (memorize this table)

Collision domain: the set of devices that can "collide" if they transmit simultaneously. Each switch port is its own collision domain; full-duplex has no collisions. Broadcast domain: the set of devices a broadcast frame (dst MAC all-FF) can reach. Routers naturally isolate broadcast domains; switches need VLANs to do so.

1.7 Chapter Self-Test

Q1. What is application data called at the transport layer? At the network layer? At the data link layer?
Ans: Segment → Packet → Frame.

Q2. At which layer do a switch, router, and hub work? What do they forward on?
Ans: Switch L2 (MAC table); Router L3 (IP routing table); Hub L1 (no forwarding basis, broadcasts).

Q3. Data goes from host A to host B through 3 routers. How many times do the IP address and MAC address change?
Ans: IP never changes (end-to-end); MAC changes every hop (4 hops = 4 changes).

Q4. Which OSI layer handles encryption and compression? Which handles port addressing?
Ans: Presentation (L6) encryption/compression; Transport (L4) port addressing.

Q5. The TCP/IP "Application" layer corresponds to which OSI layers?
Ans: Layers 5+6+7 (Session + Presentation + Application).

2Ethernet & the Data Link Layer

Core Ethernet is the de facto standard for almost all LANs, and the switch is its core device. This chapter is the prerequisite for switching (Chapters 5-8). After this chapter you should be able to answer: what is inside a frame? How is a MAC address structured? What does a switch forward on?

2.1 The Two Sublayers of the Data Link Layer

The data link layer (Layer 2) is subdivided into two sublayers, per the IEEE 802 family of standards:

• LLC (Logical Link Control) — the upper sublayer, interfaces with Layer 3, identifies the upper-layer protocol type (IPv4 or IPv6), and provides a uniform interface via SAP (Service Access Point). Its core value: letting Layer 2 "generically" carry multiple Layer-3 protocols.
• MAC (Media Access Control) — the lower sublayer, responsible for two big jobs: ① physical addressing (source/destination MAC addressing in frames); ② media access control (deciding "who may transmit on a shared medium" — the collision-avoidance mechanism CSMA/CD or CSMA/CA).

You must clearly distinguish the two media access mechanisms:

2.2 The Ethernet Frame Structure (tear a frame apart)

The 802.3 Ethernet frame (base frame, no VLAN tag) consists of these fields — exams often test "what does each field do":

Minimum frame size is 64 bytes (excluding preamble): dst 6 + src 6 + type 2 + data 46 + FCS 4 = 64. Why 64? So that in half-duplex a collision can always be detected — the sender must still be transmitting when the signal reaches the far end and returns (the round-trip time, RTT). This is the classic CSMA/CD derivation; exams sometimes ask "why is the minimum frame 64 bytes."

2.3 The Ethernet Standard Family (speed × media)

IEEE 802.3 defines the physical layer and the MAC part of the data link layer. Naming rule: speed + BASE (baseband) + media. T = twisted pair, SX = short-wavelength multimode fiber, LX = long-wavelength single-mode fiber, SR/LR = 10G fiber (short/long reach).

2.4 Twisted Pair & Pinouts (hands-on knowledge)

Twisted pair cabling has two termination styles:

• Straight-through: same pinout at both ends (both T568A or both T568B). Used between unlike devices: PC↔switch, switch↔router, PC↔hub.
• Crossover: T568A at one end, T568B at the other (pins 1-3, 2-6 swapped). Used between like devices: PC↔PC, switch↔switch, PC↔router. Modern devices have Auto-MDIX, so crossover cables are rarely needed, but the exam still covers them.

T568B pinout: white-orange, orange, white-green, blue, white-blue, green, white-brown, brown (remember "orange, green, blue, brown").

2.5 MAC Address Deep Dive (physical address)

A MAC address is 48 bits (6 bytes) in hexadecimal, burned into the NIC ROM, used for Layer-2 frame addressing. Formats: 00:1A:2B:3C:4D:5E (colon), 001A.2B3C.4D5E (Cisco dotted), or 00-1A-2B-3C-4D-5E (hyphen).

• First 24 bits (3 bytes) = OUI (Organizationally Unique Identifier), assigned by IEEE to vendors — the first 3 bytes identify the vendor.
• Last 24 bits (3 bytes) = vendor-assigned serial number (unique per NIC).
• Least significant bit of byte 1 (I/G bit): 0 = unicast, 1 = multicast.
• Second-least significant bit (U/L bit): 0 = globally unique (factory), 1 = locally administered (changeable, e.g., MAC randomization).
• Broadcast address: FF:FF:FF:FF:FF:FF (all 48 bits 1), reaches all hosts in the broadcast domain.
• Common multicast MACs: 01:00:5E:xx:xx:xx (IPv4 multicast), 01:80:C2:00:00:00 (STP BPDUs), 01:80:C2:00:00:08 (PAgP), 01:00:0C:CC:CC:CC (CDP/VTP).

2.6 Switch vs Hub vs Router (deep comparison)

Collision domain: the set of devices that could "collide" if they transmit at the same time. A hub puts all ports in one collision domain; a switch gives each port its own (full-duplex eliminates collisions entirely). Broadcast domain: the set of devices a broadcast frame can reach. Routers create one per interface (natural isolation); switches do not isolate by default (except with VLANs).

2.7 The Switch MAC Table & Forwarding Process (walk through one example)

A switch boots with an empty MAC table. Here is a complete walk-through (4 PCs connected to SW1's F0/1-F0/4):

1. PC-A (F0/1) sends a frame to PC-C (F0/3):
   - SW1 checks the source MAC: not in table → learn it (F0/1 port)
   - SW1 checks the destination MAC 0000.3333.CCCC: not in table → flood to all ports (except F0/1)
   - PC-C receives it (it is the addressee); the other ports drop it
2. PC-C replies to PC-A:
   - SW1 learns PC-C's MAC (F0/3 port)
   - SW1 checks destination 0000.1111.AAAA: in table now → forward only out F0/1 (no flood)
3. From now on, PC-A ↔ PC-C traffic is forwarded precisely, not disturbing other ports

Three behaviors summarized: unknown unicast / broadcast → flood; known unicast → forward precisely; destination on the receiving port → drop. MAC table entries age out after 300 seconds (5 min) by default to avoid stale entries.

3Network Layer · IP Addressing & Subnetting

Core IP addressing and subnetting are the heaviest CCNA exam topics — calculation questions are almost guaranteed, and it is the foundation of all network troubleshooting. This chapter must be drilled to "reflex level": given an IP+mask, compute the network address, broadcast address, usable range, and subnet count within seconds.

3.1 IPv4 Address Structure (solidify the basics)

An IPv4 address is a 32-bit binary number written in dotted decimal (4 octets, 8 bits each, range 0-255). It has two parts: Network bits (which network are you in) + Host bits (which host are you within that network). The Subnet Mask marks network bits with consecutive 1s and host bits with 0s.

IP     :  192.168.10.5
Binary :  11000000.10101000.00001010.00000101
Mask   :  255.255.255.0   = /24
Mask binary: 11111111.11111111.11111111.00000000
               ←—— 24 network bits ——→ ←8 host bits→

Network address = IP AND Mask = 192.168.10.0  (host bits all 0)
Broadcast address = network + host bits all 1 = 192.168.10.255
Usable hosts = 192.168.10.1 - 192.168.10.254  (254 total)

3.2 Binary ↔ Decimal Conversion (must be fluent)

Each octet's bit weights (high to low):

128 | 64 | 32 | 16 | 8 | 4 | 2 | 1
 1    1    0    0    1    0   1   0   = 128+64+8+2 = 202

Must-memorize decimal values (instant exam recall):

Power table (memorize to 2^10): 2^0=1, 2^1=2, 2^2=4, 2^3=8, 2^4=16, 2^5=32, 2^6=64, 2^7=128, 2^8=256, 2^9=512, 2^10=1024. Subnetting uses 2^n and 2^m-2 every day.

3.3 Address Classes (Classful) & Default Masks

Historically the first octet determined 5 classes. Although we now use classless (CIDR), the class concept is still exam fundamentals:

3.4 Subnetting Core Skill (the most important section)

Subnetting: "borrow" host bits to become subnet bits, splitting one network into multiple logical subnets. Goals: segment by department/floor, shrink broadcast domains, save addresses, simplify routing.

Two golden formulas (memorize blindfolded):

Number of subnets          = 2^n        (n = host bits borrowed)
Usable hosts per subnet    = 2^m - 2    (m = remaining host bits, minus 2 for network+broadcast)

Step-by-step problem-solving flow (the fixed exam pattern):

3.4.1 Full example: subnet a network (work through it)

Problem: company has 192.168.10.0/24, needs 6 departments, each ≤ 25 hosts. How?

① Need ≥6 subnets: 2^n ≥ 6 → n = 3 (2^3 = 8 subnets, enough)
② Borrow 3 bits → mask /27 (255.255.255.224), 5 host bits left
③ Usable hosts per subnet = 2^5 - 2 = 30 ≥ 25 ✓
④ Block size = 256 - 224 = 32
⑤ Subnet table:
   Subnet 0:  192.168.10.0   broadcast 192.168.10.31   usable .1-.30
   Subnet 1:  192.168.10.32  broadcast 192.168.10.63   usable .33-.62
   Subnet 2:  192.168.10.64  broadcast 192.168.10.95   usable .65-.94
   Subnet 3:  192.168.10.96  broadcast 192.168.10.127  usable .97-.126
   Subnet 4:  192.168.10.128 broadcast 192.168.10.159  usable .129-.158
   Subnet 5:  192.168.10.160 broadcast 192.168.10.191  usable .161-.190
   Subnet 6:  192.168.10.192 broadcast 192.168.10.223  usable .193-.222
   Subnet 7:  192.168.10.224 broadcast 192.168.10.255  usable .225-.254

3.4.2 Full example: given an IP, find the three essentials

Problem: IP 172.16.35.123, mask 255.255.240.0 (/20). Find network, broadcast, usable range.

① Mask 255.255.240.0 → third octet is 240, block = 256-240 = 16
② Third octet 35 aligns to a multiple of 16: 16×2=32 ≤ 35 < 48=16×3 → third octet = 32
③ Network address = 172.16.32.0
④ Broadcast = network + block - 1 (affects the 240 octet and below)
   = 172.16.(32+16-1).255 = 172.16.47.255
⑤ Usable range = 172.16.32.1 ~ 172.16.47.254
⑥ Usable hosts = 2^(32-20) - 2 = 2^12 - 2 = 4094

3.4.3 Special mask quick table (within /24)

3.5 VLSM (Variable-Length Subnet Masks)

VLSM: use different length masks within one major network, allocating addresses by each subnet's actual need to avoid waste. Allocation order: start with the subnet needing the most hosts, use the biggest block, then work down (large block first).

