Comprehensive CCNA Academic Study Notes

The OSI Model and Network Fundamentals

The Open Systems Interconnection (OSI) model serves two primary purposes in network operations: it defines the specific network functions that occur at each of its seven layers and facilitates a standard understanding of how information travels throughout a network environment. At the Data Link layer (Layer 2), the default behavior of a switch when receiving a frame with an unknown destination MAC address is to flood the packet to all ports within the same VLAN, excluding the port that originally received the frame. For local area network communications, a broadcast frame utilizes the destination MAC address of $ff:ff:ff:ff:ff:ff$. Power over Ethernet (PoE) classification override is a feature where, if a monitored port exceeds its maximum administrative value for power consumption, the port is automatically shut down and placed in an err-disabled state.

Network Topology and Architecture

Modern network designs often utilize a spine-and-leaf architecture to ensure scalability. In this model, every leaf switch is connected to every spine switch, which allows each device in the fabric to be separated by the same number of hops. This results in predictable latency. In traditional three-tier topologies, the core layer is optimized for high-speed connectivity and is designed to maintain continuous connectivity even during device failures, functioning as the backbone. The distribution layer in this model handles both Layer 2 and Layer 3 technologies, providing the boundary between the access layer and the core. Collapsed core architectures, or two-tier designs, combine the functions of the core and distribution layers into a single device or redundant pair, which is more cost-effective for smaller environments. In small office or home office (SOHO) contexts, broadband cable access is the preferred WAN technology, typically supporting between $1$ and $50$ users via a single broadband connection. For metropolitan area interconnections requiring converged traffic (voice, video, and data), Ethernet WAN is recommended for its high speed and easy integration with existing LAN infrastructure.

Cloud Computing and Virtualization

Virtualization allows multiple operating systems and applications to run independently on a single physical server by utilizing a hypervisor. The hypervisor virtualizes physical hardware components, including the CPU, memory, and storage, and is responsible for managing and distributing these resources to each virtual machine (VM). Virtual machines are operating system instances decoupled from server hardware. Infrastructure-as-a-Service (IaaS) is a specific cloud model that allows organizations to install their own operating systems on a virtual machine. Conversely, Software-as-a-Service (SaaS) is categorized by software that is managed and updated by the provider, removing the need for employees to manage it themselves. Rapid elasticity is a cloud characteristic where resource pools can expand or contract quickly based on tenant demand. Containers represent a different form of virtualization at the operating system level, allowing the host OS to control different CPU and memory processes while sharing the host's OS kernel.

Discovery and Management Protocols

Cisco Discovery Protocol (CDP) is used to discover connected devices, determine hardware platforms, and identify IP addresses of adjacent Cisco hardware. If an adjacent device lacks an IP address, CDP will still operate but will not provide IP information for that specific neighbor. LLDP (Link Layer Discovery Protocol) is an open-standard alternative. It can be enabled globally using the command lldp run. Specific timers like lldp timer control the frequency of updates, while lldp holdtime determines how long information is retained. lldp reinit specifies the delay time in seconds for LLDP to initialize on an interface. SNMP (Simple Network Management Protocol) is used for network monitoring. SNMPv3 is required for the highest security as it supports authentication and encryption. SNMP components include the managed device, the agent (which captures data), the MIB (Management Information Base, a collection of variables), and the NMS (Network Management System). Syslog provides various severity levels for logging; level $0$ is Emergency (system unusable), level $6$ is Informational, and level $7$ is Debugging. A notice-level message often indicates an interface line status change.

Layer 2 Switching and EtherChannel

Layer 2 switches make forwarding decisions based on the MAC address table (CAM table). The CAM table is empty until ingress traffic arrives at a port, at which point the switch learns the source MAC address. MAC address aging typically lasts $300$ seconds by default before an unused entry is removed. To prevent loops at Layer 2, Spanning Tree Protocol (STP) is used, which functions by blocking specific ports. Rapid PVST+ (802.1w) is a faster convergence version of STP. The portfast command is used on access ports to immediately transition them to the forwarding state, bypassing listening and learning states. EtherChannel technology allows for increased bandwidth and redundancy by bundling multiple physical links into a single logical link. LACP (Link Aggregation Control Protocol) is an industry-standard protocol for this (802.3ad). Configuration modes include 'active' (initiates negotiation), 'passive' (responds to negotiation), and 'on' (no protocol used). For LACP to form, at least one side must be in 'active' mode.

