Comprehensive Study Notes: Cisco CCNA Routing and Switching Complete Study Guide

Cisco Certification Framework and Examination Architecture

Cisco Certification Hierarchy and Career Tracks:
- Cisco professional credentials progress through distinct tiers: Cisco Certified Entry Network Technician (CCENT), Cisco Certified Network Associate (CCNA), Cisco Certified Network Professional (CCNP), and Cisco Certified Internetwork Expert (CCIE).
- Primary technology tracks encompass Routing and Switching (R/S), Data Center, Security, Service Provider, Service Provider Operations, Wireless, Collaboration/Voice, Industrial, Video, and Design.
- Historical single-exam formats for the CCIE have evolved into modular prerequisites; achieving CCENT or CCNA serves as the baseline validation for subsequent professional paths.

Examination Tracks and Options:
- Two-Exam Track:
- Interconnecting Cisco Networking Devices Part 1 (ICND1 Exam $100\text{-}105$ ): Validates skills required to install, operate, and troubleshoot a small branch office network. Covers IP data network operation, LAN switching, IPv6, IP routing technologies, IP services, and network device security. Priced at $\$150$ .
- Interconnecting Cisco Networking Devices Part 2 (ICND2 Exam $200\text{-}105$ ): Validates skills required to install, operate, and troubleshoot a small-to-medium enterprise branch network. Covers LAN switching technologies, IP routing, security, troubleshooting, and WAN technologies. Priced at $\$150$ .
- Single-Exam Composite Track:
- CCNA Composite Exam ( $200\text{-}125$ ): Combines all topics across ICND1 and ICND2 into a single comprehensive test. Priced at $\$250$ .
Testing Protocols and Exam Delivery:
- Proctored delivery handled globally via Pearson VUE test centers.
- Exam parameters comprise approximately $40$ to $50$ questions administered within an approximate $90\,\text{minute}$ window.
- Passing threshold is approximately $85\%$ ( $850/1000$ ), though individual forms vary.
- Formats include multiple-choice single answer, multiple-choice multiple answer, drag-and-drop, and live router/switch command-line simulations.
- Forward-only navigation rule: answers cannot be modified once confirmed by selecting "Next".
- Retake waiting policy: a mandatory delay of $5\,\text{days}$ is enforced after an unsuccessful attempt.

Internetworking Fundamentals and the OSI Reference Model

Core Internetworking Concepts:
- An internetwork is formed by connecting two or more networks using a layer 3 device (router) and configuring a logical addressing scheme (IPv4 or IPv6).
- Network Segmentation:
- Breaking up large, congested networks into smaller, manageable subnetworks using routers, switches, and bridges.
- Traffic congestion is predominantly driven by excessive hosts within a collision or broadcast domain, broadcast storms, high volumes of multicast traffic, bandwidth deficits, hub proliferation, and widespread ARP broadcasts.

Collision Domains and Broadcast Domains:
- Collision Domain:
- An Ethernet physical network segment where devices compete for shared bandwidth.
- Simultaneous transmissions produce electrical interference (collisions), terminating the transmission and requiring a forced random backoff delay before retransmitting.
- Hubs place all attached devices into a single collision domain.
- Switches dedicate an isolated collision domain to every individual port.
- Broadcast Domain:
- The group of all devices on a network segment that receive and process any Data Link or Network layer broadcast frame sent across that segment.
- By default, layer 2 switches propagate broadcasts out all active ports except the arrival port, binding the entire switch fabric to a single broadcast domain.
- Routers break up broadcast domains by default, terminating broadcasts at the ingress interface and preventing them from traversing across networks.

Layer 2 and Layer 3 Internetworking Devices:
- Routers:
- Operate at layer 3 (Network layer).
- Responsibilities: packet switching, packet filtering via Access Control Lists (ACLs), path selection via routing tables, and internetwork communication.
- Terminate both collision domains and broadcast domains per physical interface.
- Switches and Bridges:
- Operate at layer 2 (Data Link layer).
- Function as hardware-based multiport bridges leveraging Application-Specific Integrated Circuits (ASICs) to forward frames at wire speed with low latency.
- Create separate collision domains per port; do not isolate broadcast or multicast packets by default.
- Hubs and Repeaters:
- Operate at layer 1 (Physical layer).
- Function as multiport physical repeaters; reamplify/regenerate digital electrical signals across all active ports without examining frame contents or addresses.
- Create a physical star layout exhibiting a logical bus topology.
- Wireless Access Points (APs) and Controllers:
- APs extend a switch port's collision domain into the wireless medium via IEEE $802.11$ .
- Wireless LAN Controllers (WLCs) centralize and automate configuration, management, security, and RF controls across hundreds or thousands of lightweight APs.

Switched Networks Forming an Internetwork

The Open Systems Interconnection (OSI) 7-Layer Reference Model:
- Conceptual architectural framework established by the International Organization for Standardization (ISO) to standardize multi-vendor device interoperability.
- Layer 7: Application:
- Interface between application software and underlying network communication services.
- Identifies communication partner availability, synchronizes applications, and confirms necessary resources exist.
- Layer 6: Presentation:
- Translates, encodes, compresses, and encrypts data between application formats and standardized network formats (e.g., EBCDIC to ASCII conversion).
- Layer 5: Session:
- Establishes, manages, and terminates communication sessions and dialogs between applications across hosts.
- Coordinates dialog modes: simplex (unidirectional), half-duplex (alternating bidirectional), and full-duplex (concurrent bidirectional).
- Layer 4: Transport:
- Manages end-to-end data transport, multiplexing upper-layer applications, segmentation, and reassembly.
- Establishes logical connections through virtual circuit setup (three-way handshake: SYN, SYN/ACK, ACK).
- Enforces reliable transport through sequence tracking, positive acknowledgments, dynamic windowing, and flow control mechanisms (buffering, windowing, congestion avoidance).
- Layer 3: Network:
- Manages logical device addressing, tracks location across internetworks, and computes best-path routing.
- Employs routed protocols (IP, IPv6) for user data carriage and routing protocols (OSPF, EIGRP, RIP) for path discovery and routing table maintenance.
- Layer 2: Data Link:
- Provides physical transmission of data frames across local links using physical (MAC) hardware addresses.
- Performs error detection using a Cyclic Redundancy Check (CRC) placed in the Frame Check Sequence (FCS) trailer (does not perform error correction).
- IEEE $802$ sublayer division:
  - Media Access Control (MAC) ( $802.3$ , $802.11$ ): Governs physical media contention, hardware addressing, and logical topologies.
  - Logical Link Control (LLC) ( $802.2$ ): Identifies Network layer protocols, provides flow control, and sequences control bits.
- Layer 1: Physical:
- Transmits and receives unstructured raw bitstreams ( $1$ s and $0$ s) as physical/electrical/optical/RF signals across physical media.
- Defines mechanical connectors, pinouts, cable specifications, signaling voltages, and line interfaces (DTE vs. DCE).
- 7-Layer Device Classification:
- Devices operating across all seven layers include network hosts, application/web servers, Network Management Stations (NMSs), and translating gateways.