Example: 192.168.1.0/24 must serve: A=50 hosts, B=25, C=10, D=2.

① A(50)  needs 2^6-2=62 → /26, block 64 → 192.168.1.0/26  (.0-.63)
② B(25)  needs 2^5-2=30 → /27, block 32 → 192.168.1.64/27 (.64-.95)
③ C(10)  needs 2^4-2=14 → /28, block 16 → 192.168.1.96/28 (.96-.111)
④ D(2)   needs 2^2-2=2  → /30, block 4  → 192.168.1.112/30 (.112-.115)
Rest from .116 onward reserved for future growth (blocks must align)

3.6 CIDR & Route Summarization (Supernetting)

CIDR (Classless Inter-Domain Routing): slash notation (/8~/32) replaces classful A/B/C limits. It enables two powers:

• VLSM: different prefix lengths inside one network (see 3.5).
• Route summarization (supernetting): merge multiple contiguous small networks into one larger route entry, shrinking the routing table. E.g., four /24s (192.168.0.0, .1.0, .2.0, .3.0) summarize to 192.168.0.0/22.

Summary rule: find the common prefix bits. 192.168.0.0/24 = 11000000.10101000.00000000..., 192.168.3.0/24 shares the first 22 bits → summarize as /22.

3.7 ARP & ICMP (the network layer's left and right hands)

Not addressing per se, but they are the protocols IP works with — exams love them:

• ARP (Address Resolution Protocol): given a destination IP, find the destination's MAC within the same broadcast domain. Process: check ARP cache → if absent, broadcast "who is 192.168.1.1?" → the target unicasts a reply → cache it (timeout ~2-4 min; Cisco default 4 hours). ARP sits between L2 and L3 (works at the link layer, serves the network layer). When crossing networks, the frame's destination MAC is the gateway's MAC, NOT the destination host's MAC — the most common misconception.
• ICMP (Internet Control Message Protocol): error reporting and network diagnostics. ping uses ICMP Echo Request/Reply; traceroute uses ICMP TTL-exceeded. ICMP carries no user data; it is IP's "messenger."

3.8 Chapter Self-Test (subnet questions must be 100%)

Q1. How many subnets in 192.168.1.0/26? Usable hosts per subnet? Network and broadcast of the 2nd subnet?
Ans: 2 borrowed → 4 subnets; hosts 2^6-2=62; 2nd (index 1) = 192.168.1.64, broadcast 192.168.1.127.

Q2. IP 10.10.10.100 mask 255.255.255.240 — network address?
Ans: block 16, 100 aligns to 96 → 10.10.10.96.

Q3. Connecting two routers — which mask wastes the least addresses?
Ans: /30 (255.255.255.252), 2 usable hosts.

Q4. 172.16.5.0/24 split into 5 subnets of ≤20 hosts — mask?
Ans: 20 hosts needs 2^5-2=30 → 5 host bits → /27 (255.255.255.224), subnets 2^3=8≥5.

Q5. Host A (192.168.1.10/24) reaches host B (192.168.2.20/24) — whose MAC is the destination in the frame?
Ans: the default gateway's MAC — cross-network frames use the gateway as destination MAC.

4Transport & Application Layers

Core The TCP vs UDP distinction is a must-know; memorize common port numbers. The transport layer is the first "end-to-end" layer — it manages application-to-application conversation, not network-to-network.

4.1 What the Transport Layer Actually Does

The network layer (IP) delivers a packet to "the destination host," but a host runs dozens of applications — browser, mail, game... Which process gets the packet? That is what the transport layer solves with port numbers. IP addresses "which machine"; ports address "which application on that machine." Together they form the Socket = IP:port (e.g., 192.168.1.10:80).

TCP and UDP are the exam's core comparison — you must understand the mechanisms, not just memorize the chart.

4.2 TCP Deep Dive (the mechanisms of reliability)

TCP provides connection-oriented, reliable, ordered byte-stream delivery. Its reliability is not "automatic" — a set of mechanisms guarantees it:

4.2.1 The three-way handshake (why three?)

Client                                  Server
   |------ SYN(seq=x) ------->|  ① Client: I want to connect
   |<--- SYN-ACK(seq=y,ack=x+1)-| ② Server: received, agreed (and syncs its seq)
   |------ ACK(ack=y+1) ----->|  ③ Client: confirmed, start data
   ===== connection established =====

Why three? TCP is full-duplex — both sides must confirm "the peer can receive and send." Two handshakes cannot confirm "the client's receiving ability" (the server does not know the client got its SYN-ACK); four is redundant. The third ACK lets the server confirm the client is ready. Exams love: "why not two?" — answer: to prevent a stale connection request arriving late from creating a spurious connection (the classic "two-way handshake error" problem).

4.2.2 Sliding window (flow control core)

The receiver advertises its receive window (rwnd) in ACKs — "you may send at most this many bytes before I need to process them." The sender transmits within the window without waiting for each ACK (pipelining), dramatically boosting throughput. The window size changes dynamically: bigger when processing fast, smaller when overwhelmed. This is end-to-end flow control, distinct from network congestion control (cwnd) — exams distinguish them.

4.3 UDP Deep Dive (the cost of simplicity)

UDP is connectionless, unreliable, best-effort datagram delivery: no handshake, no ACK, no retransmit, no ordering. Benefits: small overhead (8-byte header vs TCP's 20), low latency, no connection-management burden. Fits: real-time voice/video (a lost frame is fine; retransmission causes lag), DNS (one question/answer), DHCP (broadcast scenario), SNMP, online games.

4.4 TCP vs UDP — the ultimate comparison table (memorize this)

4.5 Port Numbers (memorize this table — instant exam points)

4.6 Common Application-Layer Protocols, One by One

• HTTP/HTTPS: request-response model. HTTP is stateless (cookies maintain sessions); HTTPS = HTTP + TLS. Methods: GET (read), POST (write), PUT (update), DELETE (delete). Status codes: 200 OK, 301/302 redirect, 403 forbidden, 404 not found, 500 server error.
• DNS: name → IP. Resolution order: local cache → hosts file → local DNS server → root/TLD/authoritative (recursive or iterative). Record types: A (IPv4), AAAA (IPv6), CNAME (alias), MX (mail server), NS (name server), PTR (reverse), TXT (text/SPF). DNS queries default UDP/53; zone transfers (master-slave sync) use TCP/53.
• DHCP: automatic IP assignment, UDP 67/68, four steps DORA (Discover→Offer→Request→Ack). Lease renewal (T1 = 50% of lease renews, T2 = 87.5% rediscover). See Chapter 12.
• FTP/TFTP: FTP uses TCP (21 control + 20 data in active mode; passive uses a random data port), supports auth and directory browsing. TFTP uses UDP/69, minimal, no auth, used for IOS upgrades.
• SMTP/POP3/IMAP: SMTP sends (TCP/25); POP3 downloads and removes (110); IMAP keeps mail on the server for multi-device sync (143).
• SNMP: network device management. Manager polls Get (161); devices send Traps (162). Based on MIB. Versions v1/v2c (plaintext community) / v3 (encrypted auth).
• Telnet/SSH: device remote management. Telnet plaintext (23); SSH encrypted (22, the modern must).

4.7 Chapter Self-Test

Q1. Which protocol uses UDP? A. FTP B. HTTP C. DNS D. SMTP
Ans: C (DNS default UDP/53).

Q2. The three messages of the TCP handshake, in order?
Ans: SYN → SYN-ACK → ACK.

Q3. Which port maps to SSH? Why is it better than Telnet?
Ans: 22; SSH encrypts, Telnet is plaintext.

Q4. HTTPS port and the two protocols it builds on?
Ans: 443; HTTP + TLS/SSL.

Q5. What problem does the sliding window solve?
Ans: Flow control — the receiver advertises a window to throttle the sender and prevent receive-buffer overflow.

5Switch Basics & VLAN

Core Switching is the backbone of CCNA, and VLAN is the core switching concept — guaranteed exam material. After this chapter you should be able to: explain the switch's three forwarding behaviors, say why VLANs exist, configure VLANs, and manage a switch.

5.1 The Switch's Three Forwarding Behaviors (understand the principle before the commands)

A switch maintains a MAC address table (CAM table). On receiving a frame it does three steps: learn the source address → look up the destination → decide. There are only three decisions:

Details: MAC entries age out after 300 seconds (5 min) by default; CAM capacity varies by model (e.g., ~8K entries on a 2960). Flooding is how a Layer-2 network "learns" addresses — the first communication relies on it, then precise forwarding takes over.

SW1# show mac address-table
VLAN  Mac Address        Type      Ports
----  ----------------   --------  -----
1     0000.1111.AAAA     DYNAMIC   Fa0/1
1     0000.3333.CCCC     DYNAMIC   Fa0/3
1     0000.5555.EEEE     DYNAMIC   Fa0/2

5.2 What Is a VLAN (understand the "why" first)

VLAN (Virtual Local Area Network): logically grouping ports on one or more switches, where each group is an independent Layer-2 broadcast domain. By default all ports on a switch are in VLAN 1 (one broadcast domain). VLANs slice one physical network into multiple logical networks.

Four core motivations (answer "benefits of VLANs" with these):

• Broadcast isolation: broadcasts in one VLAN do not reach other VLANs, limiting the blast radius of broadcast storms.
• Enhanced security: sensitive departments (finance) are logically isolated; no access without routing.
• Simpler management & troubleshooting: group by department/floor/function regardless of physical location (the same VLAN can span multiple switches).
• Performance: smaller broadcast domains → less irrelevant traffic → more usable bandwidth.

5.3 VLAN Ranges (memorize the numbers)

VLAN IDs run 1-4094 (0 and 4095 reserved). 802.1Q uses 12 bits for the VLAN ID, hence 4096 theoretical VLANs.

