Course Overview: Networking Is a Stack of Promises

Every networking technology exists to make one promise to the layer above it: deliver this frame, deliver this packet, keep this loop from forming, translate this address. Advanced Core Concepts in Computer Networking teaches those promises in the order they depend on each other, so that when something breaks at 2 a.m., you know which promise was broken and where to look.

This course is built on a concise core concepts of computer networking revision reference of eighteen focused topics. The reference is excellent for recall, but a list of topics is not an understanding of a network. Here we rebuild those eighteen topics into six modules that mirror how a real network is constructed and debugged: foundations (models, Ethernet, ARP), addressing (IPv4, subnetting, VLSM, IPv6), network access (switching, VLANs, trunks, inter-VLAN routing, Spanning Tree, EtherChannel), IP connectivity (routing decisions, static routes, OSPF), IP services and security (ACLs, NAT and PAT, DHCP, wireless), and finally troubleshooting, where every earlier module is used at once.

The word advanced in the title does not mean obscure. It means we always ask the second question. Not only “what does this command do?” but “what happens on the wire when it is wrong?” Not only “what is the OSPF cost formula?” but “why would two routers refuse to become neighbors even though both show up/up?” Each module therefore pairs concepts with configuration, verification commands and the failure modes that appear in labs and exams.

Who this course is for

The course is designed for undergraduate students in Electronics, Computer Science and Information Technology, for engineers moving into network roles, and for candidates preparing for the Computer Networking exam & jobs. You should be comfortable with binary and hexadecimal numbers and basic computer use. No prior Cisco experience is assumed, although the labs reward those who practise commands on a simulator or real equipment as they read.

How to study each module

1. Read the concept, then draw it. Reproduce each figure on paper from memory. If you cannot draw the Spanning Tree port roles or the NAT address terms, you do not yet own them.
2. Type the configuration, do not paste it. Muscle memory for switchport mode trunk and ip nat inside source is what saves time under pressure.
3. Break it on purpose. Every lab in this guide ends with a fault to inject. Fixing a fault you created teaches more than building a working network.
4. Verify with show commands before you declare victory. A configuration that you did not verify is only a hope.

1.1 What a network is, and the four sizes you must know

A computer network is a group of interconnected devices that communicate and share resources such as data, applications and hardware. Networking exists to give us communication, centralised management, resource sharing and access to cloud services. Networks are classified by reach, and the classification also hints at the technology you will find:

Five device roles appear in nearly every diagram. A router routes packets between IP networks. A switch forwards LAN frames using MAC addresses. An access point connects wireless clients to the wired network. A firewall permits or blocks traffic according to policy. A server provides services such as web, DNS, file or application access. The single most useful sentence in this module is the one to memorise first: switches forward frames locally; routers forward packets between IP networks.

That sentence leads directly to the concept of domains. A collision domain is the set of devices that can interfere with each other on shared media; modern full-duplex switch ports give every port its own collision domain. A broadcast domain is the set of devices that receive a Layer 2 broadcast; routers separate broadcast domains, and VLANs (Module 3) subdivide them inside a switch. When a network design feels slow or unstable, the first diagnostic question is often “how large is this broadcast domain?”

Terms you will use constantly

• IP address: a logical Layer 3 address. MAC address: a Layer 2 hardware or interface identifier.
• DNS maps names to IP addresses. DHCP automatically provides IP configuration. The default gateway is the router a host uses to reach other networks.
• Bandwidth is capacity; latency is delivery delay. A satellite link can have high bandwidth and poor latency, which is why the two must never be confused.

1.2 OSI and TCP/IP: two maps of the same territory

The OSI model has seven layers and is the shared language of troubleshooting. The TCP/IP model has four layers and describes what is actually implemented. You need both, and you need to map between them without hesitation.

Encapsulation, the order that never changes

When an application sends data, each layer adds control information appropriate to that layer. Application data becomes a transport segment (TCP) or datagram (UDP), then an IP packet, then an Ethernet frame, then bits on the medium. The receiver performs decapsulation, removing each header in reverse order. If you can narrate this chain for any protocol, you can reason about where a problem lives. A wrong default gateway breaks the step that builds the frame for a remote destination. A wrong subnet mask breaks the host’s decision about whether a destination is local at all.