Ethernet Networking, Physical Media, and Data Encapsulation

Carrier Sense Multiple Access with Collision Detection (CSMA/CD):
- Contention-based media access protocol designed to regulate access on shared half-duplex Ethernet segments.
- Operational Sequence During a Collision:
1. A transmitting station continuously checks the wire for an existing carrier signal.
2. If clear, the station transmits; if two stations transmit simultaneously, an electrical collision occurs.
3. The colliding stations detect the signal anomaly and broadcast an extended jam signal to inform all network devices of the collision.
4. Transmission immediately halts across all devices on the segment.
5. The collision invokes a random backoff algorithm on each contending device.
6. Stations cease transmitting until their individual backoff timers expire.
7. All stations resume transmission eligibility with equal priority upon timer expiration.
8. After $15$ consecutive unsuccessful transmission attempts, the transmission times out.
Half-Duplex vs. Full-Duplex Modes:
- Half-Duplex:
- Defined in IEEE $802.3$ ; transmits and receives over a shared wire pair.
- Employs CSMA/CD; subject to collisions; delivers an effective throughput efficiency of approximately $30\%$ to $40\%$ of rated bandwidth.
- Mandatory when connecting to legacy hubs or shared-media environments.
- Full-Duplex:
- Point-to-point architecture utilizing two distinct wire pairs (one transmit pair, one receive pair).
- Completely eliminates collisions, bypassing CSMA/CD mechanisms entirely.
- Yields an aggregate throughput efficiency of $100\%$ in both directions (e.g., $20\,\text{Mbps}$ aggregate for $10\,\text{Mbps}$ Ethernet; $200\,\text{Mbps}$ for Fast Ethernet).
- Supported between switch-to-host, switch-to-switch, switch-to-router, router-to-router, and host-to-host configurations.
- Relies on an auto-detect mechanism at port link-up to negotiate speed and duplex. If autonegotiation fails on $10\text{Base-T}$ and $100\text{Base-TX}$ interfaces, the default operational state falls back to $10\,\text{Mbps}$ half-duplex.
Ethernet Data Link Addressing (MAC Addresses):
- Physical/hardware address burned into network interface card (NIC) firmware.
- Length: $48\,\text{bits}$ ( $6\,\text{bytes}$ ), typically formatted as twelve hexadecimal digits (e.g., 0000.0c12.3456).
- Address Breakdown:
- High-order $24\,\text{bits}$ ( $3\,\text{bytes}$ ): Organizationally Unique Identifier (OUI), assigned by the IEEE to manufacturers.
- Low-order $24\,\text{bits}$ ( $3\,\text{bytes}$ ): Vendor-assigned serial identifier ( $2^{24} = 16,777,216$ possible unique cards per OUI).
- Bit $47$ (High-order bit / I/G bit): Individual/Group bit ( $0 = \text{Individual/unicast device MAC}$ ; $1 = \text{Group multicast or broadcast address}$ ).
- Bit $46$ (G/L or U/L bit): Global/Local bit ( $0 = \text{Globally administered by IEEE}$ ; $1 = \text{Locally administered}$ ).
Mathematical Number Conversions:
- Binary and Decimal Values:
- Byte values: $128, 64, 32, 16, 8, 4, 2, 1$ .
- Maximum value of an 8-bit byte ( $11111111_2$ ): $128 + 64 + 32 + 16 + 8 + 4 + 2 + 1 = 255_{10}$ .
- Decimal masks: $10000000_2 = 128_{10}$ , $11000000_2 = 192_{10}$ , $11100000_2 = 224_{10}$ , $11110000_2 = 240_{10}$ , $11111000_2 = 248_{10}$ , $11111100_2 = 252_{10}$ , $11111110_2 = 254_{10}$ , $11111111_2 = 255_{10}$ .
- Hexadecimal Conversions:
- Base-16 numbering utilizing characters $0\text{–}9$ and $A\text{–}F$ ( $A=10, B=11, C=12, D=13, E=14, F=15$ ).
- Prefixed with 0x to designate a hexadecimal base.
- Converted by isolating 4-bit nibbles: 0x6A converts to $0110_2$ ( $6$ ) and $1010_2$ ( $10/A$ ), yielding $01101010_2 = 64 + 32 + 8 + 2 = 106_{10}$ .
Ethernet Frame Architecture (Ethernet II):
- Preamble ( $7\,\text{bytes}$ ): Alternating $1,0$ bit pattern ( $5\,\text{MHz}$ clock) enabling receiver bit synchronization.
- Start Frame Delimiter (SFD) / Synch ( $1\,\text{byte}$ ): Configured as $10101011_2$ , signaling the imminent arrival of addressing fields.
- Destination MAC Address (DA) ( $6\,\text{bytes}$ ): Transmitted least significant bit (LSB) first; identifies the recipient interface, multicast group, or broadcast address (FF:FF:FF:FF:FF:FF).
- Source MAC Address (SA) ( $6\,\text{bytes}$ ): Transmitted LSB first; identifies the sending interface; broadcast or multicast formatting is illegal.
- Type (Ether-Type) ( $2\,\text{bytes}$ ): Identifies the encapsulated Network layer routed protocol (e.g., $0\text{x}0800$ for IPv4, $0\text{x}86\text{DD}$ for IPv6, $0\text{x}0806$ for ARP). Legacy IEEE $802.3$ utilizes this field as Length.
- Data and Pad ( $46\text{–}1500\,\text{bytes}$ ): Encapsulates the layer 3 packet. If payload is less than $46\,\text{bytes}$ , padding bytes are appended to satisfy the minimum frame size requirement of $64\,\text{bytes}$ .
- Frame Check Sequence (FCS) ( $4\,\text{bytes}$ ): Stores the mathematical result of the 32-bit CRC computed across addressing, type, and data fields.
Physical Ethernet Specifications and Standards:
- EIA/TIA Standards: Standardize RJ45 (8-pin modular) connectors and Unshielded Twisted Pair (UTP) cabling.
- Cable categories: Category 5e handles up to $1\,\text{Gbps}$ at $100\,\text{meters}$ ; Category 6 handles up to $10\,\text{Gbps}$ .
- IEEE Standards Overview:
- $10\text{Base-T}$ (IEEE $802.3$ ): $10\,\text{Mbps}$ , Category 3 UTP, $100\,\text{meters}$ , RJ45 connector, physical star/logical bus.
- $100\text{Base-TX}$ (IEEE $802.3\text{u}$ ): Fast Ethernet, $100\,\text{Mbps}$ , Category 5/5e/6 UTP (2 pairs), $100\,\text{meters}$ , RJ45.
- $100\text{Base-FX}$ (IEEE $802.3\text{u}$ ): Fast Ethernet over fiber, $100\,\text{Mbps}$ , $62.5/125\,\mu\text{m}$ multimode fiber, up to $412\,\text{meters}$ , ST/SC connectors.
- $1000\text{Base-CX}$ (IEEE $802.3\text{z}$ ): $1\,\text{Gbps}$ over balanced copper twinax, up to $25\,\text{meters}$ , 9-pin HSSDC connector.
- $1000\text{Base-T}$ (IEEE $802.3\text{ab}$ ): Gigabit Ethernet over Category 5 4-pair UTP, up to $100\,\text{meters}$ .
- $1000\text{Base-SX}$ (IEEE $802.3\text{z}$ ): Gigabit Ethernet over multimode fiber, $850\,\text{nm}$ short wavelength laser; up to $220\,\text{meters}$ ( $62.5\,\mu\text{m}$ core) or $550\,\text{meters}$ ( $50\,\mu\text{m}$ core).
- $1000\text{Base-LX}$ (IEEE $802.3\text{z}$ ): Gigabit Ethernet over single-mode fiber, $1300\,\text{nm}$ laser, $9\,\mu\text{m}$ core, spans from $3\,\text{km}$ to $10\,\text{km}$ .
- $1000\text{Base-ZX}$ (Cisco Enterprise): Gigabit Ethernet over single-mode fiber, spans up to $43.5\,\text{miles}$ ( $70\,\text{km}$ ).
- $10\text{GBase-T}$ (IEEE $802.3\text{an}$ ): $10\,\text{Gbps}$ over conventional Category 5e/6/7 UTP, up to $100\,\text{meters}$ .
Cabling Pinouts and Physical Assembly:
- Straight-Through Cable:
- Pin connection: Pin 1 to 1, Pin 2 to 2, Pin 3 to 3, Pin 6 to 6.
- Application: Dissimilar devices (host to switch/hub, router to switch/hub).
- Crossover Cable:
- Pin connection ( $10/100\text{Base-TX}$ ): Pin 1 to 3, Pin 2 to 6, Pin 3 to 1, Pin 6 to 2.
- Application: Similar devices (switch to switch, hub to hub, host to host, hub to switch, router direct to host, router to router).
- Gigabit Crossover ( $1000\text{Base-T}$ ): Pin 1 to 3, Pin 2 to 6, Pin 4 to 7, Pin 5 to 8.
- Rolled Cable (Console):
- Pin connection: Pin 1 to 8, Pin 2 to 7, Pin 3 to 6, Pin 4 to 5, Pin 5 to 4, Pin 6 to 3, Pin 7 to 2, Pin 8 to 1.
- Connects PC serial/COM port (or USB-to-serial adapter) to Cisco router/switch RJ45 console port.
- Newer Cisco switches and routers incorporate a mini type-B USB console port running at speeds up to $115,200\,\text{bps}$ , which overrides the RJ45 port if connected simultaneously.

Catalyst 2960SF Series Console and SFP Ports

Fiber-Optic Media Characteristics:
- Transmits light pulses through thin glass or plastic waveguides; fully immune to electromagnetic interference (EMI) and crosstalk.
- Core: Internal glass carrying the light ( $9\,\mu\text{m}$ for single-mode; $50$ or $62.5\,\mu\text{m}$ for multimode).
- Cladding: Surrounds core with a lower refractive index, confining light via total internal reflection; standard outer diameter is $125\,\mu\text{m}$ .
- Buffer: Outer coating protecting the glass filament ( $250\,\mu\text{m}$ ).
- Single-Mode vs. Multimode:
- Single-mode: Narrow core ( $9\,\mu\text{m}$ ), single path of light (mode), laser-driven, covers extended distances ( $10\,\text{km}$ to $70\,\text{km}$ ), higher cost.
- Multimode: Wider core ( $50\text{–}62.5\,\mu\text{m}$ ), multiple light dispersion paths, LED or VCSEL driven, shorter distances ( $220\text{–}550\,\text{meters}$ ), lower cost.
Protocol Data Unit (PDU) Encapsulation Process:
1. User applications format information into upper-layer Application Data.
2. Transport layer segments data, constructs a header (source/destination ports, sequence numbers), establishing a virtual circuit.
3. Network layer encapsulates segments into Packets/Datagrams, prepending logical addressing (source/destination IP) and protocol indicators.
4. Data Link layer encapsulates packets into Frames, attaching physical source/destination MAC addresses, Ether-Type, and computing a CRC placed into the FCS trailer.
5. Physical layer encodes the frame bits into digital transmission signals synchronized via bit clocks.
- De-encapsulation reverses this sequence upon frame arrival at the destination node.
Cisco Three-Layer Hierarchical Model:
- Core Layer:
- High-speed switching backbone designed for rapid, low-latency transport across corporate backbones.
- Prohibited operations: Packet filtering, Access Control Lists (ACLs), inter-VLAN routing, workgroup support.
- Requirements: High redundancy, rapid convergence routing protocols (EIGRP, OSPF), Gigabit/10-Gigabit links.
- Distribution Layer:
- Routing, filtering, access policies, security enforcement, and WAN access point.
- Interconnects the access layer to the core; provides route summarization, VLAN routing, and broadcast/multicast boundaries.
- Access Layer:
- Desktop and workgroup access layer controlling user attachment to the switch fabric.
- Implements microsegmentation, port security, VLAN memberships, PoE, QoS classification, and rate-limiting.