5.4 Port Modes: Access vs Trunk (must be crystal clear)

5.5 Configuring VLANs (step-by-step + verification output)

Commands

SW1# configure terminal
SW1(config)# vlan 10                      ← create VLAN 10
SW1(config-vlan)# name SALES              ← name it (optional, recommended)
SW1(config-vlan)# exit
SW1(config)# vlan 20
SW1(config-vlan)# name FINANCE
SW1(config-vlan)# exit
SW1(config)# interface f0/1               ← enter the port
SW1(config-if)# switchport mode access    ← set access mode
SW1(config-if)# switchport access vlan 10 ← assign to VLAN 10
SW1(config-if)# exit
SW1(config)# interface range f0/2-10      ← batch-select ports 2-10
SW1(config-if-range)# switchport mode access
SW1(config-if-range)# switchport access vlan 20
SW1(config-if-range)# exit
SW1(config)# end
SW1# show vlan brief                      ← verify

Verification output (learn to read it):

SW1# show vlan brief
VLAN Name                             Status    Ports
---- -------------------------------- --------- -------------------------------
1    default                          active    Fa0/11, Fa0/12, ... (unassigned)
10   SALES                            active    Fa0/1
20   FINANCE                          active    Fa0/2, Fa0/3, ... Fa0/10
1002 fddi-default                     act/unsup
...

Delete: no vlan 10 (removes access assignments; ports return to VLAN 1). VLAN 1 cannot be deleted.

5.6 Basic Switch Management (every device needs this)

Commands Configure a manageable switch from zero:

enable
configure terminal
hostname SW1                        # 1. Hostname
enable secret cisco123              # 2. Encrypted privileged password (avoid enable password)
service password-encryption         # 3. Encrypt all plaintext passwords in config
banner motd #UNAUTHORIZED ACCESS PROHIBITED#  # 4. Login banner
line console 0                      # 5. Console password
  password cisco
  login
  logging synchronous
line vty 0 4                        # 6. Remote (SSH/Telnet) password
  password cisco
  login
interface vlan 1                    # 7. Management IP (SVI)
  ip address 192.168.1.2 255.255.255.0
  no shutdown
ip default-gateway 192.168.1.1      # 8. Default gateway (for cross-subnet management)
end
copy running-config startup-config  # 9. Save config (always!)

5.7 Common Troubleshooting (exam lab mindset)

• PC can't get IP / no connectivity: check port status (show interfaces status) → check no shutdown → check access vlan pairing.
• Same-VLAN but no connectivity: check both access VLANs match, cable/port up, MAC table has entries.
• Cross-VLAN "not working" is normal: it needs Layer-3 routing, not a config error (unless you configured SVI + Layer-3 interface).
• Port err-disabled: possibly port security, BPDU guard, or UDLD — show interfaces status shows the cause; fix it, then shutdown + no shutdown to recover.

6Trunk · 802.1Q · DTP

Core Trunks carry VLANs between switches — a must-know. After this chapter: explain why trunks tag frames, how 802.1Q tags, what the native VLAN is, and how DTP modes negotiate.

6.1 Why Trunk (think about the problem first)

Two switches need to carry multiple VLANs between them. If each cable carried one VLAN, 10 VLANs would need 10 cables — absurd. The solution: one cable carries all VLANs, and a "tag" identifies which VLAN each frame belongs to. That cable is the Trunk.

A host in VLAN 10 on switch 1 sends to a host in VLAN 10 on switch 2: the frame leaves switch 1's trunk port tagged "VLAN 10"; switch 2's trunk port receives it, sees tag 10, strips it, and forwards only to VLAN 10 access ports locally. Frames of other VLANs mixed on the same cable never interfere.

6.2 The 802.1Q Tag (industry standard — must-know)

IEEE 802.1Q is the only industry-standard trunk encapsulation (Cisco's proprietary ISL is obsolete; the new exam only covers 802.1Q). It inserts a 4-byte tag after the source MAC:

Original Ethernet frame:
[Dst MAC 6B][Src MAC 6B][Type 2B][Payload 46-1500B][FCS 4B]

802.1Q frame:
[Dst MAC 6B][Src MAC 6B][TPID 2B][TCI 2B][Type 2B][Payload][FCS (recomputed)]

TPID = 0x8100 (2 bytes): marks "this is an 802.1Q tagged frame"
TCI  = 2 bytes, containing:
  - PCP (3 bits): priority (0-7, for QoS)
  - DEI (1 bit): drop eligible
  - VID (12 bits): VLAN ID (0-4095, usable 1-4094)

Key points:

• The tag sits after the source MAC, before the Type field; the original 2-byte Type/Length position is taken by TPID, so the real upper-layer Type shifts 4 bytes later.
• After inserting the tag, the FCS must be recomputed (the frame changed).
• Max frame size grows from 1518 to 1522 bytes (4-byte tag); MTU adjusts accordingly.

6.3 Native VLAN — the most confusing point

A trunk has one special VLAN: the Native VLAN (default VLAN 1). Rule: native-VLAN frames travel the trunk UNtagged; every other VLAN is tagged.

Why does it exist? — compatibility with devices/protocols that don't support 802.1Q (some CDP, VTP, DTP, and STP BPDUs travel untagged).

6.4 DTP (Dynamic Trunking Protocol) — Cisco-proprietary negotiation

DTP is a Cisco-proprietary protocol that lets adjacent ports auto-negotiate whether to become a trunk. It runs on a direct link, sending DTP frames (dst MAC 01:00:0C:CC:CC:CC) periodically.

6.5 Configuring Trunk (complete commands + verification)

Commands

SW1(config)# interface g0/1
SW1(config-if)# switchport mode trunk          # trunk mode (implicitly enables DTP negotiation)
# more formally (encapsulation first):
SW1(config-if)# switchport trunk encapsulation dot1q   # 802.1Q encapsulation (older multi-encap platforms)
SW1(config-if)# switchport mode trunk
# optional: restrict allowed VLANs
SW1(config-if)# switchport trunk allowed vlan 10,20,30   # only these VLANs
# optional: change native VLAN
SW1(config-if)# switchport trunk native vlan 99
# optional: disable DTP
SW1(config-if)# switchport nonegotiate
SW1(config-if)# no shutdown
SW1(config-if)# end
SW1# show interfaces trunk                     # verify
SW1# show interfaces trunk allowed-vlan        # allowed list

Reading the verification output:

SW1# show interfaces trunk
Port        Mode         Encapsulation  Status        Native vlan
Gi0/1       on           802.1q         trunking      99
...
Port        Vlans allowed on trunk
Gi0/1       10,20,30
Port        Vlans allowed and active in management domain
Gi0/1       10,20,30

Troubleshooting: ① both ends' modes must be compatible (trunk + trunk/dynamic work); ② native VLAN must match; ③ the allowed list must cover the VLANs that need to communicate; ④ Status must read trunking to be up — not-trunking means negotiation failed.

6.6 Router-on-a-Stick — inter-VLAN routing

Inter-VLAN communication needs Layer 3. The classic approach: Router-on-a-Stick — one trunk link to the router; the router creates subinterfaces, one per VLAN, each in a different subnet.

R1(config)# interface g0/0.10           # subinterface .10 for VLAN 10
R1(config-subif)# encapsulation dot1Q 10 # tag 802.1Q, VID=10
R1(config-subif)# ip address 192.168.10.1 255.255.255.0   # VLAN 10 gateway
R1(config-subif)# exit
R1(config)# interface g0/0.20           # subinterface .20 for VLAN 20
R1(config-subif)# encapsulation dot1Q 20
R1(config-subif)# ip address 192.168.20.1 255.255.255.0   # VLAN 20 gateway
R1(config-subif)# exit
R1(config)# interface g0/0
R1(config-if)# no shutdown             # physical port must be up (no IP needed; subinterfaces handle it)

# switch side: the port to the router must be a trunk
SW1(config)# interface g0/24
SW1(config-if)# switchport mode trunk

6.7 Chapter Self-Test

Q1. Which VLAN's frames are untagged on a trunk?
Ans: the Native VLAN (default VLAN 1, changeable).

Q2. Where is the 802.1Q tag inserted, and how many bytes?
Ans: after the source MAC, before the Type field; 4 bytes (TPID 2B + TCI 2B).

Q3. Which DTP modes actively negotiate? Which pair never becomes a trunk?
Ans: dynamic desirable and trunk are active; two dynamic auto (both passive) never trunk.

Q4. In Router-on-a-Stick, does the physical router interface need an IP?
Ans: No — IPs go on the subinterfaces.

Q5. Why disable DTP in production?
Ans: to prevent VLAN hopping — an attacker negotiates a trunk and reaches all VLANs.

7STP Spanning Tree Protocol

Core STP prevents Layer-2 loops in switched networks — a must-know, commonly testing root bridge election, port states, and port roles. After this chapter: name loop's three sins, elect root/root-port/designated-port by the rules, draw the port state machine, and explain why RSTP is fast.

7.1 Why STP (the three sins of a loop)

Redundant design creates physical loops in switched networks. A loop's three catastrophic consequences:

STP (Spanning Tree Protocol): logically block some redundant ports, pruning the physical loop into a loop-free logical tree, while keeping redundant paths as backups — when the primary path fails, the backup activates automatically. A classic "use space for safety" design.

7.2 BPDU & Bridge ID (STP's communication language)

Switches exchange BPDUs (Bridge Protocol Data Units). BPDUs use multicast MAC 01:80:C2:00:00:00, sent every 2 seconds by default (Hello Time).

Each switch has a Bridge ID:

Bridge ID = Priority (2 bytes, default 32768) + MAC address (6 bytes)
Example: 32768.aaaa.bbbb.cccc
Comparison: priority first (smaller wins), then MAC (smaller wins)

IEEE later extended it to: priority + extended system ID (VLAN number) + MAC. Priority is configurable in multiples of 4096 (0-61440).

7.3 The STP Election Trio (exam core — memorize)

Three iron rules: ① all root ports on the root bridge are DPs; ② every non-root switch has exactly one RP; ③ on every link, one end is DP, the other is RP or blocked. Port cost table (memorize):

7.4 Port State Machine (802.1D — memorize the order)

Blocking → Listening → Learning → Forwarding
   ↑_______________________________________|
        (back to blocking when link/root changes)

Disabled (shutdown or failed port)

Default timers:
  Blocking: 20 sec (Max Age, BPDU aging)
  Listening: 15 sec (Forward Delay, wait for BPDU convergence)
  Learning: 15 sec (Forward Delay, learn MACs, no forwarding)
  Forwarding: normal operation
  Total: about 50 seconds from blocking to forwarding

7.5 Port Roles & RSTP (802.1w — the modern default)

RSTP collapses 802.1D's five states into three (Discarding, Learning, Forwarding) and adds port roles:

Why RSTP is fast:

• Proposal/Agreement handshake: handshake-style negotiation, no timer waits — converges in seconds.
• Edge ports: ports to end devices go straight to forwarding, no wait — but if a BPDU arrives they revert to normal ports (BPDU Guard can prevent this).
• Alternate ports take over instantly: when a root port fails, the Alternate enters forwarding immediately, no recomputation.
• Backward compatible with 802.1D (BPDU version negotiation).

