1 Introduction to Networking and the CCNA Exam · CCNA

Exam topics covered

1.1 Explain the role and function of network components

1.1.a Routers · 1.1.b Layer 2 and Layer 3 switches · 1.1.c Next-generation firewalls and IPS · 1.1.d Access points

1.1.e Controllers · 1.1.f Endpoints · 1.1.g Servers · 1.1.h PoE 1.2.e Small office/home office (SOHO) (introduced here; architectures are covered fully in Chapter 11)

Foundation. Every topic in the CCNA rests on a handful of simple ideas: devices send data to each other, that data is carried over some kind of medium, and specialised boxes in the middle decide where it should go and whether it should be allowed to get there. This chapter gives you that big picture. You will meet the building blocks of every network—routers, switches, firewalls, access points, controllers, endpoints and servers—and see how they fit together in a home office and in an enterprise. The second half of the chapter is about you: what the CCNA 200-301 exam looks like, how this book is organised to get you through it, and how to build a practice lab so that the commands in later chapters become muscle memory rather than words on a page.

1.1 What Is a Network?

A computer network is a collection of devices connected so they can exchange data, from two laptops on one cable to the global internet, a network of networks run by thousands of independent organisations. Networks work because devices follow common protocols—rules for message formats, addressing and error handling—published as standards by bodies such as the IEEE (Ethernet and Wi-Fi, the 802 family) and the IETF (internet protocols, published as RFCs). That is why a Cisco switch, a Linux server and a smartphone interoperate without special code for each pairing.

Networks exist to serve applications. Your job as an engineer is to make connectivity available, performant, secure and manageable; nearly every feature in this book serves one of those four goals.

Figure 1-1 A minimal network: endpoints connect to a switch, and a router provides the path to other networks.

Engineers draw two views of a network. The physical topology shows real devices, ports and cables; the logical topology shows how data flows: which devices share a subnet or VLAN and which router is their gateway. Performance is described by bandwidth (link capacity in bits per second, such as 1 Gbps), throughput (what you actually achieve), latency (delay) and jitter (variation in delay). Note that link speeds use bits per second while file sizes use bytes: a 1 Gbps link moves at most 125 MB per second.

1.2 LANs, WANs and the Internet

A local area network (LAN) covers a home, building or campus. The organisation owns all the equipment and cabling, so bandwidth is cheap: 1 Gbps to the desk and 10–100 Gbps between switches are normal. Wired LANs use Ethernet (IEEE 802.3); wireless LANs (WLANs) use Wi-Fi (IEEE 802.11).

A wide area network (WAN) connects LANs separated by distance, such as a branch office and headquarters. Because an enterprise cannot run cable across public roads, it leases WAN service from a provider: Metro Ethernet, MPLS VPNs, broadband internet with VPNs, or 4G/5G cellular. SD-WAN designs use a controller to manage encrypted tunnels over several internet links. The internet itself is formed by ISPs interconnecting and exchanging routes with BGP; organisations use it both to reach public services and as a cheap WAN transport. LAN: Headquarters LAN: Branch office

Figure 1-2 Two LANs joined by a private WAN link, with each site also connected to the internet.

Table 1-1 LAN versus WAN

Characteristic LAN WAN
Geographic scope Room, building, campus City, country, global
Who owns the
links
The organisation Usually leased from a service provider

Typical speeds 1–100 Gbps, inexpensive Tens of Mbps to a few Gbps, recurring monthly cost

1.3 Network Components and Their Roles

Blueprint topic 1.1 asks you to explain the role and function of each component: which device forwards by MAC address, which separates broadcast domains, which inspects applications, and what PoE does. Figure 1-3 places every component in a typical enterprise site.

Wlc l3

Figure 1-3 Components of a small enterprise site. The firewall sits inline between the edge router and the core.

1.3.1 Routers

A router forwards packets between different IP networks. It reads the destination IP address in each packet, looks it up in its routing table, and sends the packet out of the interface that leads toward that destination, rewriting the Layer 2 (data-link) header for the next link. Routes are configured statically or learned through protocols such as OSPF. Because a router does not forward broadcasts between its interfaces, each router interface is a separate broadcast domain.

Enterprise routers usually sit at the site edge, connecting to the WAN and internet and providing NAT, DHCP, VPN termination and QoS.