The TCP/IP Protocol Suite and the DoD Model

DoD Model Layer Alignment:
- Four layers: Process/Application, Host-to-Host (Transport), Internet, Network Access (Link).
- Process/Application aligns with OSI Application, Presentation, and Session layers.
- Host-to-Host aligns with OSI Transport layer.
- Internet aligns with OSI Network layer.
- Network Access aligns with OSI Data Link and Physical layers.
Process/Application Layer Protocols:
- Telnet (TCP port $23$ ): Unencrypted, cleartext terminal emulation service.
- SSH (Secure Shell) (TCP port $22$ ): Cryptographically secure terminal emulation providing authenticated, encrypted communication.
- FTP (File Transfer Protocol) (TCP ports $20$ [data] and $21$ [control]): Dual-channel connection-oriented protocol for bidirectional file manipulation, directory navigation, and authenticated transfer.
- TFTP (Trivial File Transfer Protocol) (UDP port $69$ ): Stripped-down, UDP-based file transfer protocol devoid of directory browsing, authentication, or encryption; sends small data blocks ( $512\,\text{bytes}$ ).
- SNMP (Simple Network Management Protocol) (UDP port $161$ for polling, UDP port $162$ for traps): Collects and alters network device operational data. Managed via Network Management Stations (NMSs) interrogating software agents on devices that report against a Management Information Base (MIB).
- HTTP (TCP port $80$ ): Facilitates transfer of unencrypted hypertext and web resources using Uniform Resource Locators (URLs).
- HTTPS (TCP port $443$ ): Secures HTTP transmissions via Secure Sockets Layer (SSL) or Transport Layer Security (TLS).
- NTP (Network Time Protocol) (UDP port $123$ ): Synchronizes internal clocking across distributed network elements against reference stratum servers.
- DNS (Domain Name Service) (TCP/UDP port $53$ ): Resolves hostnames and Fully Qualified Domain Names (FQDNs) to IP addresses (uses UDP for standard lookups, TCP for zone transfers).
- DHCP (Dynamic Host Configuration Protocol) & BootP (UDP ports $67$ [server] and $68$ [client]): Automates assignment of IP addresses, subnet masks, default gateways, and DNS servers.
- DHCP Address Resolution (DORA Sequence):
  1. DHCP Discover: Client broadcasts at layer 2 (FF:FF:FF:FF:FF:FF) and layer 3 (255.255.255.255).
  2. DHCP Offer: Server returns a layer 2 unicast containing an offered IP address and parameters.
  3. DHCP Request: Client broadcasts acceptance of the offered lease.
  4. DHCP Acknowledgment: Server unicasts final lease validation.
- DHCP Address Conflicts:
  - The server checks availability by transmitting an ICMP Echo Request (ping) prior to issuing an address.
  - The client transmits a Gratuitous ARP on the local broadcast domain to verify no other host owns the assigned IP.
  - If an IP conflict is discovered, the address is culled from the DHCP scope and marked unusable until an administrator manually resolves the condition.
- APIPA (Automatic Private IP Addressing):
- Subnet: 169.254.0.0/16 (169.254.0.1 through 169.254.255.254), default mask 255.255.0.0.
- Auto-configured by operating systems when DHCP server discovery fails.
Host-to-Host (Transport) Layer Protocols:
- Transmission Control Protocol (TCP):
- Full-duplex, connection-oriented, reliable protocol utilizing virtual circuits, sequence numbering, flow control, and positive acknowledgments.
- Three-Way Handshake (Virtual Circuit Setup):
  1. Initiating host sends a SYN segment requesting synchronization.
  2. Receiving host responds with a SYN/ACK segment synchronizing sequence numbers and acknowledging the initial request.
  3. Initiating host returns an ACK segment; virtual circuit is established and data transfer begins.
- TCP Header Architecture ( $20\text{–}24\,\text{bytes}$ ):
  - Source Port ( $16\,\text{bits}$ ): Originating application port ( $\ge 1024$ for dynamic source ports).
  - Destination Port ( $16\,\text{bits}$ ): Target well-known service port ( $0\text{–}1023$ defined in RFC $3232$ ).
  - Sequence Number ( $32\,\text{bits}$ ): Reconstructs segmented data streams into correct sequence.
  - Acknowledgment Number ( $32\,\text{bits}$ ): Specifies the next expected octet in the sequence.
  - Header Length / Data Offset ( $4\,\text{bits}$ ): Number of 32-bit words in the header ( $20\,\text{bytes} = 5$ words).
  - Reserved ( $6\,\text{bits}$ ): Set to zero.
  - Code Bits / Flags ( $6\,\text{bits}$ ): Control bits (URG, ACK, PSH, RST, SYN, FIN).
  - Window Size ( $16\,\text{bits}$ ): Quantity of unacknowledged data bytes the receiver will accept.
  - Checksum ( $16\,\text{bits}$ ): Cyclic Redundancy Check verifying entire header and payload.
  - Urgent Pointer ( $16\,\text{bits}$ ): Offset indicating where non-urgent data begins.
  - Options ( $0$ or multiples of $32\,\text{bits}$ ): Maximum Segment Size (MSS), padding.
- User Datagram Protocol (UDP):
- Scaled-down, connectionless, lightweight, unacknowledged, unsequenced protocol.
- UDP Header Architecture ( $8\,\text{bytes}$ total):
  - Source Port ( $16\,\text{bits}$ )
  - Destination Port ( $16\,\text{bits}$ )
  - Length ( $16\,\text{bits}$ ): Combined size of header and data
  - Checksum ( $16\,\text{bits}$ ): Verifies header and payload integrity
- Sockets and Session Multiplexing:
- A socket is defined by the unique combination of the Source IP address, Source Port, Destination IP address, and Destination Port.
- Session multiplexing enables a host with a single IP to run multiple concurrent application sessions separated by port numbers.
Internet Layer Protocols:
- Internet Protocol (IP):
- Connectionless best-effort delivery protocol managing logical network addressing and packet routing across internetworks.
- IPv4 Header Architecture ( $20\text{–}60\,\text{bytes}$ ):
  - Version ( $4\,\text{bits}$ ): Always $4$ (0100).
  - Header Length / HLEN ( $4\,\text{bits}$ ): Header length in 32-bit words ( $5$ words = $20\,\text{bytes}$ ).
  - Priority and Type of Service (ToS) ( $8\,\text{bits}$ ): Differentiated services, QoS classification.
  - Total Length ( $16\,\text{bits}$ ): Length of complete datagram (header + data).
  - Identification ( $16\,\text{bits}$ ): Unique ID linking fragmented packets.
  - Flags ( $3\,\text{bits}$ ): Fragment control (Don't Fragment [DF], More Fragments [MF]).
  - Fragment Offset ( $13\,\text{bits}$ ): Specifies relative location of fragment within original datagram.
  - Time To Live (TTL) ( $8\,\text{bits}$ ): Hop limit decremented by $1$ at each router hop; packet is discarded at $0$ to prevent routing loops.
  - Protocol ( $8\,\text{bits}$ ): Identifies encapsulated upper-layer protocol (ICMP = $1$ , IP-in-IP = $4$ , TCP = $6$ , UDP = $17$ , IPv6 = $41$ , GRE = $47$ , EIGRP = $88$ , OSPF = $89$ , L2TP = $115$ ).
  - Header Checksum ( $16\,\text{bits}$ ): Validates IPv4 header integrity only.
  - Source IP Address ( $32\,\text{bits}$ )
  - Destination IP Address ( $32\,\text{bits}$ )
  - Options & Padding
- Internet Control Message Protocol (ICMP):
- Messaging, control, and diagnostic protocol encapsulated directly in IP packets.
- Destination Unreachable: Transmitted when a router cannot deliver or route a packet.
- Time Exceeded: Transmitted when packet TTL expires to zero.
- Echo Request (Type 8) and Echo Reply (Type 0): Ping utilities validating layer 3 reachability.
- Traceroute: Utilizes incrementing TTL thresholds and ICMP Time Exceeded replies to identify the hop-by-hop layer 3 path across networks.
- Address Resolution Protocol (ARP):
- Resolves a known layer 3 IP address to an unknown layer 2 hardware MAC address within a local broadcast domain.
- Employs an ARP Request broadcast (FF:FF:FF:FF:FF:FF) and an ARP Reply unicast.
- Maintains mappings locally in an ARP cache table.

IPv4 Addressing, Subnetting, and Classless Inter-Domain Routing (CIDR)

IPv4 Address Formats and Network Classes:
- 32-bit structured hierarchical identifier composed of four 8-bit octets ( $4\,\text{bytes}$ ) expressed in dotted-decimal format.
- Total theoretical address space: $2^{32} = 4,294,967,296$ addresses.
- Class A:
- First byte range: $1\text{–}126$ (high-order bit fixed at $0$ ).
- Format: network.node.node.node.
- Default subnet mask: 255.0.0.0 (/ $8$ ).
- Available networks: $126$ ( $2^7 - 2$ ; network $0.0.0.0$ is reserved for default route; $127.0.0.0$ reserved for diagnostics/loopback).
- Available hosts per network: $2^{24} - 2 = 16,777,214$ .
- Class B:
- First byte range: $128\text{–}191$ (first bits fixed at $10_2$ ).
- Format: network.network.node.node.
- Default subnet mask: 255.255.0.0 (/ $16$ ).
- Available networks: $2^{14} = 16,384$ .
- Available hosts per network: $2^{16} - 2 = 65,534$ .
- Class C:
- First byte range: $192\text{–}223$ (first bits fixed at $110_2$ ).
- Format: network.network.network.node.
- Default subnet mask: 255.255.255.0 (/ $24$ ).
- Available networks: $2^{21} = 2,097,152$ .
- Available hosts per network: $2^8 - 2 = 254$ .
- Class D and E:
- Class D ( $224\text{–}239$ ): Multicast addressing (first bits $1110_2$ ).
- Class E ( $240\text{–}255$ ): Experimental/scientific reserve (first bits $1111_2$ ).
- Special Reserved IP Addresses:
- Network address of all zeros (0.0.0.0): Refers to "this network/segment" or default route.
- Network address of all ones (255.255.255.255): Local broadcast to all nodes on current segment.
- 127.0.0.1 through 127.255.255.254: Local diagnostic loopback tests.
- Node address of all zeros: Identifies the subnetwork address.
- Node address of all ones: Broadcast address for the specified subnetwork.
- RFC 1918 Private IP Address Allocations:
- Class A: 10.0.0.0 to 10.255.255.255 (10.0.0.0/8)
- Class B: 172.16.0.0 to 172.31.255.255 (172.16.0.0/12)
- Class C: 192.168.0.0 to 192.168.255.255 (192.168.0.0/16)
Subnetting Mechanics and Mathematical Equations:
- Subnetting borrows bits from the host field to expand the network ID field, creating smaller broadcast domains.
- The 5-Question Subnetting Matrix:
1. Subnets generated: $2^x$ ( $x = \text{borrowed masked 1-bits}$ ).
2. Usable hosts per subnet: $2^y - 2$ ( $y = \text{remaining unmasked 0-bits}$ ).
3. Block size (increment value): $256 - \text{decimal value of interesting octet}$ .
4. Valid subnets: Multiples of the block size starting from $0$ up to the mask value.
5. Broadcast address per subnet: Value immediately preceding the next subnet ( $\text{next subnet} - 1$ ).
6. Valid host range: Integers bounded strictly between the subnetwork address and the broadcast address.
- ip subnet-zero Command:
- Allows utilization of the first subnet (subnet $0$ ) and last subnet in IP network designs.
- Enabled by default starting with Cisco IOS version $12.0$ .
CIDR Notation and Block Size Conversions:
- / $25$ : Mask 255.255.255.128, Block size $128$ , $2$ subnets, $126$ hosts/subnet.
- / $26$ : Mask 255.255.255.192, Block size $64$ , $4$ subnets, $62$ hosts/subnet.
- / $27$ : Mask 255.255.255.224, Block size $32$ , $8$ subnets, $30$ hosts/subnet.
- / $28$ : Mask 255.255.255.240, Block size $16$ , $16$ subnets, $14$ hosts/subnet.
- / $29$ : Mask 255.255.255.248, Block size $8$ , $32$ subnets, $6$ hosts/subnet.
- / $30$ : Mask 255.255.255.252, Block size $4$ , $64$ subnets, $2$ hosts/subnet (dedicated to point-to-point links).

Variable Length Subnet Masks (VLSMs), Summarization, and IP Troubleshooting

Variable Length Subnet Mask (VLSM) Implementation:
- Classless routing capability that permits multiple, disparate subnet masks across segments within the same classful network space.
- Requires classless routing protocols that transmit prefix lengths/subnet masks with routing updates (RIPv2, EIGRP, OSPF).
- VLSM Design Rules:
- Determine the largest host requirements first.
- Assign the smallest appropriate block size (power of 2) that satisfies the host demand ( $\text{hosts} + 2$ ).
- Progress strictly in descending order of block sizes down to / $30$ point-to-point links to avoid overlapping address allocations.
Route Summarization (Supernetting / Route Aggregation):
- Consolidates multiple contiguous subnets into a single, summarized routing update.
- Decreases routing table size, minimizes router memory consumption, and accelerates CPU routing lookups.
- Computing Summary Boundaries:
1. Identify all networks to be summarized.
2. Determine the block size encompassing the range of interesting octets.
3. The network address of the summary is always the first subnetwork in the contiguous block.
4. The summary subnet mask is computed as $256 - \text{block size}$ in the interesting octet.
- Example: Networks 192.168.16.0/24 through 192.168.31.0/24 cover $16$ Class C networks. Block size = $16$ . Third octet mask = $256 - 16 = 240$ . Summary route = 192.168.16.0/20 (255.255.240.0).
Cisco Standardized IP Troubleshooting Methodology:
- Step 1: ping 127.0.0.1 — Validates internal host IP stack initialization.
- Step 2: ping <local-host-IP> — Validates host NIC and local protocol-to-driver bindings.
- Step 3: ping <default-gateway> — Validates local physical link, cabling, and communication across the local switch/LAN to the router interface.
- Step 4: ping <remote-destination-IP> — Validates end-to-end IP routing through intermediate routers to the remote network.
- If Steps 1–4 succeed but application access fails, verify Domain Name System (DNS) configurations, Access Control Lists (ACLs), and application server service states.
Diagnostic Utilities and Commands:
- ping: Employs ICMP echo requests and replies to verify network layer reachability.
- traceroute (Cisco) / tracert (Windows): Tracks hop-by-hop layer 3 path through TTL timeouts and ICMP Time Exceeded messages.
- arp -a (Windows) / show ip arp (Cisco): Displays IP-to-MAC address resolution mappings.
- ipconfig /all (Windows): Displays comprehensive local network interface, DHCP, and DNS configuration.

Cisco Internetworking Operating System (IOS) Operations and CLI Management

IOS Architectural Foundations:
- Cisco IOS functions as a proprietary multitasking network operating system kernel managing hardware interfaces, telecommunication protocols, routing, switching, and security functions.
- Programmed initially by William Yeager in 1986.