Transport deserves one extra paragraph because the PDF’s summary is deliberately brief. TCP is connection-oriented: it establishes a session with a three-way handshake, numbers bytes, acknowledges them, retransmits losses and controls flow with a window. UDP is connectionless and carries no delivery guarantee, which is exactly why DNS queries, DHCP, voice and video prefer it: a late packet is worth less than a new one. Both identify applications with port numbers, which is also what allows PAT in Module 5 to multiplex many hosts onto a single address.

1.3 Ethernet, MAC addresses and ARP

Ethernet is the dominant wired LAN technology and defines Layer 1 and Layer 2 operation. Common speeds are 10 Mbps, 100 Mbps, 1 Gbps, 10 Gbps and higher. Ethernet uses MAC addresses for local frame delivery: 48 bits (6 bytes), written as 12 hexadecimal digits. The first 24 bits are the manufacturer’s OUI and the last 24 bits identify the interface. The least-significant bit of the first byte is the I/G bit: 0 means unicast, 1 means multicast. The broadcast address is FF:FF:FF:FF:FF:FF and is delivered to every host in the VLAN.

How a switch learns, step by step

1. A frame arrives on a port.
2. The switch records the source MAC against the incoming port and VLAN.
3. It looks up the destination MAC.
4. Known unicast: forward out the learned port only.
5. Unknown unicast or broadcast: flood within the VLAN, except the port it arrived on.

Learning is entirely driven by the source address, which is the detail most often reversed under exam stress. Entries age out after inactivity; the Cisco default is commonly 300 seconds.

ARP: the glue between Layer 3 and Layer 2

ARP resolves an IPv4 next-hop address to a MAC address on the local segment. The ARP Request is a broadcast; the ARP Reply is normally unicast. The crucial advanced point: for a remote destination, the host ARPs for the default gateway’s MAC address, never for the remote host’s MAC. The IP packet keeps the remote destination address end to end, while the Ethernet frame is addressed to the gateway on the first hop and rewritten at every router along the path. When a user can reach local devices but nothing beyond them, a missing or incorrect default gateway (or a gateway that does not answer ARP) is the first thing to check.

2.1 IPv4 fundamentals

IPv4 uses 32-bit addresses written as four 8-bit octets in dotted decimal. In 192.168.1.10/24 the CIDR prefix /24 says the first 24 bits are the network portion and the remaining 8 bits identify hosts. The mask 255.255.255.0 is the same statement in a different notation. Every address you meet should be classified before you do anything else with it:

A worked example fixes the vocabulary. For 192.168.1.10/24: the mask is 255.255.255.0, the network address is 192.168.1.0, usable hosts run from 192.168.1.1 to 192.168.1.254, the broadcast address is 192.168.1.255, and the block contains 256 addresses in total. Always separate “total addresses” from “usable hosts”: the network and broadcast addresses are not assignable to hosts in the traditional model.

2.2 Subnetting without fear

We subnet to divide one large block into smaller broadcast domains, to use address space efficiently, to reduce broadcast scope, to create security and policy boundaries, and to build structured, scalable networks. Memorise this compact table once; the rest is arithmetic.

Host counts above are the traditional values. A /31 is used on point-to-point links (two usable addresses, no network or broadcast) and a /32 identifies a single host or loopback, so both have special routing roles.

The fast method in four moves

1. Find the interesting octet, the one where the mask is neither 255 nor 0, and compute the block size as 256 minus the mask value in that octet.
2. List subnet network addresses by repeatedly adding the block size.
3. The host range is the network address plus one, through the broadcast address minus one.
4. The broadcast address is the next subnet address minus one.

Apply it to splitting 192.168.1.0/24 into four /26 subnets. The mask is 255.255.255.192, the block size is 256 − 192 = 64, so the networks begin at 0, 64, 128 and 192.

A harder example: which subnet does the host belong to?

Question: host 172.16.45.200/21. A /21 mask is 255.255.248.0, so the interesting octet is the third and the block size is 256 − 248 = 8. Subnets in the third octet start at 0, 8, 16, …, 40, 48. Since 45 lies between 40 and 47, the network address is 172.16.40.0/21, the broadcast address is 172.16.47.255, and usable hosts run from 172.16.40.1 to 172.16.47.254. This type of question, “find the network, range and broadcast for any address”, is the backbone of subnetting questions in exams and in design reviews.