7.6 STP Enhancements (frequently tested)

7.7 Configuration & Verification (with output reading)

SW1(config)# spanning-tree mode rapid-pvst      # Rapid PVST+ (modern default)
SW1(config)# spanning-tree vlan 10 root primary  # force root for VLAN 10 (lowers priority)
SW1(config)# spanning-tree vlan 10 priority 4096 # manual priority (smaller = more likely root)
SW1(config)# interface f0/1
SW1(config-if)# switchport mode access
SW1(config-if)# spanning-tree portfast           # access port fast forward
SW1(config-if)# spanning-tree bpduguard enable   # block forged BPDUs
SW1(config-if)# end

SW1# show spanning-tree                          # core verification
VLAN0010
  Spanning tree enabled protocol rstp
  Root ID    Priority    4096
             Address     aaaa.bbbb.cccc           ← root bridge MAC (yours or someone else's)
             Cost        0                       ← cost to root (0 on the root itself)
  Bridge ID  Priority    4096
             Address     aaaa.bbbb.cccc
             Hello Time  2 sec  Max Age 20 sec  Forward Delay 15 sec

Interface        Role Sts Cost      Prio.Nbr Type
---------------- ---- --- --------- -------- --------------------------------
Fa0/1            Desg FWD 19        128.1     P2p Edge    ← edge port forwarding
Fa0/2            Root FWD 19        128.2     P2p         ← root port forwarding
Fa0/3            Altn BLK 19        128.3     P2p         ← alternate port blocked

SW1# show spanning-tree summary

How to read the output: compare Root ID vs Bridge ID to see if you are the root; read each port's Role (Root/Desg/Altn/Back) and Sts (FWD/BLK); Edge means PortFast.

7.8 Chapter Self-Test

Q1. How is the root bridge elected in STP?
Ans: smallest Bridge ID (priority first, then MAC).

Q2. On a non-root switch, which port has the lowest cost to the root?
Ans: the Root Port.

Q3. 802.1D blocking→forwarding: which states, how long?
Ans: blocking→listening→learning→forwarding, ~50 sec (20+15+15).

Q4. Why is RSTP faster than 802.1D?
Ans: proposal/agreement handshake, edge ports straight to forwarding, alternate ports take over instantly — ~6 sec.

Q5. What STP features should an access port to a PC have?
Ans: PortFast (skip listening/learning) + BPDU Guard (block forged BPDUs).

8EtherChannel · Link Aggregation

Important Bundling multiple physical links into one logical link for more bandwidth and redundancy. After this chapter: explain why plain multi-links get wasted by STP, how EtherChannel solves it, and how to configure LACP and PAgP.

8.1 Why EtherChannel (see the pain point first)

Two switches connected by two cables — what happens? — STP blocks one (to prevent loops) and the other sits idle; bandwidth does not double. If you disable STP, loop storms appear instantly. The pain: redundancy yes, bandwidth wasted.

EtherChannel solves it: bundle 2-8 physical links into one logical port (port-channel). STP treats it as one logical link — no block, no loop; all physical links forward simultaneously, bandwidth adds up (8×1G=8G), and if one link fails the rest keep working (failover).

• Bandwidth aggregation: logical bandwidth = sum of members (up to 8).
• Link redundancy: a single physical link failure shifts traffic to the others, millisecond failover.
• Load balancing: a hash (src/dst MAC, src/dst IP, or combinations) spreads flows across members.

8.2 Member Port Consistency (why channels fail to come up)

All members of an EtherChannel must be identically configured, or the channel fails:

• Same speed and duplex (e.g., all 1G full)
• Same switchport mode (all access or all trunk)
• Same VLAN config (access: same VLAN; trunk: same allowed list and native VLAN)
• Similar STP config (PortFast etc. as consistent as possible)

Inconsistent ports may go suspended — visible in the show output.

8.3 Negotiation Protocols: LACP vs PAgP (memorize the comparison)

Mode combination results (exam focus):

8.4 Configuring EtherChannel (complete commands + verification)

Commands LACP:

SW1(config)# interface range g0/1-4          # pick 4 physical links
SW1(config-if-range)# channel-group 1 mode active   # join channel group 1, LACP active
SW1(config-if-range)# exit
SW1(config)# interface port-channel 1        # enter the logical port
SW1(config-if)# switchport mode trunk        # channel type (match the members)
SW1(config-if)# switchport trunk allowed vlan 10,20,30
SW1(config-if)# exit
# peer SW2 configures identically: channel-group 1 mode active

SW1# show etherchannel summary               # core verification
Flags:  D - down        P - bundled in port-channel
        I - stand-alone s - suspended        H - Hot-standby (LACP only)
        R - Layer3      S - Layer2
Group  Port-channel  Protocol    Ports
------+-------------+-----------+-----------------------------------------------
1      Po1(SU)        LACP       Gi0/1(P)  Gi0/2(P)  Gi0/3(P)  Gi0/4(P)
                    ^^^^
           SU = Layer-2 channel Up (S=Layer2, U=Up) — the key thing to look for
           each port (P) = bundled successfully

SW1# show etherchannel port-channel          # logical port details
SW1# show etherchannel load-balance          # load-balance algorithm (default src-dst-mac)

8.5 Load-Balancing Methods (awareness, occasionally tested)

Global config: port-channel load-balance <method>. Common: src-mac, dst-mac, src-dst-mac (default, hashes both), src-ip, dst-ip, src-dst-ip. Layer-3 traffic: hash on IP; Layer-2 traffic: hash on MAC.

8.6 Chapter Self-Test

Q1. Why not just disable STP and use multiple parallel links for more bandwidth?
Ans: Layer-2 loops (broadcast storm, MAC thrash, duplicate frames). EtherChannel bundles the links into one logical link instead.

Q2. What are LACP's active/passive modes?
Ans: active (initiates) / passive (waits).

Q3. What happens if both ends are passive?
Ans: negotiation fails; the channel doesn't come up (neither sends PDUs).

Q4. What happens if one link in an EtherChannel fails?
Ans: traffic shifts to the other members (redundancy); the channel keeps working.

Q5. Which command shows the channel state? What does SU mean?
Ans: show etherchannel summary; S=Layer-2, U=Up — Po1(SU) means the Layer-2 channel is up.

9Static & Default Routes

Core Routing is one of CCNA's two pillars; static routing is the foundation — guaranteed. After this chapter: read a routing table, memorize administrative distances, configure static/default/floating-static routes, and troubleshoot "why doesn't it work."

9.1 The Essence of Routing (build the mental model first)

Routing: the router uses the routing table to decide "out which interface does this packet go, and who is the next hop." Routers look only at the destination IP — not the source, not TCP ports, not who the user is.

A route entry has four elements (memorize): destination network/mask + next hop (or exit interface) + administrative distance (AD) + metric.

R1# show ip route
Codes: C - connected, S - static, R - RIP, O - OSPF, D - EIGRP...

Gateway of last resort is 192.168.1.254 to network 0.0.0.0

      192.168.1.0/24 is variably subnetted, 2 subnets, 2 masks
C        192.168.1.0/24 is directly connected, GigabitEthernet0/0
L        192.168.1.1/32 is directly connected, GigabitEthernet0/0
S        192.168.2.0/24 [1/0] via 192.168.1.2
                         ^^^  ^  ^
                    AD=1, metric=0, next hop=192.168.1.2
O        10.0.0.0/24 [110/2] via 192.168.3.1, 00:12:34, GigabitEthernet0/1
S*       0.0.0.0/0 [1/0] via 192.168.1.254        ← default route (asterisk)
                           ^^^  ^  ^
                     C=connected, L=local, S=static, O=OSPF, S*=default

Know the codes: C (connected), L (local/interface IP), S (static), S* (default route), O (OSPF), R (RIP), D (EIGRP).

9.2 Administrative Distance (AD) — memorize the table

A router may learn the same destination from multiple sources (static, OSPF, connected...). AD expresses the trustworthiness of a route source; smaller is more trusted. The source with the smallest AD goes into the routing table.

9.3 Route Decision Logic (three comparisons, in order)

9.4 Configuring Static Routes (complete commands)

Commands Two syntaxes — master both:

# Syntax 1: next-hop IP (recommended, works across multiple hops)
R1(config)# ip route 192.168.2.0 255.255.255.0 192.168.1.2
#        [destination]    [mask]       [next-hop IP]

# Syntax 2: exit interface (common on point-to-point links, e.g., serial)
R1(config)# ip route 192.168.2.0 255.255.255.0 serial0/0/0

# Default route: destination 0.0.0.0/0, "everything not matched goes here"
R1(config)# ip route 0.0.0.0 0.0.0.0 192.168.1.254

# Floating static route (backup): set a higher AD; it only activates when the primary fails
R1(config)# ip route 192.168.2.0 255.255.255.0 192.168.1.2        # primary (AD=1)
R1(config)# ip route 192.168.2.0 255.255.255.0 192.168.9.2 200   # backup (AD=200)

# Delete: prefix with no
R1(config)# no ip route 192.168.2.0 255.255.255.0 192.168.1.2

# Verify
R1# show ip route static      # static routes only
R1# show ip route             # all

9.5 The Static Route Trap: one-way config doesn't work

Static routes are one-way — they only affect the router that has them. If A has a route to B's network but B has no route back to A, then A→B works and B→A doesn't. For two-way communication, configure both sides. This is the classic lab trap: configuring one side and calling it "broken."

How to tell: when a packet reaches the far router, that router consults its routing table for the return path; without one it drops the packet (or uses a default route). ping proves one-way reachability only; two-way requires return routes on both ends.

9.6 Typical Default-Route Scenarios

• Stub network: one exit only — point all traffic at the exit router with a default route instead of hundreds of detail routes.
• Internet egress: on the border router, ip route 0.0.0.0 0.0.0.0 <ISP peer IP>.
• The router sends "everything unknown" to its default gateway (analogous to a host's default gateway concept).