1.3.2 Layer 2 and Layer 3 switches

A Layer 2 switch connects devices within the same LAN. It forwards Ethernet frames based on destination MAC addresses, which it learns by watching the source address of every frame that arrives and recording it in its MAC address table. It forwards a known unicast frame only out of the destination's port. Each switch port is its own collision domain, but by default all ports share one broadcast domain (VLAN 1). Chapter 4 explains switching in detail. A Layer 3 switch (also called a multilayer switch) does everything a Layer 2 switch does and can also route between VLANs and subnets in hardware at wire speed. It has routed interfaces and switched virtual interfaces (SVIs) that act as default gateways for hosts. They are the normal choice for the campus distribution and core layers.

Table 1-2 Router, Layer 2 switch and Layer 3 switch compared

Feature Layer 2 switch Layer 3 switch Router

Forwards based on Destination

Mac

domains?

Only with
VLANs
Yes (VLANs and routed ports) Yes, every interface

Typical place Access layer Distribution / core WAN / internet edge 1.3.3 Next-generation firewalls and IPS

A firewall enforces security policy between zones of different trust: inside, outside (internet) and a DMZ for public servers. A traditional stateful firewall remembers outbound connections, allows their return traffic and blocks unsolicited inbound connections. A next-generation firewall (NGFW) adds application visibility and control (identifying applications regardless of port), integrated intrusion prevention, URL filtering, advanced malware protection with threat-intelligence feeds, and user-aware policies. An intrusion prevention system (IPS) sits inline in the traffic path, inspects packets against a signature database and anomaly rules, and drops malicious traffic in real time. Its older cousin, the intrusion detection system (IDS), receives a copy of the traffic (for example from a SPAN port), so it can only alert, not block. Today IPS is usually a feature of the NGFW.

Exam alert

Remember the inline distinction: an IPS is inline and can drop traffic; an IDS monitors a copy and can only alert. A next-generation firewall is identified by application awareness, integrated IPS, URL filtering and malware protection on top of stateful filtering.

1.3.4 Access points

A wireless access point (AP) bridges between the wireless medium (802.11 radio frequencies) and the wired Ethernet LAN. It advertises networks by SSID, associates clients and converts between 802.11 and 802.3 frames. APs run autonomously, as lightweight APs managed by a controller over CAPWAP, or cloud-managed (Meraki). Chapters 10 and 18 cover wireless.

1.3.5 Controllers

A wireless LAN controller (WLC) centrally manages many lightweight APs:

configuration, radio channels and power, roaming and client authentication. An SDN controller, such as Cisco Catalyst Center (formerly DNA Center), manages a whole network of switches, routers and WLCs from a central point. through a GUI or REST API (Chapter 33).

1.3.6 Endpoints

Endpoints (hosts) are the sources and destinations of traffic: PCs, laptops, phones, printers, IP cameras and Internet of Things (IoT) sensors. Each has a MAC address and normally an IP address, mask, default gateway and DNS server.

1.3.7 Servers

A server provides services to clients: web, email, files, databases, authentication (RADIUS, Active Directory), DHCP, DNS, NTP and syslog. In the client-server model many clients use a central server; in peer-to-peer each device can be both. Most servers today are virtual machines or containers, on premises or in a public cloud.

1.3.8 Power over Ethernet (PoE)

Power over Ethernet delivers DC electrical power over the same twisted-pair cable that carries data. A switch port that supplies power is called power sourcing equipment (PSE); the device receiving it is the powered device (PD). PoE removes the need for an outlet near every AP, phone and camera and centralises backup power in the wiring closet. A standards-based PSE first detects a valid PD signature, then classifies its power needs, and only then applies power—so plugging a laptop into a PoE port is safe.

Table 1-3 PoE standards

Name Standard Max power at PSE port Power at PD (approx.) Pairs used PoE (Type 1) IEEE 802.3af 15.4 W 12.95 W 2 pairs

1. detect 2. classify 3. power

Figure 1-4 A PoE switch powering an AP, a phone and a camera. The switch tracks the total power it has allocated against its power budget.

1.4 SOHO Versus Enterprise Networks

A small office/home office (SOHO) network connects a few users to the internet, so cost and simplicity dominate. One “wireless router” combines a router with NAT (all devices share one public IPv4 address), a small switch, an access point, a basic stateful firewall and a DHCP server handing out private addresses such as 192.168.1.0/24. Its WAN port connects to the ISP's cable, DSL or fibre modem.