2.3 VLSM: allocate the largest first

Variable Length Subnet Masking uses different prefix lengths inside the same address block. Real requirements are never uniform: a campus LAN with 100 hosts and a router-to-router link with 2 do not deserve the same subnet size. VLSM reduces address waste and is widely used. The discipline is simple and strict: sort requirements from largest to smallest and allocate in that order, always starting at the next free boundary. Allocating small subnets first fragments the block and leaves no aligned space for the large ones.

Requirement: divide 192.168.10.0/24 to serve LAN A (100 hosts), LAN B (50), LAN C (20) and a WAN link (2).

2.4 IPv6 fundamentals

IPv6 uses 128-bit addresses, giving an enormous address space. It supports SLAAC (stateless address autoconfiguration) and DHCPv6-based configuration. It has no broadcast: multicast replaces broadcast for many one-to-many functions, and anycast is a separate address type. IPv6 does not inherently encrypt traffic; IPsec can be used where required, so “IPv6 is secure by default” is a myth worth correcting whenever you hear it.

Compression rules. Take 2001:0DB8:AC10:0000:0000:0000:0000:1A2B. First remove leading zeros inside each hextet. Then replace one contiguous run of all-zero hextets with ::, and only once per address. The result is 2001:db8:ac10::1a2b. Using :: twice would make the address ambiguous.

Modified EUI-64. A host can build its 64-bit interface ID from its 48-bit MAC address: split the MAC in half, insert FFFE in the middle, and flip the seventh bit (the universal/local bit) of the first byte. For MAC 00:1A:2B:3C:4D:5E the first byte 00 becomes 02, giving the interface ID 021A:2BFF:FE3C:4D5E. Neighbour Discovery (NDP), which runs over ICMPv6, replaces ARP in IPv6 and also supports router discovery for SLAAC.

R1(config)# interface g0/0
R1(config-if)# ipv6 address 2001:db8:ac10::1/64
R1(config-if)# no shutdown
! Static default route in IPv6 uses ::/0
R1(config)# ipv6 route ::/0 2001:db8:12::2

3.1 Switching fundamentals

A Layer 2 switch forwards Ethernet frames based on the destination MAC address. It builds its table by learning source MAC addresses, recording the MAC, the VLAN and the port together. Module 1 gave you the algorithm; here we focus on what it implies for design and troubleshooting.

Two consequences matter. First, because dynamic entries age out (commonly 300 seconds), a host that goes quiet will eventually be “forgotten” and the next frame to it is flooded; this is normal. Second, any condition that makes the MAC table unstable, such as a Layer 2 loop, makes the switch relearn the same address on different ports in rapid succession. If you ever see a MAC address flapping between ports in the logs, suspect a loop before you suspect a faulty host.

A Layer 2 switch performs switching only and typically sits at the access layer. A Layer 3 switch performs switching and routing (through SVIs and routed ports) and typically sits at the distribution layer or provides inter-VLAN routing. The verification toolbox for this topic is small but powerful: show mac address-table, show interfaces status, show interfaces, show running-config, show cdp neighbors and show lldp neighbors. The last two are how you discover what is actually plugged into a port, which is often not what the documentation claims.

3.2 VLANs and trunking

A VLAN logically divides a switched network into separate Layer 2 broadcast domains. Devices in the same VLAN communicate at Layer 2, even across switches, through trunk links. Traffic between different VLANs requires Layer 3 routing. VLANs let you separate departments, guests, voice and management traffic without buying separate physical switches, and they shrink the broadcast domain exactly as Module 1 suggested.

802.1Q tagging. The Ethernet field order on a trunk is destination MAC, source MAC, 802.1Q tag, EtherType, payload, FCS. The 4-byte tag carries the VLAN identifier and priority information. Because the tag is inserted into the frame, trunks require the endpoints to agree on it, and frames in the native VLAN are sent untagged by default. The Cisco default native VLAN is VLAN 1, and a mismatch in native VLAN between the two ends of a trunk is a classic cause of both connectivity faults and log messages.