Cisco Catalyst 2960 Series SI Switch Front Panel

Accessing the Command-Line Interface (CLI):
- Methods: Console port (out-of-band), Auxiliary port (out-of-band modem), Telnet (in-band cleartext), SSH (in-band encrypted).
- CLI Operational Modes and Prompts:
- User EXEC Mode (Router>): Restricted monitoring and basic statistics viewing.
- Privileged EXEC Mode (Router#): Accessed via enable; permits configuration viewing, file management, debugging, and command execution.
- Global Configuration Mode (Router(config)#): Accessed via configure terminal (config t); commands apply globally to the system.
- Interface Configuration Mode (Router(config-if)#): Accessed via interface <type> <slot/port>; commands configure individual physical or logical interfaces.
- Line Configuration Mode (Router(config-line)#): Accessed via line <type> <number>; configures console, auxiliary, and virtual terminal (VTY) parameters.
- Routing Protocol Configuration Mode (Router(config-router)#): Configures routing protocol parameters.
- Setup Mode: Interactive guided configuration dialog executed automatically if no startup-config is found in NVRAM (aborted via Ctrl+C).
CLI Advanced Editing and Navigation Key Combinations:
- Ctrl+A: Moves cursor to the beginning of the command line.
- Ctrl+E: Moves cursor to the end of the command line.
- Ctrl+F: Moves cursor forward one character.
- Ctrl+B: Moves cursor backward one character.
- Esc+F: Moves cursor forward one word.
- Esc+B: Moves cursor backward one word.
- Ctrl+D / Backspace: Deletes a single character.
- Ctrl+U: Erases the entire line.
- Ctrl+W: Erases the word preceding the cursor.
- Ctrl+R: Redisplays the current line.
- Ctrl+Z: Immediately terminates configuration mode, returning to Privileged EXEC.
- Tab: Auto-completes a partially typed command string.
- Ctrl+P / Up Arrow: Recalls previous command history.
- Ctrl+N / Down Arrow: Recalls subsequent command history.
- Command line error marker (^): Pinpoints exact syntax error location.
- Command History: show history (displays last $20$ commands by default), terminal history size <lines> (adjusts buffer up to $256$ lines).
Administrative Configurations:
- Hostname: hostname <name> (locally significant, updates command prompt).
- Banners:
- Message of the Day (MOTD): banner motd <delimiting-char> <message> <delimiting-char> (displayed across all connections upon initial link).
- Login Banner: banner login <delimiting-char> (displayed after MOTD but before login prompts; disabled globally via no banner login).
- Exec Banner: banner exec <delimiting-char> (displayed upon establishing an active EXEC session).
- Passwords and Encryption:
- Privileged EXEC: enable secret <password> (uses MD5 hashing; supersedes enable password). enable password <password> (unencrypted cleartext).
- Console: line console 0, password <password>, login.
- VTY Lines: line vty 0 15 (switches) or line vty 0 4 (routers), password <password>, login.
- Auxiliary: line aux 0, password <password>, login.
- Global Password Encryption: service password-encryption (encrypts cleartext passwords using Cisco proprietary Type 7 reversible algorithm).
- CLI Usability Enhancements:
- exec-timeout <minutes> <seconds>: Configures inactivity logout delay (0 0 prevents timeout).
- logging synchronous: Prevents console unsolicited output from interrupting CLI command typing.
- description <text>: Assigns documentation strings to interfaces.
- do <command>: Allows execution of Privileged EXEC commands from within any configuration mode.
Configuring Secure Shell (SSH):
1. Set system hostname: hostname <name>
2. Set domain name: ip domain-name <domain>
3. Configure local authentication user: username <user> password <pass>
4. Generate RSA keys: crypto key generate rsa (minimum modulus $1024\,\text{bits}$ )
5. Specify protocol version: ip ssh version 2
6. Access VTY lines: line vty 0 15
7. Enable local database authentication: login local
8. Restrict access protocols: transport input ssh (or transport input ssh telnet)
Interface Configuration and Troubleshooting:
- Activation: no shutdown (interfaces are administratively down by default on routers; up by default on switches).
- IP Assignment: ip address <ip> <mask> (primary); ip address <ip> <mask> secondary.
- Serial Line Parameters:
- clock rate <bps>: Mandatory on DCE interface connections in lab back-to-back cabling (e.g., clock rate 1000000). Verified via show controllers <interface>.
- bandwidth <kbps>: Configures logical bandwidth used solely by routing metrics (OSPF, EIGRP); default serial bandwidth is $1544\,\text{Kbps}$ (T1).

Managing a Cisco Internetwork: Discovery Protocols, System Maintenance, and Logging

Cisco Device Internal Hardware Components:
- Bootstrap: Microcode in ROM initializing the router during hardware boot, launching POST and locating the IOS image.
- POST (Power-On Self-Test): Microcode in ROM testing processor, memory, and interface hardware.
- ROM Monitor (rommon): ROM microcode troubleshooting environment for disaster recovery and password reset.
- Mini-IOS (RXBOOT/Bootloader): Scaled-down IOS image stored in ROM to facilitate flashing new IOS images over the network.
- RAM: Dynamic operational memory storing the running configuration, active routing tables, ARP cache, and packet buffers.
- ROM: Read-only memory storing basic bootstrap, POST routines, and diagnostic monitors.
- Flash Memory: Electronically erasable programmable read-only memory (EEPROM) storing compressed Cisco IOS binary images; retains contents across reboots.
- NVRAM: Nonvolatile memory storing device configuration files (startup-config) and the software configuration register.
Configuration File Management:
- copy running-config startup-config (copy run start): Writes dynamic RAM configuration changes to permanent NVRAM storage.
- copy running-config tftp:: Exports RAM configuration to an external network TFTP server.
- copy tftp: running-config: Merges a remote configuration file from TFTP into active RAM (interfaces remain shut down until manually enabled).
- erase startup-config: Wipes configuration contents from NVRAM.
Dynamic Host Configuration Protocol (DHCP) Implementation:
- Server Configuration Steps:
1. Exclude static addresses: ip dhcp excluded-address <low-ip> <high-ip>
2. Define pool name: ip dhcp pool <name>
3. Set network subnet: network <net-id> <mask>
4. Define default gateway: default-router <ip>
5. Define DNS servers: dns-server <ip>
6. Configure lease duration: lease <days> <hours> <minutes>
7. (Optional) Option 66 TFTP boot server: option 66 ascii <fqdn>
- DHCP Relay:
- Routers drop DHCP client broadcast requests (port $67$ ) by default.
- ip helper-address <server-ip>: Configured on the client-facing router interface to forward UDP broadcasts (ports $37, 49, 53, 67, 68, 69, 137, 138$ ) as unicasts to the remote server.
- Verification Commands:
- show ip dhcp binding: Displays currently leased IP-to-MAC assignments.
- show ip dhcp pool: Details configured scope metrics and high watermarks.
- show ip dhcp conflict: Reports addresses removed from the pool due to detected duplicates.
System Logging (Syslog):
- Transmits asynchronous event alerts to console lines, internal memory buffers, terminal sessions, or centralized syslog servers (UDP port $514$ ).
- Severity Levels:
- Level 0: Emergency (emergencies) — System unusable
- Level 1: Alert (alerts) — Immediate action required
- Level 2: Critical (critical) — Critical condition
- Level 3: Error (errors) — Error condition
- Level 4: Warning (warnings) — Warning condition
- Level 5: Notification (notifications) — Normal but significant
- Level 6: Informational (informational) — Informational message
- Level 7: Debugging (debugging) — Debugging output
- Configuration Commands:
- logging <syslog-ip>: Directs log traps to an external server.
- logging trap <level>: Filters events sent to server by severity (logs specified level and all lower-numbered, higher-severity levels).
- service sequence-numbers: Appends incrementing sequence counters to log messages.
- service timestamps log datetime msec: Attaches millisecond-accurate timestamps.
- terminal monitor: Enables real-time log and debug messaging across Telnet/SSH VTY lines.
Network Time Protocol (NTP):
- Synchronizes system clocks against authoritative external stratum time references.
- Commands: ntp server <ip> version 4, ntp master [stratum], show ntp status, show ntp associations.
- Stratum values range from $1$ (atomic clocks) to $15$ ; $16$ designates unsynchronized/unusable status.
Device Discovery Protocols (CDP and LLDP):
- Cisco Discovery Protocol (CDP):
- Proprietary Data Link layer protocol collecting physical hardware and network data from directly connected Cisco neighbors.
- Timers: Transmission interval is $60\,\text{seconds}$ ; holdtime is $180\,\text{seconds}$ .
- Global control: cdp run / no cdp run. Interface control: cdp enable / no cdp enable.
- Commands: show cdp, show cdp neighbors, show cdp neighbors detail (reveals neighbor IP, software version, platform capabilities, native VLAN).
- Link Layer Discovery Protocol (LLDP):
- Vendor-neutral IEEE $802.1\text{AB}$ open discovery protocol.
- Global control: lldp run / no lldp run. Interface control: lldp transmit, lldp receive.

Managing Cisco Devices: Configuration Register, Image Management, and Licensing

Software Configuration Register Mechanics:
- 16-bit software register stored in NVRAM controlling boot sequences and device parameters (represented in hex, e.g., 0x2102).
- Bit Allocations:
- Bits 00–03 (Boot Field): 0x0 = Boots into ROM Monitor mode (rommon>); 0x1 = Boots mini-IOS image from ROM (Router(boot)>); 0x2–0xF = Examines NVRAM startup-config for boot system commands; defaults to loading the first valid IOS image in Flash.
- Bit 06 (0x0040): Ignores contents of NVRAM when set to 1 (used for password recovery).
- Bit 08 (0x0100): Disables console break key.
- Configuration command: config-register <value> (e.g., config-register 0x2102). Verified with show version.
Password Recovery Step-by-Step Procedure:
1. Connect a terminal to the console port ( $9600\,\text{baud}$ , 8 data bits, no parity, 1 stop bit).
2. Power cycle the router and execute a console break sequence (Ctrl+Break) during the first $60\,\text{seconds}$ of bootup to enter ROM Monitor mode (rommon 1>).
3. Adjust the configuration register to bypass NVRAM: confreg 0x2142.
4. Reset/reload the router: enter reset (or i).
5. Bypass the Initial Configuration Dialog (setup mode) by entering no or pressing Ctrl+C.
6. Enter Privileged EXEC mode: enable.
7. Load the startup configuration into RAM: copy startup-config running-config.
8. Ensure interfaces remain active: execute no shutdown across required interfaces.
9. Modify passwords: enable secret <new-password>.
10. Restore the standard configuration register value: config-register 0x2102.
11. Save the new configuration to NVRAM: copy running-config startup-config.
12. Reload the router: reload.
Cisco IOS Image Management:
- Verification: show flash (displays file names, lengths, and available storage bytes); show version (displays running IOS file name and active path).
- Backup to TFTP Server: copy flash: tftp: (requires source filename, remote TFTP IP, and destination filename).
- Restore/Upgrade from TFTP Server: copy tftp: flash: (checks available flash capacity; prompts to erase flash if space is insufficient).
- Automated fallback: boot system flash <filename>, boot system tftp <filename> <tftp-ip>, boot system rom.
- Emergency Disaster Recovery: In ROM Monitor, execute tftpdnld after manually defining variables: IP_ADDRESS, IP_SUBNET_MASK, DEFAULT_GATEWAY, TFTP_SERVER, TFTP_FILE.
- Cisco IOS File System (Cisco IFS): Supports directory manipulation via DOS/Unix-style syntax: dir, copy, more, delete, erase, format, cd, pwd, mkdir, rmdir.
Cisco IOS 15 Software Licensing:
- Replaces disparate individual software feature sets with a single unified Universal Image.
- Base Package: IP Base (pre-installed, default entry-level functionality).
- Optional Cross-Technology Packages: Data (MPLS, ATM), Unified Communications (VoIP, IP Telephony), and Security (Cisco IOS Firewall, IPS, IPsec, VPN).
- Unique Device Identifier (UDI): Composed of the Product ID (PID) and hardware Serial Number (SN); displayed via show license udi.
- Permanent Activation: Requires pairing a purchased Product Authorization Key (PAK) with the router's UDI on the Cisco License Registration Portal to generate a .lic license key file, installed via license install <url>.
- Right-To-Use (RTU) / Evaluation Licenses: Provides 60-day trial activations for technology packages; enabled via license boot module <model> technology-package <package-name>.
- Verification: show license, show license feature, show version.
- License Removal: Disable the technology package (license boot module <model> technology-package <pkg> disable), clear the license (license clear <pkg>), and reload.