One “wireless router” box
Router + NAT
+ firewall

Dhcp / dns

192.168.1.0/24
4-port switch Wi-Fi AP
modem

Isp

printer

wireless

Wan

Figure 1-5 A SOHO network: router, switch, AP, firewall and DHCP server combined in one device.

An enterprise network separates those functions into dedicated, redundant devices so each can scale and no single failure takes the site down, as in Figure 1-3. Management moves from a web GUI to the CLI, controllers and automation, and security from basic NAT to NGFWs, 802.1X and segmentation. Enterprise architectures (two- and three-tier, spine-leaf, WAN and cloud) are covered in Chapter 11.

1.5 The CCNA Certification and the 200-301 Exam

The Cisco Certified Network Associate (CCNA) is earned by passing one exam, 200-301 CCNA, with no formal prerequisites.

The exam is organised by an exam blueprint (Cisco calls it “exam topics”) that lists six domains, each with numbered topics such as “1.1 Explain the role and function of network components”. This book follows blueprint version 1.1, which added topics such as AI and machine learning in network operations. The verbs in each topic tell you how deep to go: describe and explain mean conceptual understanding, while configure and verify mean you must be able to type the commands and interpret the output.

CCNA 200-301 v1.1 exam domains and weights

1.0 Network Fundamentals 20%

2.0 Network Access 20%

3.0 IP Connectivity 25%

4.0 IP Services 10%

5.0 Security Fundamentals 15%

6.0 Automation and Programmability 10%

0% 10% 20% 30%

Figure 1-6 Exam weightings. IP Connectivity (routing) is the single largest domain; Domains 1 and 2 together account for 40%.

Parts I–VI of this book follow these domains in order.

1.5.1 Exam format

The exam is delivered by Pearson VUE at a test centre or online. Cisco does not publish the question count or passing score and changes prices from time to time, so treat Table 1-4 as approximate and confirm current details on Cisco's certification website.

Table 1-4 CCNA 200-301 exam at a glance (approximate; confirm on Cisco's site) Item Details

Exam code and name 200-301 CCNA (Implementing and Administering Cisco Solutions) Duration 120 minutes

Number of questions Not published; candidates typically report about 100–120 items Passing score Not published and may change; scaled scoring is used Cost Approximately US$300 plus local taxes (varies by country)

Validity Three years

1.5.2 Question types

Expect multiple choice with a single answer or multiple answers (“Choose two”; no partial credit), drag and drop (match or order items), simulations (configure or fix a simulated network; graded on the result), simlets (console access, but you answer multiple-choice questions using show commands) and testlets (a scenario with several questions).

Watch out

The CCNA exam does not let you go back to a previous question once you have moved on, and you cannot flag questions for review. Budget your time: simulations can take 8–12 minutes each.

In simulations, the device prompt may accept abbreviated commands and ? help, but not every command or feature of real IOS is implemented. If a command you know is valid is rejected, try the most standard form of it. Also check whether you are asked to save the configuration with copy running-config startup-config .

1.5.3 Recertification

The CCNA is valid for three years. Recertification options currently include passing the CCNA again, passing a professional-level (CCNP) exam, earning 30 Continuing Education (CE) credits, or a combination. Rules change, so check Cisco's site.

1.6 How to Use This Book

Parts I–VI follow the six exam domains in order; Part VII holds a practice exam, a study plan and appendices (command reference, subnetting drills, glossary). Each chapter opens with its exam topics and a Foundation paragraph, explains concepts before configuration, and uses Exam alert, Tip, Watch out and Note callouts plus hands-on Labs. It closes with key terms, review questions and explained answers—work out why each wrong option is wrong. A good rhythm: read a chapter quickly, re-read it with your lab open typing every command, then answer the questions. Practise subnetting daily (Appendix B).

1.7 Building Your Practice Lab

Simulations test whether you can configure and troubleshoot under time pressure; the only way to build that skill is to type commands, break things and fix them.

1.7.1 Cisco Packet Tracer

Packet Tracer is a free network simulator available to anyone who enrols in a free course on Cisco's Networking Academy (NetAcad) site. It needs little memory, and its simulation mode lets you step through traffic one packet at a time and inspect each header. It simulates IOS rather than running it, so a few commands are missing, but it covers nearly the whole blueprint and is the best place to start.