Switch(config)# vlan 10
Switch(config-vlan)# name USERS
Switch(config-vlan)# exit
Switch(config)# interface fa0/1
Switch(config-if)# switchport mode access
Switch(config-if)# switchport access vlan 10

Switch(config)# interface fa0/24
Switch(config-if)# switchport mode trunk
Switch(config-if)# switchport trunk allowed vlan 10,20,30
Switch(config-if)# no shutdown

Notice two habits. We set the port mode explicitly rather than relying on negotiation, because dynamic trunk negotiation can silently turn an access port into a trunk if the neighbour asks for it. And we restrict the trunk with an allowed-VLAN list so that only the VLANs that need to cross the link do cross it. Verify with show vlan brief, show interfaces trunk and show interfaces status.

3.3 Inter-VLAN routing

Different VLANs are separate broadcast domains and cannot communicate through Layer 2 switching alone. A router or multilayer switch must perform Layer 3 forwarding between the VLAN subnets. There are two methods you are expected to configure and compare.

Method 1: router-on-a-stick (RoAS)

One physical router interface is divided into 802.1Q subinterfaces, typically one per VLAN. Each subinterface becomes the default gateway for its VLAN.

R1(config)# interface g0/0
R1(config-if)# no shutdown
R1(config-if)# interface g0/0.10
R1(config-subif)# encapsulation dot1Q 10
R1(config-subif)# ip address 192.168.10.1 255.255.255.0
R1(config-subif)# interface g0/0.20
R1(config-subif)# encapsulation dot1Q 20
R1(config-subif)# ip address 192.168.20.1 255.255.255.0

Method 2: Layer 3 switch with SVIs

A switch virtual interface (SVI) is a logical Layer 3 interface for a VLAN. Enable routing on the switch with ip routing, create each VLAN, then give each SVI an address.

SW1(config)# ip routing
SW1(config)# vlan 10
SW1(config-vlan)# exit
SW1(config)# interface vlan 10
SW1(config-if)# ip address 192.168.10.1 255.255.255.0
SW1(config-if)# no shutdown
SW1(config)# vlan 20
SW1(config-vlan)# exit
SW1(config)# interface vlan 20
SW1(config-if)# ip address 192.168.20.1 255.255.255.0
SW1(config-if)# no shutdown

An SVI will not reach line-protocol up unless the VLAN exists and is operational, which in practice means the VLAN is created and at least one port in that VLAN (access or trunk) is up. “Interface Vlan10 is up, line protocol is down” almost always means the VLAN is missing or has no active ports.

3.4 Spanning Tree Protocol and Rapid PVST+

Redundant Layer 2 links are good engineering and dangerous physics. Without protection they create switching loops, broadcast storms, duplicate frames and MAC-table instability. Ethernet frames have no hop count, so a looped broadcast circulates until the network is saturated. Spanning Tree creates a loop-free logical topology while retaining the redundant links as backups. Current core networking concept focus is Rapid PVST+, which runs a rapid spanning tree instance per VLAN.

Root bridge election and port roles

The switch with the lowest Bridge ID becomes the root bridge. The Bridge ID is composed of the priority, the extended system ID (the VLAN number) and the MAC address; priority is compared first, and MAC address breaks ties. Every non-root switch then selects a root port, the port with the best path to the root. Every segment elects a designated port, the best forwarding port for that segment. Ports that are neither stay as alternate ports in the discarding state, ready to take over quickly if the active path fails.

Protecting the topology

• PortFast: immediate forwarding on edge (access) ports. Never use it on switch-to-switch links.
• BPDU Guard: err-disables an edge port if BPDUs are received, stopping an unauthorised switch from joining.
• Root Guard: prevents an unexpected switch from becoming root.
• Loop Guard: protects against unidirectional failures that could create loops.
• BPDU Filter: suppresses BPDUs. Powerful, and therefore to be used carefully.

SW1(config)# spanning-tree mode rapid-pvst
SW1(config)# spanning-tree vlan 10 root primary
SW1(config)# interface fa0/1
SW1(config-if)# spanning-tree portfast
SW1(config-if)# spanning-tree bpduguard enable
SW1# show spanning-tree vlan 10

A design principle worth stating plainly: do not let the root bridge be chosen by accident. By default every switch has the same priority and the oldest MAC address wins, which can put the root on an ageing access switch at the edge of the building. Choose the root deliberately (usually a core or distribution switch) and a secondary root as backup. In the output of show spanning-tree vlan 10, the line that says “This bridge is the root” or names the root ID is your first confirmation, and the role and state of each interface is your second.