Note the distinction: default route (0.0.0.0/0) vs a host's default gateway — same concept (the exit for unknown destinations), one on a router, one on a PC.

9.7 Troubleshooting Flow (lab mindset)

① ping destination → works?
② traceroute hop by hop → where does it break?
③ On the breaking router:
   show ip route  → is there a matching route?
     Yes → is the next hop reachable (ping it)?
     No  → configure static/default route
④ Check the far end's return route (the most common miss!)
⑤ Check ACL/NAT interference

9.8 Chapter Self-Test

Q1. Administrative distances of OSPF and static?
Ans: OSPF=110, static=1.

Q2. A static /24 and an OSPF /28 both match the destination. Which wins?
Ans: the OSPF /28 — longest prefix match outranks AD.

Q3. How do you write a default route?
Ans: ip route 0.0.0.0 0.0.0.0 <next-hop>.

Q4. What makes a floating static route a backup?
Ans: a larger AD (e.g., 200) — it enters the table only when the primary fails.

Q5. A has a route to B's network, B has none back. Does A ping B? B ping A?
Ans: A→B yes (A has the forward route); B→A no (B lacks the return route) — routing must be two-way.

10OSPF Dynamic Routing

Core OSPF is the representative link-state protocol; CCNA focuses on single-area OSPFv2. After this chapter: explain link-state vs distance-vector, how OSPF builds neighbors/adjacencies/DR, configure single-area OSPF, and troubleshoot it.

10.1 Why Dynamic Routing

Static routing suits small networks, but at scale (dozens or hundreds of routers) it becomes unmaintainable: adding a link means reconfiguring a pile of routers, topology changes need manual rework, and errors creep in. Dynamic routing protocols let routers exchange information, compute routes, and adapt on their own.

The two big families (a must-know comparison):

10.2 How OSPF Works (neighbor → adjacency → LSDB → SPF → table)

Neighbor states to know: 2-Way (neighbors established, no LSA exchange yet), Full (adjacency complete, LSDB synchronized) — in show ip ospf neighbor, Full is the healthy state.

10.3 Key OSPF Parameters (memorize the numbers)

Cost examples: 100 Mbps → cost 1 (10^8/10^8), 1 Gbps → cost 1 (10^8/10^9, rounds to 1), 10 Mbps → cost 10. Exams test "how to compute cost and how changing it affects path selection."

10.4 Router ID Selection (a must-know rule)

The Router ID uniquely identifies the OSPF process (32-bit, looks like an IP). Selection priority:

Important: once the Router ID is chosen it is "locked" — changing interface IPs later does not change it unless you clear ip ospf process or restart OSPF. DR/BDR election prefers the higher Router ID.

10.5 DR / BDR (the multi-access network mechanism)

On a broadcast multi-access network (Ethernet), if every router formed adjacencies with every other, N routers would need N(N-1)/2 adjacencies — wasteful. OSPF elects:

• DR (Designated Router): represents the segment, exchanges LSAs with everyone (all routers sync only with the DR).
• BDR (Backup Designated Router): backup; takes over instantly if the DR fails.
• Other routers (DROTHER) form Full adjacencies only with DR/BDR; between themselves they stay at 2-Way (neighbors, no LSA exchange).

Election rules (memorize): highest interface priority first (default 1; 0 = never participate) → tie-break by highest Router ID. DR/BDR election is non-preemptive — a better new router does not replace an elected one (unless the whole network restarts).

10.6 Configuring Single-Area OSPF (complete commands + verification)

Commands

R1(config)# router ospf 1              # start OSPF process 1 (process ID is local; peers may differ)
R1(config-router)# router-id 1.1.1.1   # manually set the Router ID (recommended)
R1(config-router)# network 192.168.1.0 0.0.0.255 area 0   # advertise the interface's network
R1(config-router)# network 192.168.12.0 0.0.0.255 area 0  # wildcard mask!
R1(config-router)# exit

# Note: network advertises "the network the interface is in"; wildcard = inverted mask
# 255.255.255.0 → 0.0.0.255 ; 255.255.255.128 → 0.0.0.127

R2(config)# router ospf 1
R2(config-router)# router-id 2.2.2.2
R2(config-router)# network 192.168.12.0 0.0.0.255 area 0
R2(config-router)# network 192.168.2.0 0.0.0.255 area 0

# Verify
R1# show ip ospf neighbor           # neighbor state (Full = OK)
R1# show ip ospf interface          # Hello/Dead, area, cost
R1# show ip route ospf              # OSPF-learned routes
R1# show ip ospf database           # LSDB
R1# clear ip ospf process           # reset OSPF (must do after changing Router ID)

Neighbor verification output:

R1# show ip ospf neighbor
Neighbor ID  Pri  State      Dead Time  Address        Interface
2.2.2.2        1  FULL/DR    00:00:35   192.168.12.2   GigabitEthernet0/0
                        ^^^^
               FULL = adjacency complete, /DR = peer is the DR

10.7 OSPF Troubleshooting (lab mindset)

① show ip ospf neighbor → is there a neighbor? What state?
   - No neighbor: interface up? Same area on both ends? Hello/Dead match? Auth match? Network type match?
   - Stuck at 2-Way: normal between DROTHERs — check whether a DR exists
   - Stuck at EXSTART/EXCHANGE: usually MTU mismatch or LSA exchange issues
② show ip route ospf → did you learn routes?
   - No: check whether network statements cover the interface networks
③ Check the wildcard mask (the most common error!)
④ Process IDs on both ends are irrelevant, but Router IDs must be unique network-wide

10.8 Chapter Self-Test

Q1. OSPF's AD? Hello and Dead intervals on Ethernet?
Ans: AD=110; Hello 10s, Dead 40s.

Q2. Which multicast addresses does OSPF use? DR/BDR?
Ans: 224.0.0.5 (all OSPF); 224.0.0.6 (DR/BDR).

Q3. Which networks elect DR/BDR?
Ans: multi-access networks (Ethernet); point-to-point links do not.

Q4. Router ID selection order?
Ans: manual → highest loopback IP → highest active physical interface IP.

Q5. What wildcard mask for advertising 192.168.1.0/24?
Ans: 0.0.0.255.

11IPv6 Fundamentals

Important The modern CCNA requires IPv6 addressing and basic configuration. After this chapter: read compressed/expanded IPv6 addresses, name the address types and prefixes, configure interface IPv6 addresses, and explain IPv6 neighbor discovery.

11.1 Why IPv6 (IPv4's three pain points)

• Address exhaustion: IPv4 has only ~4.3 billion addresses (2^32), long since exhausted. IPv6 has 2^128 — every grain of sand on Earth could get billions.
• The NAT burden: IPv4 leans on NAT to survive, but NAT breaks end-to-end transparency, complicates troubleshooting, and affects some protocols. IPv6 has native address abundance, so NAT is not needed — end-to-end is restored.
• Autoconfiguration: IPv4 needs DHCP; IPv6 has SLAAC (Stateless Address Autoconfiguration) — hosts generate addresses automatically.

11.2 IPv6 Address Structure (reading 128 bits)

An IPv6 address is 128 bits, written as 8 groups of 4 hex digits, colon-separated:

Full form: 2001:0db8:0000:0000:0000:ff00:0042:8329
Compression rules:
① Leading zeros per group may be omitted:
   2001:db8:0:0:0:ff00:42:8329
② One run of all-zero groups may be compressed with :: (once only!):
   2001:db8::ff00:42:8329
   Note: :: only once — twice is ambiguous
Examples: 2001:db8::1        = 2001:0db8:0000:...:0001
    ::1                      = loopback (0:0:...:0:1)
    ::                       = unspecified address

11.3 Address Types & Prefixes (memorize the table)

Common multicast addresses: ff02::1 (all nodes), ff02::2 (all routers), ff02::5 (OSPFv3), ff02::9 (RIPng), ff02::1:ffxx:xxxx (solicited-node, for NDP).

11.4 Link-Local & EUI-64 (exam item)

Every IPv6 interface auto-generates a link-local address (fe80::/10), even with no configured address. By default it derives the interface ID via EUI-64 (from MAC):

MAC:  00:1A:2B:3C:4D:5E
Step 1: insert fffe in the middle → 001A:2BFF:FE3C:4D5E
Step 2: flip bit 7 (U/L bit) → 021A:2BFF:FE3C:4D5E
Result: interface ID = 021A:2BFF:FE3C:4D5E
Link-local = fe80::021A:2BFF:FE3C:4D5E

11.5 IPv6 Neighbor Discovery (NDP — replaces ARP)

IPv6 has no ARP; NDP (Neighbor Discovery Protocol) does the same job, built on ICMPv6:

SLAAC: a host receives an RA (with a /64 prefix) and auto-generates a GUA using its EUI-64 interface ID — no DHCP needed. For extra info (DNS), pair it with DHCPv6.

11.6 Configuring IPv6 (complete commands)

Commands

R1(config)# ipv6 unicast-routing          # enable IPv6 routing (routers; not switches)
R1(config)# interface g0/0
R1(config-if)# ipv6 address 2001:db8:1::1/64   # configure a GUA
R1(config-if)# ipv6 address fe80::1 link-local # (optional) manual link-local
R1(config-if)# no shutdown

# Static routes
R1(config)# ipv6 route 2001:db8:2::/64 2001:db8:12::2
R1(config)# ipv6 route ::/0 2001:db8:12::254   # IPv6 default route (::/0)

# OSPFv3 (IPv6 OSPF — awareness)
R1(config)# ipv6 router ospf 1
R1(config-rtr)# router-id 1.1.1.1
R1(config)# interface g0/0
R1(config-if)# ipv6 ospf 1 area 0

# Verify
R1# show ipv6 interface brief
R1# show ipv6 route
R1# show ipv6 neighbors

11.7 IPv4 vs IPv6 (frequently compared)

11.8 Chapter Self-Test

Q1. Compress 2001:0db8:0000:0000:0000:0000:0000:0001
Ans: 2001:db8::1.

Q2. IPv6 loopback and unspecified addresses?
Ans: ::1 and ::.

Q3. Link-local prefix? Is it routable?
Ans: fe80::/10; no, same-link only.

Q4. Which protocol replaces ARP in IPv6?
Ans: NDP (NS/NA, based on ICMPv6).