1.7.2 Cisco Modeling Labs (CML)

Cisco Modeling Labs runs real Cisco operating system images (IOSv, IOSvL2, IOS XE in the form of CSR1000v/Catalyst 8000v, NX-OS, ASAv) as virtual machines. so output matches production devices. It has a free tier with a small node limit and a paid personal licence, and needs a reasonably powerful PC. Cisco DevNet also offers free, time-limited sandbox labs.

1.7.3 GNS3 and EVE-NG

GNS3 and EVE-NG are third-party emulation platforms that can run Cisco virtual images (which you must obtain legally, for example from a CML licence) alongside Linux hosts, firewalls from other vendors and even real devices connected through your PC's network card. Community editions are free but need more setup.

Used hardware, such as Catalyst 2960 switches and ISR routers bought second-hand, teaches console cables, PoE and cabling faults that simulators skip, at the cost of power, noise and older software.

1.7.4 A recommended lab topology

Figure 1-7 shows a topology that supports nearly every lab in this book. Three routers in a

triangle give you redundant paths for static routing and OSPF. Two access switches joined by two links let you practise trunks, spanning tree and EtherChannel, and the two distribution-style switches let you experiment with first hop redundancy. A server, an AP and a WLC cover the services and wireless chapters.

L3 L3

Wlc

ISP / Internet (NAT practice)
R1
R2 R3

Dsw1 dsw2

Asw1 asw2

Pc1 ap pc2 wlc

Figure 1-7 Recommended practice lab: three routers for routing and NAT, a distribution pair for FHRP and inter-VLAN routing,

two access switches for VLANs, STP and EtherChannel, plus a server, AP and WLC. Build it gradually: one switch and two PCs for Chapters 3 and 4, then add devices as chapters require, saving a known-good copy of each lab.

1.7.5 Your first login

When you power on a new Cisco router or switch with no configuration, it offers to run the System Configuration Dialog, a question-and-answer setup wizard. In this book we always answer no and configure the device manually, because that is what the exam expects. Figure 1-8 shows what you see on the console of a factory-default router in a lab. R1 — console (first boot)

Cisco IOS XE Software, Version 17.09.04a

...

--- System Configuration Dialog ---

Would you like to enter the initial configuration dialog? [yes/no]: no Would you like to terminate autoinstall? [yes]: yes

Press RETURN to get started!

Router> enable
Router# configure terminal

Enter configuration commands, one per line. End with CNTL/Z.

Router(config)# hostname R1
R1(config)# end
R1# copy running-config startup-config

Destination filename [startup-config]?

Building configuration...

[OK]

Figure 1-8 First console session on a lab router: declining the setup dialog, setting a hostname and saving. Chapter 4 explains

every mode shown here. All CLI output in this book is illustrative of IOS 15.x and IOS XE 16.x/17.x; details vary by platform and release.

LAB Build a starter lab in Packet Tracer

Goal: Create a small topology, give the hosts addresses, and prove they can communicate. This lab needs no device configuration beyond the PCs, and it gets you comfortable with the simulator before Chapter 4.

Topology: One 2960 switch (SW1) and two PCs (PC1 on Fa0/1, PC2 on Fa0/2), connected with copper straight-through cables, as in Figure 1-1 without the router.

Steps:

1. Drag a 2960 switch and two generic PCs onto the workspace. Use the automatic connection tool or choose Copper Straight-Through and connect each PC's FastEthernet0 to switch ports Fa0/1 and Fa0/2.
2. On PC1, open Desktop > IP Configuration and set IPv4 address 192.168.1.11 , mask 255.255.255.0 . On PC2 set 192.168.1.12 , mask 255.255.255.0 .
3. On PC1, open Desktop > Command Prompt and run ping 192.168.1.12 .
4. Switch to Simulation mode, filter for ARP and ICMP only, and ping again. Step through the events and open each PDU to see its Layer 2 and Layer 3 headers. Verify: The first ping may lose one reply while ARP resolves the MAC address; subsequent pings succeed.

Expected result: Four replies. In simulation mode you should see PC1 broadcast an ARP request, PC2 reply with its MAC address, and then the ICMP echo request and echo reply travel through the switch. Keep this file: you will add a router and configure the switch in later chapters.