3.5 EtherChannel

EtherChannel bundles multiple physical Ethernet links into one logical port-channel. It delivers higher aggregate bandwidth, redundancy and simpler Spanning Tree behaviour, because STP sees one logical link instead of several parallel links it would otherwise have to block. Traffic is load-balanced across member links using a hashing algorithm, which means a single flow always uses one member link; aggregate capacity helps many flows, not one fast transfer.

Requirements. Member links should have compatible speed and duplex and matching Layer 2 settings, and links in one bundle must have consistent access VLAN or trunk parameters. Both ends must agree on the aggregation method. The current core networking focus is LACP, the open standard; Cisco’s older proprietary alternative is PAgP.

SW1(config)# interface range g0/1 - 4
SW1(config-if-range)# channel-group 1 mode active
SW1(config)# interface port-channel 1
SW1(config-if)# switchport mode trunk
SW1# show etherchannel summary
SW1# show interfaces trunk

In show etherchannel summary, the flag SU beside the port-channel means it is Layer 2 and in use, and P beside a member means it is bundled. A member flagged I (stand-alone) or s (suspended) is the signature of a mismatch. Common issues are mismatched VLAN or trunk settings, incompatible modes such as passive on both sides, mixing “on” with LACP, and failed physical links.

4.1 The routing decision, in the right order

A router receives a packet, strips the Layer 2 header, looks at the destination IP address and consults its routing table. Three comparisons can be involved and they are applied in a strict order that is the most frequently confused idea in routing:

1. Longest prefix match. Among all routes that contain the destination, the most specific one (the longest mask) wins, regardless of its source or metric.
2. Administrative distance (AD). If several sources offer the same prefix, the source with the lowest AD is trusted. Typical values: connected 0, static 1, OSPF 110.
3. Metric. Among paths to the same prefix learned by the same routing protocol, the lowest metric wins. In OSPF the metric is cost.

The practical implication: a /24 route from OSPF beats a /16 static route for a destination inside the /24, even though static routes have a better AD, because longest prefix is evaluated first. If no route matches, the packet is dropped (and an ICMP unreachable is usually returned) unless a default route exists. The IPv4 default route is 0.0.0.0/0 and the IPv6 default route is ::/0; in the routing table it is shown as the gateway of last resort.

4.2 Static routing

Static routes are configured manually and do not learn topology changes automatically. They are useful for small or stub networks, default routes and deterministic backup paths. The syntax is ip route <destination> <mask> <next-hop | exit-interface> [AD].

R1(config)# ip route 192.168.2.0 255.255.255.0 10.0.0.2
R2(config)# ip route 0.0.0.0 0.0.0.0 10.0.0.1
! Floating static: AD 5 is only a backup if a better route to the
! same prefix with a LOWER AD is present
R1(config)# ip route 192.168.2.0 255.255.255.0 10.0.0.2 5

R1(config)# ipv6 route 2001:db8:2::/64 2001:db8:12::2
R1(config)# ipv6 route ::/0 2001:db8:12::2

Specifying a next-hop IP lets the router perform a recursive lookup to find the outgoing interface. Specifying only an exit interface on a multi-access Ethernet link can force the router to ARP for every destination, which is inefficient; the usual best practice on Ethernet is the next-hop address (or both). Verify with show ip route, show ipv6 route, ping and traceroute. In the table, the code S marks static routes, C connected networks and L the local interface address, O is OSPF, and S* marks a static default route.

4.3 OSPF: how routers learn the map

OSPF is a link-state interior gateway protocol (IGP). Instead of passing along a summary of routes, each router describes its own links, floods that information, and every router assembles the same link-state database (LSDB). Each router then runs the SPF algorithm on that database to calculate its own best paths. OSPF uses cost as its metric and supports VLSM and CIDR. Cost is derived from interface bandwidth relative to a reference bandwidth (100 Mbps by default), so on a network with Gigabit links you should raise the reference bandwidth, or links of different speeds will look identical to OSPF.

