Cisco Certified Network Associate (CCNA) Network Access Syllabus

You configured a trunk but VLAN 20 traffic isn't passing. What two common trunk issues should you check?

Whether VLAN 20 is in the trunk's allowed VLAN list, and whether VLANs/native VLAN match on both ends (also verify the VLAN exists and is active).

What is inter-VLAN routing?

The process of forwarding traffic between different VLANs (different subnets), which requires a Layer 3 device because VLANs are separate broadcast domains/subnets.

What are the three methods of inter-VLAN routing?

Legacy (one router interface per VLAN), Router-on-a-Stick (single trunked router interface with subinterfaces), and a multilayer/Layer 3 switch using SVIs.

What is Router-on-a-Stick?

Inter-VLAN routing using one physical router interface configured with subinterfaces, each assigned to a VLAN via 802.1Q encapsulation, connected to a switch trunk port.

What commands configure a router subinterface for VLAN 10 in Router-on-a-Stick?

interface g0/0.10 ; encapsulation dot1q 10 ; ip address 192.168.10.1 255.255.255.0.

What is an SVI and how is it used for inter-VLAN routing?

A Switched Virtual Interface (interface vlan X) is a virtual Layer 3 interface on a multilayer switch that acts as the default gateway for that VLAN, enabling fast hardware-based inter-VLAN routing.

What global command must be enabled on a Layer 3 switch to route between SVIs?

ip routing.

What is the purpose of Spanning Tree Protocol (STP)?

To prevent Layer 2 loops in networks with redundant switch links by selectively blocking ports, while maintaining a loop-free logical topology.

What IEEE standard defines the original STP, and what defines Rapid STP?

802.1D defines original STP; 802.1w defines Rapid Spanning Tree Protocol (RSTP).

What information does a switch use to elect the STP root bridge?

The lowest Bridge ID, which is the bridge priority (default 32768) plus the MAC address; the lowest priority wins, ties broken by the lowest MAC address.

What is the Bridge ID composed of in PVST+?

4-bit priority + 12-bit extended system ID (the VLAN ID) + 48-bit MAC address. So effective priority = base priority + VLAN ID.

List the three STP port roles in 802.1D.

Root port (best path to root, one per non-root switch), Designated port (forwarding port per segment), and Non-designated/blocking port.

How does a switch choose its root port?

Lowest cumulative root path cost; tie-break by lowest sender bridge ID, then lowest sender port ID (priority/number).

What are the default STP port costs for 10 Mbps, 100 Mbps, 1 Gbps, and 10 Gbps links?

100, 19, 4, and 2 respectively (original short-mode IEEE cost values).

List the five 802.1D STP port states in order and note which forward traffic.

Disabled, Blocking, Listening, Learning, Forwarding. Only Forwarding forwards user traffic (Learning builds the MAC table but doesn't forward).

What are the default STP timers (hello, forward delay, max age) and total convergence time?

Hello 2s, Forward Delay 15s, Max Age 20s; a port takes about 30-50 seconds to go from blocking to forwarding.

What is Rapid PVST+?

Cisco's per-VLAN implementation of RSTP (802.1w), running a separate rapid spanning-tree instance for each VLAN for fast convergence.

List the RSTP/Rapid PVST+ port roles.

Root port, Designated port, Alternate port (backup path to root), and Backup port (backup for a designated port on a shared segment).

What are the three RSTP port states (vs. five in 802.1D)?

Discarding, Learning, and Forwarding (Discarding combines disabled, blocking, and listening).

How fast does RSTP converge compared to legacy STP?

RSTP converges in well under a second (typically milliseconds) on point-to-point links, versus 30-50 seconds for legacy STP, because it uses a proposal/agreement handshake instead of timers.

What command makes a switch the root bridge for VLAN 10 using Rapid PVST+?

spanning-tree vlan 10 root primary (or set 'spanning-tree vlan 10 priority 4096').

What command enables Rapid PVST+ mode globally?

spanning-tree mode rapid-pvst.

What is PortFast and where is it used?

A feature that lets an access (edge) port transition immediately to forwarding, skipping listening/learning states. Used only on ports connected to end hosts, never to other switches.

What is BPDU Guard and what does it do?

A protection feature that error-disables a PortFast port if it receives any BPDU, preventing an unauthorized switch from joining and altering the topology.

What is Root Guard?

An STP protection feature that prevents a port from becoming a root port; if it receives a superior BPDU it puts the port into root-inconsistent (blocking) state, protecting the root bridge placement.

What is Loop Guard?

A feature that prevents a non-designated port from erroneously transitioning to forwarding when it stops receiving BPDUs (e.g., due to a unidirectional link), keeping it in loop-inconsistent blocking state.

What is EtherChannel?

A technology that bundles multiple physical links into a single logical link to increase bandwidth and provide redundancy, while STP treats the bundle as one link (no blocking).

What is the maximum number of physical links per EtherChannel bundle?

Up to 8 active links (Cisco supports configuring up to 16, with 8 active and 8 standby).

Compare the two EtherChannel negotiation protocols.

PAgP is Cisco-proprietary (modes: auto, desirable); LACP is the IEEE 802.3ad open standard (modes: passive, active). 'on' mode forces a channel with no negotiation.

Which PAgP and LACP mode combinations form an EtherChannel?

PAgP: desirable+desirable or desirable+auto. LACP: active+active or active+passive. On both, passive+passive and auto+auto do NOT form a channel; 'on'+'on' does.

What is the difference between a Layer 2 and a Layer 3 EtherChannel?

A Layer 2 EtherChannel switches traffic and uses a port-channel with switchport settings; a Layer 3 EtherChannel routes traffic, is configured with 'no switchport' and an IP address on the port-channel interface.

What requirements must member ports meet to form an EtherChannel?