Q5. Which command enables IPv6 routing on a router?
Ans: ipv6 unicast-routing.

12DHCP · NAT · DNS

Core The big three IP services — NAT is a guaranteed calculation/config topic. After this chapter: explain DHCP's four steps, NAT's three types and configuration, and the DNS resolution flow.

12.1 DHCP Deep Dive

DHCP automatically assigns IP address, mask, default gateway, and DNS, saving per-host manual configuration. Ports: UDP 67 (server), 68 (client).

The working process (DORA, memorize):

Client                                   DHCP server
   |---- Discover (broadcast) ----->|  ① Find servers: "who can give me an IP?" (broadcast to 255.255.255.255)
   |<---- Offer (unicast/broadcast) ----|  ② Server offers: "I can give you 192.168.1.100"
   |---- Request (broadcast) ----->|  ③ Client requests: "I want that address" (broadcast so all servers know)
   |<---- Ack (unicast/broadcast) -----|  ④ Server confirms: "OK, leased to you for X seconds"

Details: lease typically 24 hours or less; T1 = 50% of lease the client unicasts to renew with its original server; T2 = 87.5% it broadcasts to rediscover servers. If renewal fails, the address is released when the lease expires.

12.2 Configuring a Cisco Router as DHCP Server (complete commands)

Commands

R1(config)# ip dhcp excluded-address 192.168.1.1 192.168.1.10
# reserved addresses (gateway/servers — never handed out)
R1(config)# ip dhcp pool LAN                  # create an address pool
R1(dhcp-config)# network 192.168.1.0 255.255.255.0   # assignable range
R1(dhcp-config)# default-router 192.168.1.1          # gateway
R1(dhcp-config)# dns-server 8.8.8.8                  # DNS
R1(dhcp-config)# lease 7                             # 7-day lease (optional)
R1(dhcp-config)# exit

# DHCP across subnets: relay on the router facing clients
R2(config)# interface g0/0
R2(config-if)# ip helper-address 192.168.1.1   # forward DHCP broadcasts to the server

# Verify
R1# show ip dhcp binding        # assigned addresses
R1# show ip dhcp pool           # pool config
R1# debug ip dhcp server events # troubleshooting

12.3 NAT (the focus topic)

Private addresses (RFC 1918) are not routable on the public Internet. NAT on the edge device translates private IPs to public IPs. Three benefits: conserves public addresses, hides the internal structure, resolves overlapping address schemes.

The three types (memorize):

The four address concepts (exams split hairs — know them):

12.4 Configuring PAT (overload) + Static NAT

Commands

# ---------- PAT: internal network shares one public IP ----------
R1(config)# access-list 1 permit 192.168.1.0 0.0.0.255   # define the internal network
R1(config)# ip nat inside source list 1 interface g0/1 overload
#        [internal ACL]             [exit iface] [overload = port reuse]
R1(config)# interface g0/0
R1(config-if)# ip nat inside     # mark inside
R1(config)# interface g0/1
R1(config-if)# ip nat outside    # mark outside

# ---------- Static NAT: publish a server ----------
R1(config)# ip nat inside source static 192.168.1.50 203.0.113.50
#        [server private IP]  [public IP]
# note: don't forget the ACL permit + inside/outside markings

# Verify
R1# show ip nat translations    # the translation table (Inside Local ↔ Inside Global)
R1# show ip nat statistics      # hit counters
R1# clear ip nat translation *  # flush (troubleshooting)

R1# show ip nat translations
Pro Inside global      Inside local       Outside local    Outside global
tcp 203.0.113.5:1025   192.168.1.10:1025  198.51.100.7:80   198.51.100.7:80
tcp 203.0.113.5:1026   192.168.1.11:1026  198.51.100.7:80   198.51.100.7:80
   ^^^^^^^^^^^^^^^^     ^^^^^^^^^^^^^^^^
   public IP+port       private IP+port  ← PAT: same public IP, different ports

12.5 DNS Deep Dive

DNS resolves human-friendly names (www.example.com) to IPs. Port UDP 53 (queries), TCP 53 (zone transfers/large responses).

The resolution process (recursive + iterative):

PC asks local DNS: what is www.example.com?
Local DNS checks cache → miss:
   → asks the root server: who is authoritative for .com?
   → asks the .com TLD: who is authoritative for example.com?
   → asks the example.com authoritative: www's A record = 93.184.216.34
Local DNS caches and replies: 93.184.216.34

Record types (memorize): A=IPv4, AAAA=IPv6, CNAME=alias, MX=mail server, NS=name server, PTR=reverse (IP→name), TXT=text (SPF anti-spam).

On Cisco devices: ip name-server 8.8.8.8 + ip domain-lookup (on by default, lets ping resolve names).

12.6 Chapter Self-Test

Q1. The four DHCP steps?
Ans: Discover → Offer → Request → Ack (DORA).

Q2. DHCP ports? Cross-subnet mechanism?
Ans: UDP 67/68; ip helper-address (DHCP relay).

Q3. Which NAT lets many internal hosts share one public IP?
Ans: PAT (overload), port-distinguished.

Q4. Publishing a web server uses which NAT?
Ans: static NAT (fixed one-to-one).

Q5. DNS default query port/protocol? A and AAAA records?
Ans: UDP 53; A=IPv4, AAAA=IPv6.

13WAN · PPP · Wireless

Important WAN connectivity and wireless basics are exam topics. After this chapter: name the common WAN technologies, configure PPP authentication, and explain wireless standards and security.

13.1 WAN Technology Overview (LAN vs WAN)

LAN: you own it, geographically small, fast. The typical technology is Ethernet. WAN: connects remote sites, usually leased from a service provider, geographically large.

Cisco serial encapsulation: the two protocols to compare (exam favorite): HDLC (Cisco default, proprietary framing) and PPP (standard, supports authentication and multilink).

13.2 PPP Deep Dive

PPP (Point-to-Point Protocol) is the standard point-to-point link protocol — more powerful than HDLC:

• Authentication: PAP (plaintext), CHAP (encrypted three-way handshake) — HDLC has none.
• Multilink (MLPPP): bundles multiple physical links into one logical link (like EtherChannel for serial).
• Compression: data compression (Predictor/Stacker).
• Error detection: LCP quality check.
• Dynamic assignment: IPCP can assign the peer an IP (for dial-up).

PPP protocol stack: LCP (Link Control Protocol) builds the link/negotiates/auths; NCP (Network Control Protocol) negotiates network-layer parameters (e.g., IPCP assigns IPs).

PAP vs CHAP (memorize):

13.3 Configuring PPP + CHAP (complete commands)

Commands Configure both ends; usernames/passwords are reciprocal:

# ---- R1 ----
R1(config)# username R2 password cisco    # username = peer's hostname, same password both ends
R1(config)# interface serial0/0/0
R1(config-if)# encapsulation ppp          # PPP encapsulation
R1(config-if)# ppp authentication chap    # enable CHAP
R1(config-if)# no shutdown

# ---- R2 ----
R2(config)# username R1 password cisco    # note: the username is R1
R2(config)# interface serial0/0/0
R2(config-if)# encapsulation ppp
R2(config-if)# ppp authentication chap

# Verify
R1# show interfaces serial0/0/0   # look for LCP: Open / auth state
R1# debug ppp authentication      # troubleshooting (watch the auth exchange)
# Troubleshooting: username is the peer's hostname, passwords identical, enable secret does not affect PPP

13.4 Wireless Fundamentals (deep dive)

Wireless LAN standards are the IEEE 802.11 family. Memorize the speeds and bands:

Key concepts:

• AP (Access Point): Layer-2 device, the wireless terminal's "switch." WLC (Wireless LAN Controller) centrally manages thin APs (thin APs download config from the WLC).
• SSID: the wireless network name clients use to find the network.
• Channels: 2.4 GHz has 13 overlapping channels; use non-overlapping 1/6/11; 5 GHz has many non-overlapping channels, less interference.
• CSMA/CA: wireless uses collision avoidance (not detection) — hidden nodes + inability to listen while transmitting (see Chapter 2).
• Roaming: clients move between APs keeping connectivity (same SSID).

Wireless security (memorize):

13.5 Wireless vs Wired (frequently compared)

13.6 Chapter Self-Test

Q1. Key difference between PPP and HDLC?
Ans: PPP is a standard supporting auth (CHAP/PAP)/multilink/compression; HDLC is Cisco-proprietary, no auth.

Q2. Why is CHAP safer than PAP?
Ans: CHAP uses challenge-response + MD5 hash, password never leaves the wire; PAP sends it in plaintext.

Q3. Which 802.11 standard is WiFi 6?
Ans: 802.11ax.

Q4. The must-use wireless encryption?
Ans: WPA2/WPA3 + AES.

Q5. What media access mechanism does wireless use, and why?
Ans: CSMA/CA (collision avoidance) — wireless cannot listen while transmitting and has hidden nodes.

14Access Control Lists (ACL)

Core ACLs are the core of network security and traffic filtering — guaranteed config and judgment questions. After this chapter: explain standard vs extended ACLs, understand implicit deny, place in/out correctly, and configure named ACLs.

14.1 What Is an ACL (position it first)

ACL (Access Control List): an ordered set of rules on a router that makes permit / deny decisions on passing traffic. Uses beyond "firewall":

• Traffic filtering (allow/deny specific traffic) — the main use
• NAT match conditions (which internal addresses translate)
• QoS classification (which traffic is prioritized)
• Route filtering (e.g., distribute-list limits route advertisements)
• Remote management restriction (only specific management IPs reach the VTY)

14.2 The Three Iron Rules (memorize)

14.3 Standard vs Extended ACL (memorize the comparison)

14.4 Wildcard Mask — the hidden ACL exam item

ACLs match addresses with wildcard masks (not subnet masks): 0 = must match exactly, 1 = ignore.

Subnet mask: 255.255.255.0   → wildcard: 0.0.0.255
Match a whole /24:  permit 192.168.1.0 0.0.0.255   (first 24 bits exact, last 8 any)
Match a single host: permit 192.168.1.5 0.0.0.0     (all exact)  or  permit host 192.168.1.5
Match anything:       permit any                    (shorthand for 0.0.0.0 255.255.255.255)

Special wildcards (awareness): 0.0.0.254 matches even addresses (last bit must be 0); 0.0.0.252 matches blocks of 4. Exams mainly test network/host/any.