IP Addressing and Subnetting

IPv4 addresses are limited, necessitating the use of RFC 1918 private address ranges: $10.0.0.0/8$, $172.16.0.0/12$, and $192.168.0.0/16$. These addresses allow internal communication without consuming public IP space and require Network Address Translation (NAT) to access the internet. NAT Overload (PAT) allows a one-to-many relationship where multiple internal hosts share a single public IP. In subnetting, a $/30$ mask provides $2$ usable hosts, typically used for point-to-point links. For a subnet with $20$ users, a $/27$ mask ($255.255.255.224$) is the most efficient choice to minimize waste while allowing growth. A $T1$ connection provides a maximum bandwidth of $1.544\,Mbps$. For workstation configuration, DHCP (Dynamic Host Configuration Protocol) provides IP addresses, subnet masks, default gateways, and DNS server information. The DHCP process follows the DISCOVER, OFFER, REQUEST, ACK sequence.

IP Routing and OSPF

Routers use the administrative distance (AD) to select the best path when multiple protocols provide a route to the same destination. Connected routes have an AD of $0$, static routes $1$, EBGP $20$, EIGRP $90$, OSPF $110$, and RIP $120$. Within a single protocol, the metric is used to determine the best path. OSPF (Open Shortest Path First) is a link-state protocol that uses cost as its metric, calculated by dividing a reference bandwidth by the actual bandwidth. In OSPF, a Designated Router (DR) and Backup Designated Router (BDR) are elected on multi-access segments like Ethernet. The election is based on the highest OSPF priority; if priorities are tied, the highest Router ID is used. OSPF neighbors must have matching Area IDs, hello/dead timers, and subnet masks to form an adjacency. Floating static routes are backup routes configured with a higher AD than the primary route, ensuring they only enter the routing table if the primary fails.

IPv6 Operations

IPv6 addresses are $128$ bits long and can be compressed by removing leading zeros and replacing consecutive blocks of zeros with a double colon ::. Global Unicast addresses (starting with $2000::/3$) are publicly routable. Unique Local addresses ($FC00::/7$) are for private internal use. Link-Local addresses ($FE80::/10$) are mandatory for every interface and are used for communication on a single link. Multicast addresses ($FF00::/8$) provide one-to-many communication. Anycast addresses are assigned to multiple devices but route to the nearest one. Modified EUI-64 is a method to automatically generate a $64$-bit interface ID by taking the $48$-bit MAC address, inserting FFFE in the middle, and inverting the 7th bit. SLAAC (Stateless Address Autoconfiguration) allows devices to configure their own IPv6 address without a DHCPv6 server.

Network Security and Access Control

Security involves physical access control, such as badge readers and surveillance, as well as electronic controls. ACLs (Access Control Lists) filter traffic; standard ACLs filter by source IP only, while extended ACLs (range $100-199$) filter by source/destination IP, protocol, and port numbers. Modern security utilizes multi-factor authentication (MFA), which combines 'something you know' (password), 'something you have' (token/smartphone), or 'something you are' (biometrics). WPA3 improves wireless security through Simultaneous Authentication of Equals (SAE) to protect against brute-force attacks and offers Perfect Forward Secrecy. SSH (Secure Shell) is the standard for secure remote CLI access, requiring a hostname, domain name, and generated RSA keys (typically $1024$ or $2048$ bits). AAA stands for Authentication (who you are), Authorization (what you can do), and Accounting (what you did). TACACS+ is a Cisco-proprietary AAA protocol using TCP port $49$, and it encrypts the entire packet, whereas RADIUS uses UDP and only encrypts the password.

Wireless LAN Concepts

Wireless infrastructure uses Wireless LAN Controllers (WLCs) to centralize the management of lightweight Access Points (APs). CAPWAP (Control and Provisioning of Wireless Access Points) is the protocol used for communication between the AP and WLC. AP modes include Local (normal operation), Sniffer (captures traffic), Monitor (rogue detection), and FlexConnect (allows local switching at remote sites if the WLC connection is lost). SSIDs (Service Set Identifiers) identify specific wireless networks. To minimize interference in the $2.4\,GHz$ band, channels $1$, $6$, and $11$ are used as they are non-overlapping. The $5\,GHz$ band offers up to $23$ non-overlapping channels. WLCs manage radio resource management (RRM) to dynamically adjust power and channel assignments. For high-speed Voice over WLAN, the Platinum QoS profile is recommended.

SDN and Network Automation

Software-Defined Networking (SDN) centralizes the control plane on a controller, while the data plane remains distributed on switches/routers for traffic forwarding. Northbound APIs facilitate communication between the controller and applications, while Southbound APIs (like OpenFlow, NETCONF, or RESTCONF) communicate between the controller and network hardware. Cisco DNA Center is an SDN controller for campus networks that provides automation, assurance, and analytics. It uses machine learning to identify and resolve issues. Configuration management tools include Ansible (agentless, uses SSH and YAML playbooks), Puppet (agent-based, uses manifests), and Chef (agent-based, uses Ruby-based cookbooks). REST APIs use HTTP methods: GET (read), POST (create), PUT (replace), PATCH (update), and DELETE (remove). JSON (JavaScript Object Notation) is a common data format for APIs, utilizing objects (curly braces {}), arrays (square brackets []), and key-value pairs.