Neighbours, adjacency and the DR/BDR

Routers become neighbours by exchanging Hello packets. Neighbours must agree on compatible parameters: area, subnet, timers, authentication and key options. On broadcast Ethernet networks, OSPF elects a Designated Router (DR) and Backup DR (BDR) so that routers do not form a full mesh of adjacencies; the other routers, called DROthers, form full adjacencies primarily with the DR and BDR and remain in the 2-Way state with each other. On point-to-point links there is no DR/BDR election. The election prefers the highest interface priority (default 1; priority 0 means ineligible), with the highest router ID as the tie-breaker, and it is not pre-emptive once a DR exists. The router ID is a 32-bit identifier chosen automatically or configured explicitly; configure it explicitly so that it never changes unexpectedly.

Neighbour relationships climb a ladder of states: Down, Init, 2-Way, ExStart, Exchange, Loading and Full. Knowing the ladder is a debugging tool. A neighbour stuck in Init means Hellos are received but the neighbour is not seeing yours (often an ACL or one-way link). Stuck in 2-Way is normal between DROthers. Stuck in ExStart/Exchange classically points to an MTU mismatch between the two interfaces.

router ospf 1
 router-id 1.1.1.1
 network 10.0.12.0 0.0.0.255 area 0
 network 192.168.1.0 0.0.0.255 area 0
 passive-interface g0/1
R1# show ip ospf neighbor
R1# show ip route ospf
R1# show ip ospf interface brief
R1# show ip ospf

The network statement uses a wildcard mask and does two jobs at once: it selects which interfaces run OSPF and which networks are advertised. passive-interface keeps an interface advertised but stops it from sending Hellos, which is the right choice for user-facing LAN links where no router should ever appear.

The OSPF neighbour failure checklist

• Interfaces up/up and in the same subnet with the same mask.
• Same area on that link; matching Hello and dead timers.
• Authentication settings identical on both sides.
• Unique router IDs, and no interface marked passive on the link.
• No ACL blocking OSPF; matching MTU on both ends.

The Core networking focus is single-area OSPF, router ID, neighbour formation, broadcast DR/BDR behaviour and point-to-point behaviour. Multi-area design builds on exactly these mechanics.

5.1 Access control lists

An ACL permits or denies packets according to an ordered list of rules. Three behaviours define every ACL: rules are processed top-down, the first match wins, and an implicit deny sits at the end. The implicit deny is invisible in the configuration, which is why a list that contains only deny statements blocks everything.

The placement guidelines have reasons. A standard ACL matches only the source, so placing it near the source would block that source from everything, including destinations you meant to allow. An extended ACL is specific, so placing it close to the source drops unwanted traffic before it crosses the network. These are design guidelines, not hard technical limits: choose the placement that meets policy cleanly.

A wildcard mask is the inverse of a subnet mask: a 0 bit means “must match” and a 1 bit means “do not care”. A quick way to obtain it is 255 minus each mask octet.

! Standard ACL: block one subnet, permit everything else
access-list 10 deny 192.168.10.0 0.0.0.255
access-list 10 permit any
interface g0/1
 ip access-group 10 out

! Extended ACL: block web access to one server only
access-list 101 deny tcp 192.168.20.0 0.0.0.255 host 192.168.30.10 eq 80
access-list 101 permit ip any any
interface g0/0
 ip access-group 101 in

Read the extended example as a sentence: “deny TCP from the 192.168.20.0/24 network to the host 192.168.30.10 on port 80; permit any other IP traffic.” The final permit ip any any is essential, because without it the implicit deny would block everything else. Remember the direction: in is evaluated as traffic enters the interface, out as it leaves. Named ACLs (ip access-list extended NAME) are easier to edit because each entry has a sequence number you can insert or delete. Verify with show access-lists (hit counters reveal which rule is matching) and show ip interface g0/0 (shows which ACL is applied and in which direction).