14.5 Configuring Standard + Extended + Named ACLs (complete commands)

Commands

# ---------- Standard ACL (numbered) ----------
R1(config)# access-list 1 permit 192.168.1.0 0.0.0.255   # permit that network
R1(config)# access-list 1 deny 192.168.2.0 0.0.0.255     # deny another
R1(config)# interface g0/0
R1(config-if)# ip access-group 1 in       # bind + direction (in)

# ---------- Extended ACL (numbered) ----------
# permit internal web (80) out; deny external Telnet (23) in
R1(config)# access-list 100 permit tcp 192.168.1.0 0.0.0.255 any eq 80
R1(config)# access-list 100 deny tcp any 192.168.1.0 0.0.0.255 eq 23
R1(config)# access-list 100 permit ip any any   # implicit deny would block the rest — add a catch-all
R1(config)# interface g0/1
R1(config-if)# ip access-group 100 in

# ---------- Named ACL (editable, recommended) ----------
R1(config)# ip access-list extended BLOCK_TELNET
R1(config-ext-nacl)# deny tcp any 192.168.1.0 0.0.0.255 eq 23
R1(config-ext-nacl)# permit ip any any
R1(config-ext-nacl)# exit
R1(config)# interface g0/1
R1(config-if)# ip access-group BLOCK_TELNET in

# ---------- Verify ----------
R1# show access-lists              # rules + match counters
R1# show ip access-lists
R1# show access-lists 100

Reading the output:

R1# show access-lists
Extended IP access list 100
    10 permit tcp 192.168.1.0 0.0.0.255 any eq www (12 matches)
    20 deny tcp any 192.168.1.0 0.0.0.255 eq telnet (3 matches)
    30 permit ip any any (58 matches)
    ^^ sequence #   ^^ match counter — which rule is doing the work

14.6 Classic Scenarios (exam drills)

Scenario 1: allow only 192.168.1.0/24 to the server's web; deny everything else.
Extended ACL near the source (the router in front of the server): permit tcp 192.168.1.0 0.0.0.255 host 10.0.0.5 eq 80 + implicit deny handles the rest.

Scenario 2: block the finance VLAN (VLAN 10) from reaching the management network (10.0.0.0/24); allow everything else.
deny ip 192.168.10.0 0.0.0.255 10.0.0.0 0.0.0.255 + permit ip any any.

Scenario 3: allow only the admin IP (1.1.1.1) to SSH-manage the router.
Bind on the VTY lines: access-class 5 in (standard ACL 5 permits 1.1.1.1) — remote management restriction uses access-class, not access-group.

14.7 Chapter Self-Test

Q1. What does a standard ACL match, and where is it placed?
Ans: source IP only; close to the destination.

Q2. The implicit rule at the end of an ACL?
Ans: implicit deny — unmatched traffic is denied.

Q3. Wildcard 0.0.0.255 matches what?
Ans: first 24 bits exact, last 8 any — a whole /24.

Q4. Extended ACL number range?
Ans: 100-199 (and 2000-2699).

Q5. Which command restricts VTY remote management?
Ans: access-class under line vty.

15Port Security & Basic Defense

Important Switch port security is the security-chapter focus of CCNA. After this chapter: configure port security, name the three violation modes, and understand Layer-2 security technologies like DHCP Snooping/DAI.

15.1 Port Security Deep Dive

Port security: limit the number of MAC addresses a port may learn, and which MACs are allowed, preventing unauthorized devices. Three typical scenarios:

• Prevent rogue devices: allow only 1 MAC (the workstation PC); plugging in an AP/switch trips the violation.
• Prevent MAC flooding attacks: attackers send thousands of fake MACs to fill the MAC table, making the switch "forget" real MACs → flood → sniff. Limiting the MAC count mitigates this.
• Pin fixed devices: only the specified MAC (server/printer) may connect.

The three violation modes — memorize:

15.2 Configuring Port Security (complete commands + verification)

Commands

SW1(config)# interface f0/1
SW1(config-if)# switchport mode access          # port security works on access ports
SW1(config-if)# switchport port-security        # enable port security
SW1(config-if)# switchport port-security maximum 2     # max 2 MACs (default 1)
SW1(config-if)# switchport port-security violation shutdown   # violation = shutdown (default)
SW1(config-if)# switchport port-security mac-address 0011.2233.4455   # fixed allowed MAC
SW1(config-if)# switchport port-security mac-address sticky          # stick learned MACs to config
SW1(config-if)# end

# Verify
SW1# show port-security
SW1# show port-security interface f0/1
SW1# show port-security address

# Recover a shutdown port
SW1(config)# interface f0/1
SW1(config-if)# shutdown
SW1(config-if)# no shutdown     # must close-open once to recover

Reading the output:

SW1# show port-security interface f0/1
Port Security              : Enabled
Violation Mode             : Shutdown          ← current violation mode
Maximum MAC Addresses      : 2                 ← limit
Total MAC Addresses        : 1
Security Violation Count   : 0                 ← violations so far
Sticky MAC Addresses       : 0

15.3 The Layer-2 Security Toolkit (concepts exams test)

15.4 Device Management Security (basic but tested)

# Full SSH configuration example
R1(config)# hostname R1
R1(config)# ip domain-name example.com      # SSH needs a domain
R1(config)# crypto key generate rsa          # generate RSA keys (768-2048 bits)
R1(config)# username admin secret cisco123   # local user
R1(config)# line vty 0 4
R1(config-line)# transport input ssh         # SSH only
R1(config-line)# login local                # local auth
R1(config-line)# exit

15.5 Chapter Self-Test

Q1. Port security default max MACs and violation mode?
Ans: maximum 1; violation shutdown.

Q2. How to recover a shutdown port?
Ans: shutdown + no shutdown under the interface.

Q3. Which technology blocks rogue DHCP servers?
Ans: DHCP Snooping (untrusted ports drop DHCP Offer).

Q4. What does DAI block?
Ans: ARP spoofing (validates IP-MAC bindings).

Q5. What does remote management recommend? What must be generated first for SSH?
Ans: SSH; crypto key generate rsa.

16Network Automation & Programmability

Important This is a major new direction in CCNA 200-301 with a notable weight — a concept must-know. After this chapter: explain SDN's three planes, compare SNMP/NETCONF/RESTCONF, read JSON, and name the automation tools.

16.1 Why Automation (understand the trend first)

Traditional networking means logging into every device and typing CLI: slow, error-prone, inconsistent, no rollback. Network automation turns configuration into code: repeatable, version-controlled (Git), testable (CI/CD), deployable in bulk — the core of "Network as Code" and SDN.

Real benefits: provisioning 100 new branch routers in minutes with a script vs hours by hand; automatic validation and rollback on errors; a unified, auditable config baseline network-wide.

16.2 SDN & the Three Planes (must-know concept)

SDN (Software-Defined Networking): separate the network's control plane from the data plane, with a centralized controller pushing policy in software.

Traditional router: control and data planes both live in the device, each computing its own routes. SDN: the controller computes centrally, and the switch just executes (simplified to a forwarding device).

16.3 SDN Interfaces (API directions)

OpenFlow is the classic southbound protocol: the controller directly manipulates the switch's flow table (match-action). Modern controllers (Cisco DNA Center) primarily manage devices via NETCONF/RESTCONF.

16.4 Network Management Protocols: SNMP vs NETCONF vs RESTCONF (memorize)

YANG (Yet Another Next Generation): a data modeling language — tree-structured descriptions of device config/state data (e.g., "what attributes does an interface have"). NETCONF/RESTCONF operate on YANG-defined data. Exams ask "what is YANG" — a data model / modeling language, not a protocol.

16.5 REST API & JSON (must-know basics)

REST API: operate on resources (identified by URLs) with HTTP methods:

JSON (JavaScript Object Notation): key-value text format, the most common network-API format. Key points: { } objects, [ ] arrays, "key":"value"; value types: string/number/boolean/array/object/null.

# JSON example: one interface's state
{
  "interface": "GigabitEthernet0/1",
  "enabled": true,
  "mtu": 1500,
  "ipv4": {
    "address": "192.168.1.1",
    "mask": "255.255.255.0"
  },
  "vlans": [10, 20, 30]          ← array
}

# curl to RESTCONF for interface config
curl -u user:pass https://device/restconf/data/interfaces \
     -H "Accept: application/yang-data+json"

# Python with the requests library
import requests, json
r = requests.get("https://device/restconf/data/interfaces",
                 auth=("user","pass"), verify=False)
print(json.dumps(r.json(), indent=2))

16.6 Automation Tools & Config Management (awareness)

# Ansible playbook example (YAML) — bulk VLAN config
---
- name: Configure VLANs
  hosts: switches
  gather_facts: no
  tasks:
    - name: Create VLAN 10
      cisco.ios.ios_vlan:
        vlan_id: 10
        name: SALES
        state: present

16.7 Chapter Self-Test

Q1. Which two planes does SDN separate?
Ans: control (brain) and data (forwarding).

Q2. What do the southbound and northbound interfaces connect?
Ans: southbound = controller to devices; northbound = apps to controller.

Q3. NETCONF data format and modeling language?
Ans: XML transport; YANG modeling.

Q4. What do GET/POST/DELETE do in REST?
Ans: GET reads, POST creates, DELETE deletes.

Q5. In JSON, what do [ ] represent?
Ans: an array (a set of values).

17CLI Command Quick Reference

Core The CCNA must-know Cisco IOS commands, organized by use case, for a final pre-exam pass. Memorize by practicing, not by staring.