All ports must have matching speed, duplex, allowed VLAN list, native VLAN, trunk/access mode, and STP settings; mismatches keep ports out of the bundle.

What commands create a Layer 2 LACP EtherChannel on interfaces Gi0/1-2?

interface range gi0/1-2 ; channel-group 1 mode active (this auto-creates interface port-channel 1).

What commands are needed to make port-channel 1 a Layer 3 EtherChannel?

interface port-channel 1 ; no switchport ; ip address 10.1.1.1 255.255.255.0 (and 'channel-group 1 mode active' on members).

What command verifies EtherChannel bundle status and what does a '(P)' flag mean?

show etherchannel summary; '(P)' means the port is bundled in the port-channel; 'P' on the port-channel means it is in use (Layer 2).

What is Cisco Discovery Protocol (CDP)?

A Cisco-proprietary Layer 2 protocol that discovers directly connected Cisco devices, sharing info like device ID, IP address, platform, capabilities, and port IDs.

What are CDP's default timers?

Advertisements sent every 60 seconds; holdtime (how long info is kept) is 180 seconds.

What commands display detailed CDP neighbor information including IP and IOS version?

show cdp neighbors detail (or show cdp entry *).

How do you disable CDP globally versus on a single interface?

Globally: 'no cdp run'. Per interface: 'no cdp enable' under the interface.

What is LLDP and how does it differ from CDP?

Link Layer Discovery Protocol (IEEE 802.1AB) is the vendor-neutral, open-standard equivalent of CDP for discovering neighbors in multivendor networks; CDP is Cisco-proprietary.

What are LLDP's default timers and how is it enabled?

Advertisements every 30 seconds, holdtime 120 seconds. Enabled globally with 'lldp run' (LLDP is disabled by default on Cisco devices).

In CDP/LLDP output, what does the 'Local Intrfce' versus 'Port ID' column represent?

Local Intrfce is the port on your local device; Port ID is the neighbor's port connected to that local interface.

What is a Wireless LAN Controller (WLC)?

A central device that manages, configures, and controls multiple lightweight access points, handling functions like RF management, security, and roaming in a centralized (split-MAC) architecture.

What is the difference between an autonomous AP and a lightweight AP?

An autonomous AP is standalone with a full local configuration; a lightweight AP relies on a WLC for configuration and control, using the split-MAC architecture.

What protocol do lightweight APs use to communicate with a WLC, and what does it tunnel?

CAPWAP (Control And Provisioning of Wireless Access Points); it uses a control tunnel (UDP 5246) and a data tunnel (UDP 5247) between AP and WLC.

In the split-MAC architecture, which MAC-layer functions stay on the AP versus move to the WLC?

Real-time functions (beacons, ACKs, encryption, frame transmission) stay on the AP; management functions (authentication, association, security policy, RF management) move to the WLC.

List common Cisco lightweight AP operating modes.

Local (default), FlexConnect (local switching when WLC link is down), Monitor, Sniffer, Rogue Detector, Bridge/Mesh, SE-Connect, and Flex+Bridge.

What does FlexConnect mode allow an AP to do?

Switch client data traffic locally at the branch and continue operating even if the WAN link to the WLC fails, instead of tunneling all traffic back to the controller.

What are the main WLC interface types used for management and traffic?

Management interface (in-band management/AP communication), Virtual interface (client auth/DHCP relay, e.g., 1.1.1.1), Service port (out-of-band management), and Dynamic interfaces (mapped to WLANs/VLANs).

How do administrators typically access a WLC for management?

Via HTTPS GUI to the management or service-port IP, SSH/Telnet CLI, or the console port; the management interface handles in-band access while the service port provides out-of-band access.

On a WLC, what is a 'dynamic interface' and why is it important?

A logical interface mapped to a VLAN that connects a WLAN to the wired network; client traffic for a WLAN egresses through its associated dynamic interface's VLAN.

What three components are bound together when creating a WLAN on a WLC?

The SSID (and profile name), a WLAN ID, and an interface/interface group (VLAN) that carries the WLAN's traffic, plus the security policy.

In the WLC GUI, under which main tab do you create and configure WLANs?

The WLANs tab (WLANs > Create New), where you set the SSID, interface mapping, and security settings.

What is the difference between an SSID and a WLAN?

The SSID is the wireless network name broadcast to clients; a WLAN is the full logical configuration on the WLC (SSID + VLAN interface + security/QoS policies) that delivers that network.

What are the main Layer 2 wireless security options from weakest to strongest?

Open (none) and WEP (deprecated/insecure), then WPA, WPA2, and WPA3 — with WPA2/WPA3 using AES-CCMP encryption being the recommended choices.

Compare WPA2-Personal and WPA2-Enterprise authentication.

WPA2-Personal (PSK) uses a shared pre-shared key for all users; WPA2-Enterprise (802.1X) authenticates each user individually against a RADIUS/AAA server with unique credentials.

What encryption and integrity method does WPA2 use?

AES encryption with CCMP (Counter Mode with CBC-MAC Protocol) for confidentiality and integrity, replacing WPA's weaker TKIP.

What is 802.1X and what three roles does it define?

An IEEE port-based access control framework for authentication. Roles: Supplicant (client), Authenticator (AP/WLC), and Authentication Server (RADIUS).

Why is WEP considered insecure and unsuitable for modern WLANs?

WEP uses the weak RC4 cipher with short, reusable initialization vectors (IVs), allowing the key to be cracked quickly; it is deprecated and should never be used.

When configuring Layer 2 security for a WLAN in the WLC GUI, where do you set WPA2/PSK?

Under WLANs > (the WLAN) > Security > Layer 2 tab, where you choose WPA+WPA2, enable WPA2 Policy/AES, and set either PSK or 802.1X (AAA server).