5.2 NAT and PAT

Network Address Translation translates IPv4 addresses between inside and outside address domains. PAT (NAT overload) lets many inside hosts share one public IPv4 address by using Layer 4 port numbers. NAT conserves public IPv4 space, but it is not a replacement for a firewall: translation hides addressing, it does not decide what is allowed. The vocabulary is where most mistakes occur.

access-list 1 permit 192.168.1.0 0.0.0.255
interface g0/0
 ip nat inside
interface g0/1
 ip nat outside
ip nat inside source list 1 interface g0/1 overload
R1# show ip nat translations
R1# show ip nat statistics

Troubleshoot NAT in three questions. Are the inside and outside roles on the correct interfaces? Does the ACL actually match the inside hosts (the ACL in NAT selects traffic to translate, it does not permit or deny)? Is the keyword overload present, if many hosts share one address? show ip nat translations answers the rest by showing whether entries are being created at all.

5.3 DHCP and DHCP relay

DHCP supplies IPv4 parameters automatically: address, mask, default gateway, DNS and lease time. It uses UDP port 67 on the server and UDP 68 on the client. The exchange is remembered as DORA: the client broadcasts a Discover, a server answers with an Offer, the client sends a Request for the offered address, and the server confirms with an Acknowledge.

ip dhcp excluded-address 192.168.10.1 192.168.10.20
ip dhcp pool LAN
 network 192.168.10.0 255.255.255.0
 default-router 192.168.10.1
 dns-server 8.8.8.8
 lease 7
R1# show ip dhcp binding
R1# show ip dhcp pool

Exclude infrastructure addresses before clients can be leased them, otherwise the server may hand your gateway’s address to a laptop. Because the Discover is a broadcast, it does not cross routers. When the DHCP server lives on another subnet, configure ip helper-address <server-ip> on the router interface that faces the clients, so the router relays the client’s messages to the server as unicast. A client that shows a 169.254.x.x address is the visible symptom of a failed DHCP exchange.

5.4 Wireless LAN essentials

An SSID is the network name; the access point provides wireless access and bridges client traffic toward the wired network. The 2.4 GHz band generally offers longer range, while 5 GHz usually provides more channel capacity and higher throughput. In many regulatory domains, channels 1, 6 and 11 are the common non-overlapping choices for 20 MHz channels on 2.4 GHz, so neighbouring access points should be planned on those channels to avoid self-interference.

Security. WPA2 commonly uses AES-CCMP for encryption. WPA3 strengthens protection and, in Personal mode, uses SAE (Simultaneous Authentication of Equals) in place of the WPA2 pre-shared key exchange, which resists offline dictionary attacks. When you read a WLAN configuration, identify the SSID, the security type, the authentication method (Personal pre-shared key or Enterprise 802.1X) and the VLAN or interface the WLAN maps to.

Wireless exam focus also includes AP modes, WLC connectivity and interpreting common WLAN security settings. In controller-based designs, the switch port connecting a lightweight AP is often an access port in the AP management VLAN, while the port toward the WLC is typically a trunk, so VLAN and trunk knowledge from Module 3 applies directly.

6.1 A repeatable troubleshooting method

Random clicking is not troubleshooting. Professionals follow a logical flow that keeps them from fixing the wrong thing, and the flow has six steps: identify the symptoms and their scope, gather evidence with commands and logs, isolate the failing layer or hop, fix with a controlled change, verify end to end, and document the cause and solution.

OSI-based checks

Choose a direction deliberately. Bottom-up (start at the cable) suits suspected hardware or link problems. Top-down (start at the application) suits a user complaint about one service. Divide and conquer (start at Layer 3 with ping, then move up or down depending on the result) is the fastest on average, because a successful ping to the destination rules out layers 1 to 3 in one step and a failed one tells you to move down.

6.2 The life of a packet: one ping, every module

Consider the most ordinary event in networking: PC1 (192.168.10.50, VLAN 10) pings a server at 203.0.113.80 on the Internet. The network uses router-on-a-stick for inter-VLAN routing, PAT on the edge router, and OSPF toward the provider side. Every concept in this guide appears.