IP Routing Fundamentals, Static Routing, and RIP

Routing Mechanics and Path Determination:
- Routing is the layer 3 process of forwarding packets from one subnetwork to another across an internetwork.
- Routers make forwarding decisions based strictly on the destination IP address parsed against the local routing table using the Longest Match Rule (the most specific route with the longest prefix length is selected).
- Frame Rewrite: As a packet is switched between router hops, layer 2 encapsulation headers (source/destination MAC addresses) are stripped and rewritten at each hop, while the inner layer 3 source and destination IP addresses remain unchanged (except for TTL decrements and NAT).
Internal Packet Switching Mechanisms:
- Process Switching: Legacy method where the router CPU evaluates every incoming packet individually against the full routing table; highest processor overhead.
- Fast Switching: Route-once, switch-many model; the first packet of a flow is process-switched, and the resulting forwarding decision and layer 2 header rewrite are saved to a cache for wire-speed forwarding of subsequent packets.
- Cisco Express Forwarding (CEF): Default topology-driven forwarding architecture; constructs a Forwarding Information Base (FIB) synchronized with the routing table and an Adjacency Table derived from the ARP cache; change-triggered rather than packet-triggered.
Administrative Distance (AD):
- Measure of route source trustworthiness ranging from $0$ to $255$ ( $0$ is most trusted; $255$ is rejected/unusable):
- Connected interface: $0$
- Static route: $1$
- External BGP: $20$
- EIGRP (internal): $90$
- OSPF: $110$
- RIP: $120$
- External EIGRP: $170$
- Internal BGP: $200$
- Unknown: $255$
Static Routing Configuration:
- Command syntax: ip route <destination-network> <mask> {next-hop-ip | exit-interface} [administrative-distance] [permanent]
- Next-Hop vs. Exit Interface:
- Using next-hop IP displays the route as via <next-hop-ip> with an AD of $1$ .
- Using an exit interface flags the static route as directly connected with an AD of $0$ .
- Floating Static Routes: Static routes configured with an administrative distance higher than dynamic routing protocols (e.g., AD $150$ ) to serve as a passive backup if dynamic paths fail.
- Default Routing (Gateway of Last Resort):
- Forwards packets with unknown destination addresses: ip route 0.0.0.0 0.0.0.0 {next-hop-ip | exit-interface}.
- Deployed on stub routers with a single exit path.
Routing Information Protocol (RIPv2):
- Distance-vector routing protocol utilizing hop count as its sole metric (maximum allowable hops = $15$ ; $16$ is considered unreachable).
- RIPv2 adds classless routing, VLSM support, route authentication, and multicasts updates to 224.0.0.9 every $30\,\text{seconds}$ .
- Configuration:
- Global activation: router rip
- Enable version 2: version 2
- Disable classful boundary auto-summarization: no auto-summary
- Advertise network: network <classful-network-id>
- Suppress update broadcasts: passive-interface <interface>
- Ingest and advertise default route: default-information originate

Layer 2 Switching Technologies and Port Security

Layer 2 Switch Operations:
- Operates at the Data Link layer, utilizing ASICs to evaluate incoming frame headers and forward traffic at wire speed with low latency.
- Three Core Switch Functions:
1. Address Learning: The switch inspects the source MAC address of every incoming frame and records the mapping against the receiving port in the MAC address table (CAM table).
2. Forward/Filter Decisions: The switch evaluates the destination MAC address against its CAM table. If known, the frame is forwarded out the designated port only. If unknown (or if the frame is a broadcast/multicast), the frame is flooded out all ports within the source VLAN except the arrival port.
3. Loop Avoidance: Executes Spanning Tree Protocol to eliminate layer 2 network loops on redundant physical topologies.

Cisco Catalyst 3560 Series PoE-12 Switch

Switch Port Security Configuration and Enforcement:
- Constrains port access to authorized MAC addresses, preventing unauthorized MAC flooding and bridge table attacks.
- Prerequisite: The switch port must be explicitly configured as an access or trunk port (switchport mode access).
- Core Commands:
- Enable port security: switchport port-security
- Maximum MAC threshold: switchport port-security maximum <1-8192> (default is 1)
- Static MAC assignment: switchport port-security mac-address <mac-address>
- Dynamic sticky learning: switchport port-security mac-address sticky (converts dynamically learned MAC addresses into static entries saved in running-config)
- Security Violation Modes:
- shutdown (Default): The port is placed into an err-disabled (Secure-shutdown) state, turning the physical LED amber; shuts down traffic immediately, generates a syslog message, increments the violation counter, and sends an SNMP trap. Recovery requires executing shutdown followed by no shutdown.
- restrict: Drops packets with unauthorized source MAC addresses, generates a syslog log entry, increments the violation counter, and transmits an SNMP trap; keeps the port operational for authorized frames.
- protect: Drops packets with unauthorized source MAC addresses without generating logs or SNMP traps; the port remains operational.
- Verification: show port-security, show port-security interface <interface>, show mac address-table.

Virtual LANs (VLANs), Trunking, and Inter-VLAN Routing

VLAN Architecture and Concepts:
- A VLAN is a logical grouping of switch ports forming an isolated broadcast domain within a layer 2 switch fabric.
- Extends broadcast control, simplifies network adds/moves/changes, and enforces administrative security boundaries.
- Ranges: Normal range ( $1\text{–}1005$ ; VLAN 1 is default, native, and cannot be deleted; $1002\text{–}1005$ are reserved for Token Ring/FDDI); Extended range ( $1006\text{–}4094$ , requires VTP transparent mode).
Switch Port Membership Modes:
- Access Port: Belongs to and carries traffic for a single VLAN. Untagged native frames only.
- Configuration: switchport mode access, switchport access vlan <vlan-id>.
- Voice Access Port: Carries both standard data traffic (native access VLAN) and VoIP packets over an auxiliary voice VLAN across a single physical port connecting an IP phone.
- Configuration: switchport voice vlan <vlan-id>.
- Trunk Port: High-speed point-to-point link carrying traffic across multiple VLANs concurrently.
VLAN Trunking Protocols and Frame Tagging:
- IEEE 802.1Q: Open standard; inserts a 4-byte ( $32\,\text{bit}$ ) tag into the original Ethernet frame header. Includes a 12-bit VLAN Identifier (VID), supporting up to $4094$ VLANs ( $2^{12} - 2$ ). Supports a Native VLAN (VLAN 1 default), which transmits and receives untagged traffic. Mismatched native VLANs across a trunk generate CDP error alerts (%CDP-4-NATIVE_VLAN_MISMATCH).
- Inter-Switch Link (ISL): Cisco proprietary; encapsulates the entire original Ethernet frame with a 26-byte header and a 4-byte CRC/FCS trailer ( $30\,\text{bytes}$ overhead); does not support a native untagged VLAN.
- Dynamic Trunking Protocol (DTP): Cisco proprietary link negotiation protocol.
- Modes: switchport mode trunk (permanent trunk), switchport mode dynamic desirable (actively initiates trunking), switchport mode dynamic auto (passively waits for neighbor initiation; two connected auto ports will not trunk), switchport nonegotiate (disables DTP negotiation).
- VLAN Trunking Protocol (VTP):
- Synchronizes VLAN additions, deletions, and renamings across an administrative VTP domain.
- Modes: Server (creates/modifies/deletes VLANs, saves to NVRAM, default), Client (receives/forwards updates, cannot alter VLANs, stored in volatile RAM), Transparent (does not synchronize with domain, forwards advertisements, maintains local independent database in NVRAM).
- Requirements: Domain name, version (v1 or v2), and optional password must match exactly.
- VTP Pruning: Eliminates unnecessary flooded broadcast/multicast traffic across trunks to switches lacking member ports (normal VLANs $2\text{–}1001$ eligible; VLAN 1 cannot be pruned).
Inter-VLAN Routing (IVR):
- Router on a Stick (ROAS):
- Connects a single physical router interface to a switch trunk port.
- Employs logical subinterfaces: interface FastEthernet 0/0.<subif>.
- Binds subinterface to 802.1Q tag: encapsulation dot1q <vlan-id> [native].
- Assigns subnet IP address functioning as the default gateway for that VLAN.
- Switched Virtual Interfaces (SVIs) / Layer 3 Multilayer Switching:
- Internal routed interfaces on a multilayer switch (e.g., Catalyst 3560).
- Global command: ip routing.
- Interface configuration: interface vlan <vlan-id>, ip address <ip> <mask>, no shutdown.

Network Security: Access Control Lists (ACLs)

Access Control List Operations:
- Packet-filtering sequential if-then decision lists evaluated by the router CPU.
- Processing Rules:
1. Compared sequentially line-by-line starting at line 1.
2. Processing terminates immediately upon the first condition match; subsequent lines are ignored.
3. An invisible, implicit deny any terminates every access list; packets matching no specific statement are dropped.
- Directionality: Inbound ACLs filter packets prior to routing decisions; Outbound ACLs filter packets after routing lookups but before queueing.
- Rule of thumb: Limit to one ACL per interface, per direction, per protocol.
Wildcard Masking Calculations:
- Inverted mask format where binary $0$ checks the bit value for an exact match and binary $1$ ignores the bit value.
- The wildcard value equals the block size minus $1$ in the interesting octet.
- Examples:
- Host check: 172.16.30.5 0.0.0.0 (abbreviated via host 172.16.30.5).
- Class C subnet (/ $24$ ): 172.16.30.0 0.0.0.255.
- Block size of $16$ (/ $28$ ): 0.0.0.15.
- Block size of $32$ (/ $27$ ): 0.0.0.31.
- All addresses match: 0.0.0.0 255.255.255.255 (abbreviated via any).
Standard IP Access Lists:
- Number ranges: $1\text{–}99$ and expanded $1300\text{–}1999$ .
- Evaluates source IP addresses exclusively; permits or denies entire protocol suites.
- Placement guideline: Locate as close to the destination as possible.
- Application to interfaces: ip access-group <number> {in | out}.
- Controlling VTY Access: Restricts Telnet/SSH access without evaluating every packet at physical interfaces: line vty 0 4, access-class <number> in.
Extended IP Access Lists:
- Number ranges: $100\text{–}199$ and expanded $2000\text{–}2699$ .
- Evaluates source IP, destination IP, protocol field (IP, TCP, UDP, ICMP), and layer 4 port numbers.
- Placement guideline: Locate as close to the source as possible.
- Operators: eq (equal), neq (not equal), gt (greater than), lt (less than), range.
- Syntax: access-list <100-199> {permit | deny} <protocol> <source> <source-wildcard> [operator port] <destination> <destination-wildcard> [operator port] [log].
Named Access Lists:
- Syntax: ip access-list {standard | extended} <name>.
- Allows individual line insertion and deletion via sequence numbering (e.g., 10 deny tcp host ...).
- Remarks: remark <comment> adds documentation entries.
- Verification: show access-lists, show ip access-list, show ip interface.