Chapter review
Key terms
network
protocol
standard (IEEE, IETF)

Lan

Wlan

Wan

Svi

MAC address table

next-generation firewall

Ips

Ids

access point
wireless LAN controller
endpoint
server
PoE / PSE / PD

Soho

exam blueprint
simlet
Review questions

1. Which device forwards traffic between different IP networks using a routing table?

A. Hub
B. Layer 2 switch
C. Router
D. Access point

2. Which feature distinguishes a next-generation firewall from a traditional stateful firewall?

A. Blocking unsolicited inbound connections
B. Application visibility and control
C. Tracking TCP session state
D. Performing NAT

3. An engineer needs a device that inspects traffic inline and drops packets matching attack signatures. Which device should be deployed?

A. IDS
B. IPS
C. WLC
D. Layer 2 switch

4. Which two functions does a Layer 3 switch provide that a Layer 2 switch does not? (Choose two.)

A. Learning MAC addresses
B. Routing between VLANs
C. Forwarding frames based on MAC address
D. Providing SVIs as default gateways for hosts
E. Flooding unknown unicast frames

5. Which device centrally manages lightweight access points, including RF channel and power settings?

A. Wireless LAN controller
B. Next-generation firewall
C. Layer 3 switch
D. RADIUS server

6. What is the maximum power available at the PSE port with IEEE 802.3at (PoE+)?

A. 7 W
B. 15.4 W
C. 30 W
D. 60 W

7. Which two statements describe PoE operation? (Choose two.)

A. The switch is the powered device
B. The PSE detects a valid PD signature before applying power
C. PoE requires a separate cable for power
D. The switch has a total power budget shared among its ports
E. PoE can only be used on fiber links

8. Which network type typically spans cities, uses links leased from a service provider and has a recurring cost?

A. LAN
B. WLAN
C. WAN
D. SOHO

9. Which CCNA 200-301 domain carries the highest weight?

A. Network Fundamentals
B. Network Access
C. IP Connectivity
D. Security Fundamentals

10. Which exam item type gives you console access to a simulated network but asks multiple-choice questions you answer using show commands?

A. Simulation
B. Simlet
C. Testlet
D. Drag and drop

11. Which two are examples of endpoints? (Choose two.)

A. IP phone
B. Access switch
C. IP camera
D. Edge router
E. Wireless LAN controller

12. By default, which statement is true about a Layer 2 switch with all ports in VLAN 1?

A. Each port is a separate broadcast domain
B. All ports are in one collision domain
C. Each port is a separate collision domain, and all ports share one broadcast domain
D. The switch routes between its ports

Answers

1. C. Routers forward packets between IP networks based on the destination IP address and the routing table. Switches forward frames within a LAN by MAC address; hubs repeat bits; APs bridge wireless clients onto the LAN.
2. B. Application visibility and control (along with integrated IPS, URL filtering and malware protection) is what makes a firewall “next-generation”. Stateful tracking, blocking unsolicited inbound traffic and NAT are features of traditional firewalls too.
3. B. An IPS is inline and can drop malicious traffic. An IDS receives a copy of traffic and can only alert.
4. B, D. Layer 3 switches route between VLANs and provide SVIs that act as default gateways. MAC learning, MAC-based forwarding and flooding are things every Layer 2 switch does.
5. A. A WLC manages lightweight APs, including radio resource management, configuration and client roaming.
6. C. 802.3at (PoE+) supplies up to 30 W at the PSE port (about 25.5 W at the device). 15.4 W is 802.3af; 60 W is 802.3bt Type 3.
7. B, D. The PSE (switch) detects and classifies the PD before supplying power, and the switch has a finite power budget. The switch is the PSE, not the PD; PoE uses the same copper cable as data and does not work over fiber.
8. C. A WAN spans large distances over links usually leased from a provider.
9. C. IP Connectivity is 25%. Network Fundamentals and Network Access are 20% each; Security Fundamentals is 15%.
10. B. A simlet gives CLI access for gathering information to answer multiple-choice questions. A simulation requires you to configure; a testlet presents a scenario with several questions but no console.
11. A, C. IP phones and IP cameras are endpoints that originate and receive traffic. Switches, routers and WLCs are infrastructure devices.
12. C. Every switch port is its own collision domain, but without VLANs all ports share a single broadcast domain. A Layer 2 switch does not route.