1. Local or remote? (Module 2). PC1 applies its mask to the destination. 203.0.113.80 is not in 192.168.10.0/24, so the packet must go to the default gateway, 192.168.10.1.
2. ARP (Module 1). PC1 has no MAC for 192.168.10.1, so it broadcasts an ARP Request. The reply gives the router’s subinterface MAC. The frame is addressed to the gateway’s MAC, while the IP packet keeps the server’s IP as its destination.
3. Switching (Module 3). SW1 learns PC1’s MAC from the source address, finds the gateway MAC out the trunk port, and forwards the frame there. Over the trunk the frame carries an 802.1Q tag for VLAN 10.
4. Routing decision (Module 4). R1 receives the frame on g0/0.10, removes the Layer 2 header and searches its routing table. No specific route matches, so longest prefix match falls to the default route learned through OSPF or configured statically.
5. ACL check (Module 5). If an ACL is applied inbound on g0/0.10 or outbound on the edge interface, the packet is compared against it top-down, and the first match decides its fate.
6. NAT/PAT (Module 5). At the edge, the inside local source 192.168.10.50 is translated to the router’s inside global address with a port, and the entry is stored for the return traffic.
7. New frame, same packet. At each hop the router builds a new Ethernet frame for the next hop. The Layer 2 addresses change at every router; the Layer 3 destination does not (apart from NAT at the edge).
8. The reply. The server’s reply arrives addressed to the inside global address. R1 consults the translation table, restores 192.168.10.50, routes the packet to VLAN 10, and ARP and switching deliver the final frame to PC1.

If you can narrate that walk from memory, you have an internal model of the network that makes every symptom diagnosable. Each step also names a failure: wrong mask or gateway (step 1), unreachable gateway (step 2), missing VLAN or trunk (step 3), missing or wrong route (step 4), ACL deny (step 5), NAT misconfiguration (step 6).

6.3 Case files

Eight Hands-On Labs

Build each lab in a simulator such as Cisco Packet Tracer or on physical equipment. Every lab follows the same rhythm as Module 6: build, verify, break, diagnose, repair and document. Submit your configurations, show command evidence and a short note on what you changed to fix the injected fault.

CLI Quick Reference

Exam Traps, Learning Outcomes and FAQ

Ten traps that cost marks

1. Switches learn from the source MAC, never the destination.
2. For remote destinations the host ARPs for the gateway, not the remote host.
3. Total addresses are not usable hosts: subtract the network and broadcast addresses.
4. In VLSM, allocate the largest subnet first.
5. IPv6 :: may appear once; IPv6 has no broadcast and is not encrypted by default.
6. Native VLAN traffic is untagged, and the default is VLAN 1.
7. PortFast belongs on edge ports only, never between switches.
8. LACP passive plus passive does not form a bundle.
9. Routing order is longest prefix, then administrative distance, then metric.
10. ping is ICMP at Layer 3; it does not test a TCP or UDP port.

Learning outcomes

On completing this course you will be able to: classify and subnet IPv4 addresses and design a VLSM plan; compress and classify IPv6 addresses; configure and verify VLANs, trunks, inter-VLAN routing, Rapid PVST+ and LACP EtherChannel; read a routing table and explain a forwarding decision; configure static routing and single-area OSPF; write and place standard and extended ACLs; configure PAT and DHCP; interpret WLAN security and architecture; and apply a structured method to locate faults at the correct layer.

Where to go next: deepen security fundamentals (port security, DHCP snooping, dynamic ARP inspection, AAA), and study Automation & Programmability (REST APIs, JSON, controller-based networking and configuration management). Both build directly on the foundations above.

Frequently asked questions

What is the difference between a switch and a router?

A switch forwards Ethernet frames inside a LAN using destination MAC addresses. A router forwards IP packets between different IP networks using its routing table.

Why does a host ARP for the default gateway instead of the remote host?

ARP works only on the local Layer 2 segment. A remote destination is reached through the router, so the frame is addressed to the gateway’s MAC while the packet keeps the remote IP.

How do I choose between router-on-a-stick and a Layer 3 switch?

Router-on-a-stick uses one trunked router interface with subinterfaces and suits small designs. A Layer 3 switch routes between SVIs in hardware and scales better on a campus.

Which routing decision wins first: longest prefix, administrative distance or metric?

Longest prefix match comes first. Administrative distance only chooses between sources offering the same prefix, and metric compares paths from the same protocol.

What is the difference between NAT and PAT?

NAT translates IPv4 addresses between inside and outside domains. PAT lets many inside hosts share one public address by tracking Layer 4 port numbers.

Why will two LACP passive ports never form an EtherChannel?

A passive port only responds to LACP and never initiates it. At least one side must be active.

Glossary