Network Address Translation (NAT) and Port Address Translation (PAT)

NAT Terminologies and Definitions:
- Inside Local: Private IPv4 address assigned to a host on the internal network.
- Inside Global: Registered public IPv4 address representing the inside host to the external Internet.
- Outside Local: Outside destination host address as perceived by the inside network.
- Outside Global: Registered public IPv4 address allocated to an external host by its owner.
NAT Flavors and Operational Modes:
- Static NAT: One-to-one permanent mapping of an inside local address to an inside global address (e.g., public web servers).
- Dynamic NAT: Many-to-many dynamic mapping allocating an address from an authorized pool of registered public global addresses.
- Port Address Translation (PAT) / NAT Overload: Many-to-one mapping multiplexing thousands of inside local private addresses to a single (or few) inside global public IP address using unique layer 4 source port numbers ( $\approx 65,000$ connections per IP).
Cisco IOS NAT Configurations:
- Interface Designation: ip nat inside (private network), ip nat outside (public Internet).
- Static NAT Configuration:
- ip nat inside source static <inside-local-ip> <inside-global-ip>
- Dynamic NAT Configuration:
- ip nat pool <pool-name> <start-ip> <end-ip> netmask <mask>
- access-list <acl> permit <network> <wildcard>
- ip nat inside source list <acl> pool <pool-name>
- PAT (Overload) Configuration:
- Overloading a pool: ip nat inside source list <acl> pool <pool-name> overload
- Overloading an interface: ip nat inside source list <acl> interface <interface> overload
- Troubleshooting and Verification:
- show ip nat translations: Displays active translations.
- show ip nat statistics: Displays pool metrics, translation counters, and active mappings.
- clear ip nat translation *: Purges dynamic mappings from the NAT table.
- debug ip nat: Real-time packet translation logs (asterisk * denotes fast-switched translations).

Internet Protocol Version 6 (IPv6) Architecture and Routing

IPv6 Architectural Framework:
- 128-bit address space ( $3.4 \times 10^{38}$ addresses), resolving IPv4 depletion.
- Formatted as eight 16-bit blocks separated by colons in hexadecimal notation (2001:0db8:3c4d:0012:0000:0000:1234:56ab).
- Shortening conventions:
- Omit leading zeros in any 16-bit quartet (0012 becomes 12).
- Replace consecutive all-zero quartets once per address with double colons (::).
IPv6 Address Types:
- Global Unicast (2000::/3): Globally routable public addresses.
- Link-Local (FE80::/10): Non-routable local-link communication addresses (first 10 bits 1111 1110 10).
- Unique Local (FC00::/7): Private site-specific routable addresses replacing site-local (FEC0::/10, deprecated).
- Multicast (FF00::/8): One-to-many communication; replaces all IPv4 broadcast traffic.
- Anycast: One-to-nearest address assigned to multiple interfaces; packets route to the closest device topologically.
- Special Addresses: :: (unspecified), ::1 (loopback equivalent to 127.0.0.1), 2002::/16 (6-to-4 tunneling).
Stateless Autoconfiguration and Modified EUI-64:
- Combines the 64-bit network prefix with an automatically generated 64-bit Interface ID derived from the 48-bit MAC address.
- Insertion: Inserts FFFE in the exact middle of the MAC address (between the 3rd and 4th bytes).
- U/L Bit Inversion: The 7th bit of the first byte (Universal/Local bit) is inverted ( $0$ becomes $1$ ).
- Example: MAC 0060.d673.1987 becomes Interface ID 0260:d6FF:FE73:1987.
ICMPv6 and Neighbor Discovery Protocol (NDP):
- Integrated protocol replacing IPv4 ARP, IGMP, and ICMP.
- Type 133: Router Solicitation (RS), multicast to FF02::2 (All-Routers).
- Type 134: Router Advertisement (RA), multicast to FF02::1 (All-Nodes) carrying the 64-bit prefix.
- Type 135: Neighbor Solicitation (NS), requests MAC addresses or performs Duplicate Address Detection (DAD).
- Type 136: Neighbor Advertisement (NA), returns local MAC bindings.
- Solicited-Node Multicast: FF02::1:FFxx:xxxx mapped to Ethernet multicast MAC 33:33:xx:xx:xx:xx.
IPv6 Routing and Interface Configuration:
- Global routing activation: ipv6 unicast-routing
- Interface assignment: ipv6 address <ipv6-prefix>/<prefix-length> [eui-64]
- Auto-configuration: ipv6 address autoconfig [default] (the default parameter injects a default route from RA announcements).
- Static Routing: ipv6 route <prefix>/<length> {next-hop-ip | exit-interface}. Default route: ipv6 route ::/0 <next-hop | exit-int>.
- Verification: show ipv6 route, show ipv6 interface brief, show ipv6 neighbors.

Enhanced Switched Technologies: Spanning Tree Protocol (STP), RSTP, and EtherChannel

Spanning Tree Protocol (IEEE 802.1D):
- Loop-avoidance mechanism operating across layer 2 switched meshes to block redundant paths and prevent broadcast storms, multiple frame copies, and MAC table thrashing.
- Bridge ID (BID):
- 8 bytes total.
- CST / 802.1D: 2-byte Priority ( $0\text{–}65,535$ , default $32,768$ ) + 6-byte MAC address.
- PVST+: 4-bit Priority (increments of $4096$ ) + 12-bit Extended System ID (carrying the VLAN ID) + 6-byte MAC address.
- Root Bridge Selection:
- The bridge with the lowest Bridge ID wins the election.
- If priorities match, the lowest numerical MAC address breaks the tie.
- STP Link Port Costs (IEEE Standard):
- $10\,\text{Mbps} = 100$
- $100\,\text{Mbps} = 19$
- $1000\,\text{Mbps} (1\,\text{Gbps}) = 4$
- $10\,\text{Gbps} = 2$
- STP Port Roles:
- Root Port (RP): One per non-root switch; lowest accumulated path cost to the root bridge.
- Designated Port (DP): One per physical segment; lowest path cost back to root; always in forwarding mode on the root bridge.
- Non-Designated / Blocked Port: Redundant link in blocking/discarding mode to break loops.
- 802.1D Port States and Timers:
- Blocking ( $20\,\text{seconds}$ Max Age): Discards frames, listens to BPDUs.
- Listening ( $15\,\text{seconds}$ Forward Delay): Evaluates BPDUs, no MAC learning, no frame forwarding.
- Learning ( $15\,\text{seconds}$ Forward Delay): Populates MAC address table, no frame forwarding.
- Forwarding: Normal data frame forwarding and MAC learning.
- Disabled: Administratively down.
- Total standard convergence duration: $50\,\text{seconds}$ .
Rapid Spanning Tree Protocol (RSTP / IEEE 802.1w):
- Proactive convergence protocol eliminating legacy delay timers.
- States: Discarding (merges Disabled, Blocking, Listening), Learning, and Forwarding.
- Roles: Root, Designated, Alternate (backup for root port), and Backup (backup for designated port).
- Cisco Implementation: Rapid PVST+ (spanning-tree mode rapid-pvst), running an independent 802.1w instance per VLAN.
Cisco STP Enhancements:
- PortFast: Configured on access ports connected to end-user workstations or servers (spanning-tree portfast); transitions immediately from blocking to forwarding state, bypassing listening/learning.
- BPDU Guard: Protection tool paired with PortFast (spanning-tree bpduguard enable); places an access port immediately into err-disabled status if an incoming BPDU is detected, preventing rogue switch attachments.
- Root Bridge Manipulation: spanning-tree vlan <vlan> root primary (sets priority to $24,576$ or lower), spanning-tree vlan <vlan> root secondary (sets priority to $28,672$ ), or spanning-tree vlan <vlan> priority <value> (increments of $4096$ ).
EtherChannel Link Bundling (PAgP and LACP):
- Aggregates between two and eight Fast Ethernet, Gigabit, or 10-Gigabit ports into a single logical channel, multiplying bandwidth and providing link redundancy without STP port blocking.
- All bundled ports must match speed, duplex, trunking encapsulation, and allowed VLAN parameters.
- Port Aggregation Protocol (PAgP) (Cisco Proprietary):
- auto: Passively waits for neighbor initiation.
- desirable: Actively negotiates bundle formation.
- Link Aggregation Control Protocol (LACP) (IEEE 802.3ad):
- passive: Passively responds to LACP frames.
- active: Actively initiates LACP negotiation.
- on: Forces unconditional EtherChannel aggregation without negotiation protocols.
- Layer 3 EtherChannel: Configured on interface port-channel <num> with no switchport and an IP address assigned directly to the logical port channel.

Network Device Management, First Hop Redundancy Protocols (HSRP), and SNMP

Mitigating Access Layer Threats:
- DHCP Snooping: Layer 2 security mechanism filtering untrusted DHCP messages; classifies switch ports as trusted (uplinks, DHCP servers) or untrusted (hosts); builds a DHCP Snooping Binding Database tracking client MAC, IP, lease, VLAN, and port assignments.
- Dynamic ARP Inspection (DAI): Intercepts and validates all ARP packets on untrusted ports against the DHCP Snooping Binding Database to protect against ARP cache poisoning and man-in-the-middle exploits.
- IEEE 802.1X: Port-based identity authentication architecture comprising three elements: Supplicant (client software), Authenticator (switch/access point controlling access), and Authentication Server (central RADIUS server).
External Authentication Services (AAA):
- Centralizes authentication, authorization, and accounting across network devices via aaa new-model.
- TACACS+ (Terminal Access Controller Access-Control System+):
- Cisco proprietary protocol using TCP port $49$ .
- Separates authentication, authorization, and accounting functions into independent modular services.
- Encrypts the entire packet body (everything past the standard header).
- RADIUS (Remote Authentication Dial-In User Service):
- Open IETF standard protocol using UDP ports $1812/1813$ or $1645/1646$ .
- Combines authentication and authorization into a unified exchange; accounting is handled separately.
- Encrypts only the password field within the access-request packet; all other payload fields remain cleartext.
Simple Network Management Protocol (SNMP):
- Application layer protocol facilitating device health monitoring via an NMS polling device agents and receiving event traps.
- Operations: GET, SET, WALK, TRAP (unsolicited asynchronous alert, unacknowledged), and INFORM (asynchronous alert requiring acknowledgment).
- Version Comparisons:
- SNMPv1: Plaintext community strings, UDP only.
- SNMPv2c: Plaintext community strings, introduces GETBULK (retrieving large data sets in a single request) and INFORM alerts.
- SNMPv3: Cryptographic security featuring SHA/MD5 packet authentication and DES/AES payload encryption; supports message integrity.
- Configuration: snmp-server host <ip> <community>, snmp-server community <string> {ro | rw} [acl].
First Hop Redundancy Protocols (FHRPs) and HSRP:
- Presents a redundant collection of physical routers as a single logical virtual gateway with a shared virtual IP and virtual MAC address.
- Hot Standby Router Protocol (HSRP) (Cisco Proprietary):
- Roles: One Active router (forwards traffic addressed to virtual router), one Standby router (monitors Active router via Hellos; assumes forwarding if Active fails), and Listen routers.
- Virtual MAC Address Architecture:
  - First 24 bits: 0000.0c (Cisco vendor OUI).
  - Next 16 bits: 07.ac (Well-known HSRP identifier).
  - Final 8 bits: Hexadecimal HSRP group number (e.g., Group 10 = 0a, yielding 0000.0c07.ac0a).
- Timers: Hello timer ( $3\,\text{seconds}$ default, multicasts to 224.0.0.2 in v1, 224.0.0.102 in v2; UDP port $1985$ ); Hold timer ( $10\,\text{seconds}$ default, three times Hello timer).
- Election & Preemption:
  - Highest priority wins (default priority is $100$ , range $0\text{–}255$ ). Highest IP breaks ties.
  - standby <group> preempt: Forces a newly recovered router with higher priority to immediately reclaim the Active role.
- Interface Tracking: Monitors upstream interfaces; decrements local priority by a specified value if a monitored interface fails (standby <group> track <int> <decrement>), allowing the standby router to preempt.