17.1 Mode Navigation (CLI basics)

enable                          # user → privileged mode
disable                         # privileged → user
configure terminal              # privileged → global config
interface g0/0                  # global → interface config
interface range f0/1-10         # batch interfaces
line console 0 / line vty 0 4   # line config
router ospf 1 / router rip      # routing protocol config
exit                            # back one level
end / Ctrl-Z                    # straight back to privileged
?                               # context help
Tab                             # command completion
show running-config             # running config
show startup-config             # startup config
copy running-config startup-config   # save (=write)
reload                          # reboot
erase startup-config            # wipe startup config (factory reset)

17.2 Interface & IP Configuration

interface g0/0
  ip address 192.168.1.1 255.255.255.0   # IP + mask
  description LINK-TO-CORE              # documentation
  no shutdown                           # enable
  shutdown                              # disable
  speed 100 / duplex full               # manual speed/duplex
show ip interface brief     # interface IP + status (core troubleshooting)
show interfaces             # detail (traffic/errors/duplex)
show ip interface           # IP details

17.3 Switching (VLAN/Trunk/STP/EtherChannel)

vlan 10
  name SALES                          # create VLAN + name
interface f0/1
  switchport mode access
  switchport access vlan 10           # assign port to VLAN
interface g0/1
  switchport mode trunk
  switchport trunk allowed vlan 10,20,30   # trunk: only these VLANs
  switchport trunk native vlan 99          # change native
  switchport nonegotiate                   # disable DTP
spanning-tree mode rapid-pvst              # rapid spanning tree
interface f0/1
  spanning-tree portfast                   # access port fast forward
  spanning-tree bpduguard enable           # BPDU protection
interface range g0/1-2
  channel-group 1 mode active              # EtherChannel (LACP)
interface port-channel 1
  switchport mode trunk                    # channel type
show vlan brief
show interfaces trunk
show spanning-tree
show etherchannel summary

17.4 Routing (static/default/OSPF)

ip route 192.168.2.0 255.255.255.0 192.168.1.2     # static (next hop)
ip route 192.168.2.0 255.255.255.0 serial0/0/0       # static (exit interface)
ip route 0.0.0.0 0.0.0.0 192.168.1.254               # default route
router ospf 1
  router-id 1.1.1.1
  network 192.168.1.0 0.0.0.255 area 0               # advertise (wildcard!)
show ip route
show ip route ospf / static
show ip ospf neighbor

17.5 IP Services (DHCP/NAT/ACL)

# DHCP server
ip dhcp excluded-address 192.168.1.1 192.168.1.10
ip dhcp pool LAN
  network 192.168.1.0 255.255.255.0
  default-router 192.168.1.1
  dns-server 8.8.8.8
# DHCP relay
interface g0/0
  ip helper-address 192.168.2.5

# NAT/PAT
access-list 1 permit 192.168.1.0 0.0.0.255
ip nat inside source list 1 interface g0/1 overload
ip nat inside source static 192.168.1.50 203.0.113.50   # static NAT
interface g0/0 → ip nat inside
interface g0/1 → ip nat outside

# ACL
access-list 100 permit tcp 192.168.1.0 0.0.0.255 any eq 80
ip access-list extended BLOCK
  deny tcp any any eq 23
  permit ip any any
interface g0/1
  ip access-group 100 in
show ip dhcp binding
show ip nat translations
show access-lists

17.6 Security (port security/SSH/passwords)

# Basic passwords
enable secret cisco123
service password-encryption
banner motd #UNAUTHORIZED ACCESS PROHIBITED#
line console 0 / line vty 0 4
  password cisco
  login
  exec-timeout 5 0            # 5-min timeout

# SSH
hostname R1
ip domain-name example.com
crypto key generate rsa
username admin secret cisco123
line vty 0 4
  transport input ssh
  login local

# Port security
interface f0/1
  switchport mode access
  switchport port-security
  switchport port-security maximum 2
  switchport port-security violation shutdown
  switchport port-security mac-address sticky
show port-security address
show port-security interface f0/1

17.7 Troubleshooting & Verification (a lab's lifeline)

ping 192.168.1.1            # connectivity
ping 192.168.1.1 source 192.168.2.1   # specify source IP (multi-path scenarios)
traceroute 8.8.8.8          # hop-by-hop path
show cdp neighbors          # directly connected neighbors (Cisco proprietary)
show lldp neighbors         # standard neighbor discovery
show arp                    # ARP table (IP-MAC)
show mac address-table      # switch MAC table
show ip interface brief     # interface status overview
show interfaces             # interface errors/duplex/CRC
show ip route               # routing table
show running-config | include ip route   # filtered view
debug ip packet             # packet-level debug (careful; never in production)
show logging                # logs
clear counters              # clear interface counters (watch increments)
terminal monitor            # see debug output over remote sessions

18Exam Strategy & Practice

Core Passing strategy + self-test questions to verify your level. After this chapter: know how the exam works, know your study priorities, and check yourself with the practice set.

18.1 CCNA 200-301 Exam Overview (know the format)

Official blueprint weights (read this — it decides your study effort):

18.2 Study Roadmap (an 8-week example)

Invest 1-2 hours daily, with hands-on ≥50% of the time. Reading without labs = wasted study — the Cisco exam tests "can you configure and troubleshoot," not "have you seen these commands."

18.3 Exam Techniques (points you can bank)

• Do subnetting first: calculation questions early while fresh — guaranteed points.
• Drag-and-drop: answers usually include distractors (e.g., a protocol that doesn't exist).
• Simlets (labs): configure only what's needed, nothing extra; verify with show; save when done (copy run start doesn't always count but it's a good habit).
• Multi-select: the question says "Choose two/three" — over- or under-selecting both fail; if unsure, don't add.
• Time management: 120 min / ~110 questions ≈ 1 min each. Flag uncertain ones and come back.
• Process of elimination: when unsure, first drop obviously wrong answers (wrong port, wrong AD, wrong layer).

18.4 Comprehensive Self-Test (35 questions, answers included)

Part A · Network Fundamentals (Ch 1-4)

Q1. How many usable hosts in a /26 subnet (255.255.255.192)?
A. 62　B. 64　C. 126　D. 30
Answer: A (2^6 - 2 = 62).

Q2. At which layer does a router work? How does it isolate networks?
Answer: Layer 3 (network); it separates broadcast domains.

Q3. Data travels from host A to host B through 2 routers. How often do MAC and IP change?
Answer: MAC 3 times (once per hop); IP never (end-to-end).

Q4. When does a switch flood a frame?
Answer: when the destination MAC is unknown (not in the table) or is broadcast/multicast.

Q5. Which protocol uses UDP? A. FTP B. HTTP C. DNS D. SMTP
Answer: C (DNS default UDP/53).

Q6. HTTPS port and its two underlying protocols?
Answer: 443; HTTP + TLS/SSL.

Q7. 172.16.0.0/12 is which class?
Answer: Class B private range (172.16.0.0-172.31.255.255).

Q8. Where is CSMA/CA used, and why not CD?
Answer: wireless (802.11); wireless can't listen while transmitting and has hidden nodes.

Part B · Switching (Ch 5-8)

Q9. In STP, what determines the root bridge?
Answer: smallest Bridge ID (priority + MAC, smaller wins).

Q10. Where is the 802.1Q tag inserted, and how many bytes?
Answer: after the source MAC; 4 bytes.

Q11. Which VLAN is untagged on a trunk?
Answer: the Native VLAN (default VLAN 1).

Q12. Port security defaults: max MACs and violation mode?
Answer: maximum 1; violation shutdown.

Q13. LACP's active mode name?
Answer: active (passive is the passive side).

Q14. 802.1D blocking to forwarding: how long, which states?
Answer: ~50 s; blocking → listening → learning → forwarding.

Q15. What does inter-VLAN communication need?
Answer: a Layer-3 device (router / L3 switch), e.g., Router-on-a-Stick or SVIs.

Part C · Routing & IP Services (Ch 9-12)

Q16. OSPF's AD? Hello/Dead on Ethernet?
Answer: AD=110; Hello 10 s, Dead 40 s.

Q17. Which NAT lets many internal hosts share one public IP?
Answer: PAT (overload).

Q18. Static and OSPF both present, same prefix — which wins?
Answer: static (AD 1 < OSPF 110) — but if the OSPF prefix is longer (/28 vs /24), OSPF wins (longest match outranks AD).

Q19. The four DHCP steps?
Answer: Discover → Offer → Request → Ack (DORA).

Q20. How do you write a default route?
Answer: ip route 0.0.0.0 0.0.0.0 <next-hop>.

Q21. IPv6 loopback and unspecified?
Answer: ::1 and ::.

Q22. What replaces ARP in IPv6?
Answer: NDP (NS/NA, based on ICMPv6).

Q23. Why DR/BDR on Ethernet OSPF?
Answer: to reduce adjacencies — full mesh on a multi-access network is too costly; everyone syncs only with DR/BDR.

Q24. Wildcard mask to advertise 192.168.1.0/24 in OSPF?
Answer: 0.0.0.255.

Part D · Security & Automation (Ch 13-16)

Q25. Standard vs extended ACL: what do they match, where are they placed?
Answer: standard = source IP, near destination; extended = src/dst IP + ports, near source.

Q26. The implicit rule at the end of an ACL?
Answer: implicit deny — unmatched traffic is dropped.

Q27. Remote management protocol? Port? vs Telnet?
Answer: SSH (22, encrypted); Telnet (23, plaintext, obsolete).

Q28. What does DHCP Snooping block?
Answer: rogue DHCP servers (untrusted ports drop DHCP Offer).

Q29. YANG, NETCONF, RESTCONF — what are they?
Answer: YANG = data modeling language; NETCONF = XML configuration protocol; RESTCONF = REST-style config interface.

Q30. Which two planes does SDN separate?
Answer: control plane (brain) and data plane (forwarding).

Q31. The must-use wireless encryption?
Answer: WPA2/WPA3 + AES (WEP is obsolete).

Q32. Why is PPP CHAP safer than PAP?
Answer: CHAP challenge-response + MD5 hash; the password never leaves the wire; PAP is plaintext.

Part E · Simlet-style questions (think through the steps)

Q33. Two switches each have VLAN 10; PCs can't ping each other. Troubleshoot.
Steps: ① show vlan brief — does VLAN 10 exist on both ends with ports assigned? ② show interfaces trunk — is the interconnect a trunk with Status=trunking? ③ allowed list contains 10? native VLAN matches? ④ ping the gateway / hop-by-hop.

Q34. PAT is configured but internal users still can't reach the Internet. Check what?
Steps: ① show ip nat translations — any translations? (none = ACL didn't match or inside/outside not marked); ② show ip interface brief — is the outside interface up? ③ show ip route — is there a default route? ④ does the ACL permit the internal network?

Q35. OSPF neighbors stuck at EXSTART — why?
Answer: usually an MTU mismatch — the interfaces' MTUs differ, breaking LSA exchange. Set MTU to match.

18.5 The 24-Hour Countdown Checklist

• Run through the Ch 17 CLI quick reference (blind-write the commands).
• 10 subnetting warm-ups (instant recall).
• Memorize ADs (0/1/90/110/120), ports (80/443/22/23/53/67/68/110/143), the STP state machine.
• Re-read every "memory" box (this handbook's tip/warn boxes are condensed exam points).
• Sleep well, bring ID, arrive early.