Enhanced Interior Gateway Routing Protocol (EIGRP and EIGRPv6)

EIGRP Architecture and Operation:
- Advanced distance-vector / hybrid routing protocol developed by Cisco.
- Converges rapidly via Diffusing Update Algorithm (DUAL), tracking loop-free primary and backup paths.
- Communicates via Reliable Transport Protocol (RTP) using multicast IP 224.0.0.10 or unicast.
- Transmits bounded, partial updates only upon topology changes; no periodic full table broadcasts.
- Packet Types: Hello (neighbor discovery/keepalive, unreliable), Acknowledgment (ACK) (unreliable unicast verifying receipt), Update (reliable route data), Query (reliable multicast requesting route data), and Reply (reliable unicast response to query).
Internal Tables Stored in RAM:
- Neighbor Table: Tracks adjacent EIGRP peers; displays Smooth Round-Trip Time (SRTT), Retransmission Timeout (RTO), hold time, and queue counters (show ip eigrp neighbors).
- Topology Table: Houses all destination networks advertised by neighbors; contains Successors and Feasible Successors (show ip eigrp topology).
- Routing Table: Contains only the primary, lowest-cost Successor routes (show ip route eigrp).
DUAL Terminology and Metrics:
- Feasible Distance (FD): The lowest calculated metric from the local router along the path to the destination network.
- Reported Distance (RD) / Advertised Distance (AD): The path metric to the destination network as reported by the neighboring router.
- Successor: The primary route with the lowest FD, installed in the routing table.
- Feasible Successor (FS): A backup route maintained in the topology table; must satisfy the Feasibility Condition: $\text{Reported Distance (RD)} < \text{Feasible Distance (FD of current Successor)}$ If the Successor fails, the Feasible Successor immediately promotes to the routing table without recalculating DUAL.
- Composite Metric Formula: $\text{Metric} = 256 \times \left[ K_1 \times \text{Bandwidth} + \frac{K_2 \times \text{Bandwidth}}{256 - \text{Load}} + K_3 \times \text{Delay} \right] \times \left[ \frac{K_5}{\text{Reliability} + K_4} \right]$
- Defaults: $K_1 = 1$ , $K_2 = 0$ , $K_3 = 1$ , $K_4 = 0$ , $K_5 = 0$ .
- Default Operational Metric Equation: $\text{Metric} = 256 \times \left( \frac{10^7}{\text{Least Bandwidth in Kbps}} + \frac{\sum \text{Delay in } \mu\text{s}}{10} \right)$
Advanced Features and Unequal-Cost Load Balancing:
- Supports up to $4$ equal-cost paths by default (up to $32$ paths in IOS 15.0 via maximum-paths).
- Unequal-Cost Load Balancing: Configured via variance <multiplier> ( $1\text{–}128$ ); installs Feasible Successor paths whose FD is less than the multiplier times the Successor's FD: $\text{FD of FS} < \text{Variance} \times \text{FD of Successor}$
- Split Horizon: Prohibits advertising routes out the same interface on which they were learned; disabled via no ip split-horizon eigrp <as>.
EIGRPv6 Differences and Configuration:
- IPv6 transport: Advertises IPv6 prefixes, multicasts to FF02::A, communicates via interface link-local addresses.
- Operates without the network command; activated directly within interface configuration mode.
- Configuration requires a 32-bit dotted-decimal Router ID (RID): ipv6 unicast-routing ipv6 router eigrp <as> router-id <32-bit-id> no shutdown interface <interface> ipv6 eigrp <as>

Single-Area and Multi-Area Open Shortest Path First (OSPFv2 and OSPFv3)

OSPF Architectural Foundations:
- Open standard link-state routing protocol executing the Dijkstra Shortest Path First (SPF) algorithm.
- Path Cost Metric: Based on bandwidth ( $\text{Cost} = 10^8 / \text{Bandwidth in bps}$ ). Fast Ethernet and higher default to cost $1$ . Reference bandwidth can be adjusted via auto-cost reference-bandwidth <Mbps>.
- Administrative Distance: $110$ .
- Router ID (RID): Unique 32-bit identifier selected as follows: 1) Manually assigned router-id; 2) Highest IP address on any active loopback interface; 3) Highest IP address on any active physical interface.
OSPF Network Topologies and Roles:
- Broadcast Multi-Access (Ethernet): Elects a Designated Router (DR) and Backup Designated Router (BDR) to minimize adjacencies ( $N(N-1)/2$ reduced to adjacent with DR/BDR only). Routers send LSAs to 224.0.0.6 (AllDRouters); DR floods updates to 224.0.0.5 (AllSPFRouters).
- Point-to-Point (Serial): No DR/BDR elected; forms full adjacency directly; multicasts to 224.0.0.5.
- DR/BDR Election Rules:
- Highest interface priority wins (default priority is $1$ , range $0\text{–}255$ ; priority $0$ never participates in elections).
- Highest Router ID (RID) breaks ties. Non-preemptive: existing DR/BDR remain active until reboot or process restart.
OSPF Neighbor Adjacency States:
1. Down: No Hello packets received.
2. Attempt: Used on NBMA networks where neighbors are statically configured.
3. Init: Hello packet received from neighbor, but local RID is not yet in the neighbor's Hello packet.
4. 2-Way: Bidirectional communication established; local RID present in neighbor's Hello. DR/BDR election occurs on multi-access links.
5. ExStart: Negotiation of master/slave relationship and initial sequence numbers for Database Description (DBD) exchange (highest RID becomes master).
6. Exchange: Routers exchange DBD packets containing LSA headers.
7. Loading: Routers exchange Link-State Requests (LSRs) and Link-State Updates (LSUs) to populate missing topology data.
8. Full: Complete synchronization of link-state databases achieved between adjacent neighbors.
- Neighbors fail to establish adjacencies if the following variables do not match: Area ID, Subnet/mask, Hello and Dead intervals, Area flags (stub), and Authentication keys.
Multi-Area Architecture and Link-State Advertisements (LSAs):
- Area Hierarchy: Backbone Area 0 (0.0.0.0); all non-backbone areas must physically attach to Area 0 to prevent inter-area routing loops.
- Router Classifications:
- Internal Router: All interfaces reside within a single area.
- Backbone Router: Has at least one interface attached to Area 0.
- Area Border Router (ABR): Interfaces span Area 0 and one or more non-backbone areas; maintains independent link-state databases per area.
- Autonomous System Boundary Router (ASBR): Has at least one interface connecting to an external autonomous system or foreign routing process.
- LSA Types:
- Type 1 (Router LSA): Flooded by every router within its local area; lists local links, states, and interface costs.
- Type 2 (Network LSA): Flooded by the DR within its local multi-access area; lists all adjacent routers on the segment.
- Type 3 (Summary LSA): Generated by ABRs; floods inter-area network reachability into other areas.
- Type 4 (ASBR Summary LSA): Generated by ABRs; advertises the location and cost to reach an external ASBR.
- Type 5 (AS External LSA): Generated by ASBRs; flooded globally to advertise external routes redistributed into OSPF.
OSPFv3 Configuration (IPv6):
- Enables link-state routing directly across IPv6 interfaces; uses multicast FF02::5 and FF02::6.
- Configured on interfaces rather than under the router process: ipv6 router ospf <process-id> router-id <32-bit-id> interface <interface> ipv6 ospf <process-id> area <area-id>

Comprehensive Network Troubleshooting Methodologies and Tools

Layer 2 and Physical Troubleshooting:
- Cable/Duplex Mismatches: Indicated by incrementing late collision counters, alignment errors, and framing errors; causes packet loss, latency, and intermittent connection degradation.
- Excessive input drops, ignored frames, and no-buffer errors indicate broadcast storms or switch/router buffer exhaustion.
- Native VLAN Mismatch: Indicated by %CDP-4-NATIVE_VLAN_MISMATCH; unblocks native ports via 802.1Q but drops untagged management frames.
IP Service Level Agreements (IP SLA):
- Synthesizes and measures active network performance metrics (latency, jitter, packet loss, MOS scores, round-trip times).
- ICMP Echo Configuration Workflow: ip sla 1 icmp-echo 172.16.20.254 frequency 10 ip sla schedule 1 life forever start-time now     
- Verification: show ip sla configuration, show ip sla statistics.
Switched Port Analyzer (SPAN / Port Mirroring):
- Overcomes layer 2 unicast filtering limitations by copying ingress and/or egress traffic from source interfaces or VLANs to a designated destination port attached to a network sniffer.
- Local SPAN Configuration Workflow: monitor session 1 source interface FastEthernet 0/1 [rx | tx | both] monitor session 1 destination interface FastEthernet 0/2     
- Verification: show monitor.
IPv6 Extended ACL Troubleshooting:
- Evaluates source IPv6, destination IPv6, protocol headers, and layer 4 ports.
- Always named: ipv6 access-list <name>.
- Applied to interfaces via: ipv6 traffic-filter <name> {in | out} (unlike IPv4's ip access-group).
- Implicit Entries: Unlike IPv4, IPv6 ACLs include two invisible leading permit rules prior to the final implicit deny:
- permit icmp any any nd-na
- permit icmp any any nd-ns
- deny ipv6 any any These permit statements ensure that Neighbor Discovery Protocol (NDP) operations continue unobstructed.

Wide Area Networks (WANs), Serial Connections, and External BGP (eBGP)

WAN Concepts and Terminology:
- Customer Premises Equipment (CPE): Terminating hardware located physically at the subscriber facility.
- Demarcation Point (Demarc): Precise interface boundary separating telco responsibility from subscriber premises equipment.
- Local Loop: Physical access wiring bridging the demarc to the provider Central Office (CO/POP).
- Data Terminal Equipment (DTE): Customer device sourcing or sinking digital data (routers).
- Data Communication Equipment (DCE): Provider-side hardware providing clocking synchronization and line conversion (CSU/DSU).
- WAN Bandwidth Hierarchy:
- DS0: $64\,\text{Kbps}$
- T1 (DS1): $1.544\,\text{Mbps}$ ( $24\,\text{DS0s}$ , US standard)
- E1: $2.048\,\text{Mbps}$ ( $30\,\text{DS0s}$ , European standard)
- T3 (DS3): $44.736\,\text{Mbps}$ ( $28\,\text{DS1s}$ / $672\,\text{DS0s}$ )
- OC-3: $155.52\,\text{Mbps}$
- OC-12: $622.08\,\text{Mbps}$
- OC-48: $2488.32\,\text{Mbps}$
- OC-192: $9953.28\,\text{Mbps}$
Point-to-Point Protocol (PPP):
- Industry-standard Data Link layer protocol providing multiprotocol encapsulation over synchronous and asynchronous serial connections.
- Architecture:
- High-Level Data Link Control (HDLC): Bit-oriented synchronous framing.
- Link Control Protocol (LCP): Establishes, configures, tests, and terminates link connections; negotiates authentication, compression, error detection, and multilink.
- Network Control Protocol (NCP): Establishes and negotiates specific layer 3 routed protocol services (e.g., IPCP for IP, CDPCP for CDP).
- Authentication Protocols:
- PAP (Password Authentication Protocol): Basic, two-way handshake; transmits usernames and passwords in cleartext.
- CHAP (Challenge Handshake Authentication Protocol): Secure, three-way challenge-response handshake; computes a one-way MD5 hash over shared secrets; periodic re-authentication.
- Multilink PPP (MLP): Bundles multiple physical serial links into a unified logical channel (interface Multilink1), load balancing fragmented packets across paths to minimize WAN latency.
- Point-to-Point Protocol over Ethernet (PPPoE): Encapsulates PPP frames inside Ethernet frames over ADSL deployments; configured using a virtual dialer interface (interface Dialer1, ip address negotiated, encapsulation ppp, dialer pool 1) bound to an Ethernet interface via pppoe-client dial-pool-number 1.
Virtual Private Networks (VPNs) and GRE Tunnels:
- VPN Classifications:
- Enterprise-Managed: Remote-access VPNs (Cisco AnyConnect, SSL), Site-to-site VPNs (IPsec), Extranet VPNs.
- Provider-Managed: Layer 2 MPLS VPNs (Virtual Private Wire Service [VPWS] / Ethernet over MPLS; Virtual Private LAN Service [VPLS]); Layer 3 MPLS VPNs.
- Generic Routing Encapsulation (GRE):
- Cisco-developed tunneling protocol capable of encapsulating arbitrary passenger layer 3 protocols inside an IP transport carrier.
- Stateless, unencrypted, no native flow control; appends a 24-byte overhead ( $20\,\text{byte}$ IP header + $4\,\text{byte}$ GRE header).
- Binds with IPsec (GRE over IPsec) to secure dynamic routing protocols (OSPF, EIGRP) and multicast traffic over public backbones.
- Configuration: interface Tunnel0 ip address 192.168.10.1 255.255.255.0 tunnel source <source-ip> tunnel destination <destination-ip> tunnel mode gre ip       
- Recursive Routing Failure: %TUN-5-RECURDOWN occurs when a router learns the path to the tunnel destination address through the tunnel interface itself, causing the interface to flap.
External Border Gateway Protocol (eBGP):
- Path-vector routing protocol operating between different autonomous systems; powers global Internet routing.
- Uses TCP port $179$ ; neighbors (peers) must be explicitly statically configured.
- Loop Avoidance: Enforces the AS-Path attribute; an autonomous system discards any route advertisement containing its own AS number within the path list.
- Configuration Workflow: router bgp <local-as> neighbor <peer-ip> remote-as <remote-as> network <network-id> mask <subnet-mask>     
Note: The BGP network command requires an exact match with a prefix existing in the active routing table to inject the route into the BGP table.
Verification: show ip bgp summary, show ip bgp, show ip bgp neighbors (displays keepalive and hold time intervals; default hold time is $180\,\text{seconds}$ , keepalive is $60\,\text{seconds}$ ).

Evolution of Intelligent Networks: Switch Stacking, SDN, APIC-EM, and QoS

Cisco StackWise Architecture:
- Unites up to nine individual physical switches into a single, cohesive, logical switching element via proprietary closed-loop stack interconnect cables.
- Managed as a single unit via a master switch elected across stack members; shares a single IP address, single configuration file, and single console session.
- Redundant cross-stack EtherChannels eliminate spanning-tree blocked uplinks.

Cloud Computing Service Models:
- Infrastructure as a Service (IaaS): Delivers baseline virtualized computing hardware, storage, and networking. Customer manages the OS, runtime, and software.
- Platform as a Service (PaaS): Delivers a pre-configured execution platform and development stack. Provider manages hardware and OS; customer manages software and applications.
- Software as a Service (SaaS): Delivers fully functional cloud-hosted applications directly to end users over the Web (e.g., Office 365, Google Drive, Salesforce). Provider manages all underlying infrastructure, OS, and application tiers.
Software-Defined Networking (SDN) Architecture:
- Decouples the Control Plane (intelligence, routing tables, topology logic) from the Data Plane (forwarding plane, hardware ASICs switching bits from ingress to egress).
- Centralizes the control plane inside an SDN software controller managing dumb/white-box forwarding elements.
- Architecture Layers: Data Plane (network elements), Control Plane (SDN controllers), and Application Plane (business logic applications).
- Application Programming Interfaces (APIs):
- Southbound APIs (SBIs): Interfaces between controller and physical network devices. Examples: OpenFlow (industry standard), NETCONF (IETF RFC 6241 XML configuration management), onePK (Cisco proprietary SDK), and OpFlex (declarative model used in Cisco ACI).
- Northbound APIs (NBIs): Interfaces between SDN controller and higher-tier business applications; typically leverage RESTful HTTP methods (GET, POST, PUT, DELETE) exchanging JSON or XML payloads.
Cisco APIC-EM (Application Policy Infrastructure Controller - Enterprise Module):
- Cisco's SDN controller for enterprise campus and WAN infrastructures.
- Uses a Service Abstraction Layer (SAL) communicating with legacy networking hardware using CLI and SNMP.
- Functions: Automated Network Discovery, Device/Host Inventory, Topology Visualizer, Zero-Touch Deployment (PnP), and Policy Management.

APIC-EM Path Trace and ACL Analysis Tool:
- Automated visualization tool tracing hop-by-hop layer 2 and layer 3 packet flows between source and destination endpoints based on IP and transport port numbers.
- Directly detects and visualizes configuration errors and Access Control Lists blocking application flows across intermediate switches and routers.

Cisco Intelligent WAN (IWAN):
- SD-WAN solution routing enterprise traffic securely over hybrid WAN transports (MPLS, broadband Internet, 4G LTE) to reduce cost.
- Four Technical Pillars:
1. Transport-Independent Design: Dynamic Multipoint VPN (DMVPN) overlay with IPsec.
2. Intelligent Path Control: Cisco Performance Routing (PfR) making dynamic path selections based on delay, loss, and jitter.
3. Application Optimization: Network-Based Application Recognition 2 (NBAR2), Application Visibility and Control (AVC), and WAAS acceleration.
4. Secure Connectivity: Certified encryption, zone-based firewalls, and Cisco Cloud Web Security (CWS).

Quality of Service (QoS) Architecture:
- Manages congestion, latency, packet drop rates, and jitter across bandwidth-constrained interfaces.
- Traffic Classes and Tolerances:
- Voice: Smooth, predictable, drop-sensitive, delay-sensitive. Latency $\le 150\,\text{ms}$ , jitter $\le 30\,\text{ms}$ , packet loss $\le 1\%$ , bandwidth $30\text{–}128\,\text{Kbps}$ .
- Video: Bursty, greedy, drop-sensitive, delay-sensitive. Latency $\le 200\text{–}400\,\text{ms}$ , jitter $\le 30\text{–}50\,\text{ms}$ , packet loss $\le 0.1\%\text{–}1\%$ , bandwidth $384\,\text{Kbps}$ to $\ge 20\,\text{Mbps}$ .
- Data: Smooth or bursty, drop-insensitive, delay-insensitive; utilizes TCP retransmissions.
- Trust Boundaries:
- The boundary on an edge switch where packet markings are trusted and evaluated.
- Marks from untrusted domains (PCs, printers) are rewritten to zero.
- Classification and Marking Fields:
- Class of Service (CoS): 3-bit field within IEEE 802.1Q tag (Layer 2, values $0\text{–}7$ ).
- IP Precedence: 3-bit field within the IPv4 Type of Service (ToS) octet (Layer 3, values $0\text{–}7$ ).
- Differentiated Services Code Point (DSCP): 6-bit field within the IPv4 DS field (Layer 3, values $0\text{–}63$ ); backward compatible with IP Precedence.
- Traffic Identifier (TID): 3-bit wireless frame marking (IEEE 802.11).
- Network-Based Application Recognition (NBAR): Deep packet inspection engine operating at Layers 4–7.
- Traffic Conditioning Tools:
- Policing: Typically deployed on ingress interfaces; strictly limits traffic rate; drops or re-marks packets that exceed specified bandwidth ceilings; does not buffer; causes TCP retransmissions; introduces no delay or jitter.
- Shaping: Typically deployed on egress interfaces toward service providers; delays packets by buffering excess bursts to produce an even, smoothed output rate; reduces packet drops; introduces latency and jitter.
- Congestion Management (Queuing):
- Legacy: First-In First-Out (FIFO), Priority Queuing (PQ), Custom Queuing (CQ), Weighted Fair Queuing (WFQ).
- Modern Enterprise Standards:
  - Class-Based Weighted Fair Queuing (CBWFQ): Assigns guaranteed bandwidth to user-defined traffic classes; non-priority, data-oriented.
  - Low Latency Queuing (LLQ): Combines CBWFQ with strict Priority Queuing (PQ) for real-time delay-sensitive voice and video traffic.
- Congestion Avoidance:
- Weighted Random Early Detection (WRED): Proactively discards lower-priority packets randomly before queues fill completely; prevents TCP global synchronization and tail drop.

Hardening Cisco Devices and Disabling Unnecessary Network Services

Vulnerabilities in Default Services:
- Default IOS configurations enable unneeded background daemons that consume CPU resources and expose the platform to Denial of Service (DoS) exploits and topology enumeration.
Hardening Commands and Configurations:
- Blocking Remote SNMP: access-list 110 deny udp any any eq snmp placed inbound on edge interfaces.
- Disabling Small Diagnostic Services: no service tcp-small-servers, no service udp-small-servers (terminates echo, chargen, discard, and daytime ports).
- Disabling Finger: no service finger (prevents attackers from querying logged-in users).
- Disabling Remote Configuration and Boot Services: no ip boot server, no service config.
- Disabling Insecure Web Management: no ip http server.
- Disabling IP Source Routing: no ip source-route (prevents senders from specifying the packet route through the network).
- Disabling Proxy ARP: no ip proxy-arp (applied across all physical LAN interfaces to prevent address spoofing).
- Disabling ICMP Redirect Messages: no ip redirects (prevents routers from advising hosts of alternate next-hop gateways).
- Disabling ICMP Unreachable Notifications: no ip unreachables (prevents discovery of unconfigured internal subnets).
- Disabling Multicast Route Caching: no ip mroute-cache.
- Disabling Maintenance Operation Protocol (MOP): no mop enabled (applied across router interfaces to terminate legacy DECnet utility links).
- Disabling X.25 PAD: no service pad.
- Enabling Nagle TCP Congestion Algorithm: service nagle (reduces packet counts by concatenating small packet trains, though incompatible with X Window).
- Disabling Global CDP: no cdp run (or per-interface via no cdp enable).
- Filtering Default Forwarded UDP Protocols: When deploying ip helper-address, the router forwards eight UDP ports by default ( $37, 49, 53, 67, 68, 69, 137, 138$ ). Suppress unused ports via: no ip forward-protocol udp <port>.
Cisco auto secure Hardening Wizard:
- Automated Privileged EXEC wizard (auto secure) configuring baseline system hardening in a single pass.
- Hardens the Management Plane: Disables finger, PAD, small servers, CDP, HTTP; enables service password encryption, TCP keepalives, login attack blocking periods, and SSH.
- Hardens the Forwarding Plane: Enables Cisco Express Forwarding (CEF), Unicast Reverse Path Forwarding (uRPF), TCP Intercept; disables ICMP redirects, proxy ARP, directed broadcasts, and unreachable messages.