Cisco CCNA
200-301 Roadmap

🎯 Module goal: Think like a switch — predict exactly how frames are forwarded, learned, flooded, and filtered, then configure and troubleshoot a real switch from the CLI with confidence.

2.1 MAC addressing and the CAM learning table

A MAC address is a 48-bit hardware identifier written as twelve hex digits (e.g. 00:1A:2B:3C:4D:5E). The first half is the vendor's OUI, the second half is that vendor's unique serial for the NIC. It matters at Layer 2 because Ethernet delivers frames between adjacent devices using these addresses.

A switch is smarter than a hub because of its CAM (content addressable memory) table. When a frame enters a port, the switch reads the source MAC and records "this MAC lives on this port" — that's learning. Then it looks up the destination MAC: known destination → forward out just that port (filtering); unknown destination → copy out every other port (flooding). Entries age out after ~300 seconds of silence, so the table tracks reality as devices move.

Switch# show mac address-table
          Mac Address Table
-------------------------------------------
Vlan    Mac Address       Type        Ports
----    -----------       --------    -----
   1    0001.42ff.2201    DYNAMIC     Fa0/1
   1    0001.42ff.2202    DYNAMIC     Fa0/3

2.2 ARP flow, captured and explained

PC-A wants to send to IP 192.168.1.20 but only knows the IP, not the MAC. So it shouts an ARP request: a broadcast frame (destination FF:FF:FF:FF:FF:FF) asking "who has 192.168.1.20?" Every host on the segment receives it; only .20 answers with a unicast ARP reply carrying its MAC. Both sides cache the mapping so they don't repeat the dance constantly — on Windows check it with arp -a.

In Packet Tracer, delete the ARP entries (Simulation panel → clear), ping again, and watch two extra frames precede your ICMP. This tiny flow explains huge swaths of networking: why broadcasts stay inside a LAN, why ARP poisoning works as an attack, and why "one subnet per VLAN" (Module 3) is a rule and not a suggestion.

2.3 Frame format and delivery types

An Ethernet II frame reads: Preamble+SFD | Destination MAC | Source MAC | Type | Payload | FCS. The Type field says what's inside — 0x0800 means IPv4, 0x8100 flags an 802.1Q VLAN tag (Module 3). The FCS is a CRC checksum: if bits got mangled in transit, the receiving NIC silently discards the frame.

• Unicast — one specific destination MAC; the normal case.
• Broadcast — FF:FF:FF:FF:FF:FF; every host must process it; never crosses a router.
• Multicast — IPv4 uses MAC prefix 01:00:5E; only subscribed hosts process it (video streams).

2.4 Switch CLI survival kit

Cisco IOS has modes: user EXEC (just > prompt, look-only), privileged EXEC (#, full control), then global config. The muscle memory you need forever:

Switch> enable
Switch# configure terminal
Switch(config)# hostname SW-FLOOR2
SW-FLOOR2(config)# enable secret Cisco123
SW-FLOOR2(config)# line console 0
SW-FLOOR2(config-line)# password c0nsole
SW-FLOOR2(config-line)# login
SW-FLOOR2(config-line)# exit
SW-FLOOR2(config)# service password-encryption
SW-FLOOR2(config)# banner motd #Authorized access only#
SW-FLOOR2(config)# end
SW-FLOOR2# copy running-config startup-config

The show commands that earn their keep daily: show running-config (what's configured now), show mac address-table (what it learned), show interfaces status (link state/speed/duplex per port), show version (IOS image, uptime, model). Always show before you change anything — diagnose first, touch config second.

2.5 Speed/duplex mismatches and a port troubleshooting flowchart

Duplex mismatch symptoms are sneaky: pings mostly succeed but transfers crawl, and the half-duplex side counts late collisions while the full side shows CRC errors. Work ports methodically: ① physical layer — LED, cable seated both ends, swap cable; ② show interfaces status — connected? speed/duplex sane and matching?; ③ show interfaces counters errors — collisions/CRC climbing?; ④ fix negotiation consistently on both ends. Nine out of ten "the network is broken" tickets die at step ②.

SW-FLOOR2# show interfaces counters errors
Port      Align-Err    FCS-Err   Xmit-Err    Rcv-Err  Late-Coll
Fa0/1             0          0          0          0       1847
Fa0/2             0          0          0          0          0

2.6 Basic hardening: shut unused ports down

An unsecured switch port is an open door into your VLAN. The baseline: administratively disable anything without a user, protect privileged mode, and announce policy legally via banner:

SW-FLOOR2(config)# interface range fa0/10 - 24
SW-FLOOR2(config-if-range)# shutdown
SW-FLOOR2(config-if-range)# description SPARE-PORTS
SW-FLOOR2(config-if-range)# exit

Also replace Telnet with SSH before anyone teaches you bad habits: give the switch a hostname + domain-name, generate crypto key generate rsa (1024+ bits), and permit SSH-only on the vty lines. Full management-plane lockdown returns in Module 7 with ACLs; here you just want no plaintext protocols and no dead ports left enabled.

🎯 Module goal: Carve one physical switch fabric into many isolated broadcast domains, wire them together with 802.1Q trunks, and verify every hop — the single most-used skill on the CCNA.

3.1 Why VLANs exist: broadcast domains, security, departments

By default every port on a switch shares one broadcast domain: an ARP request annoys all 200 users, and anyone can sniff or reach anything. A VLAN slices a switch into logical switches — ports in VLAN 10 never see frames from VLAN 20, full stop. You gain smaller broadcast domains, security boundaries between departments, and flexibility: move a desk and you re-assign a port in software instead of pulling cable to another switch.

The golden pairing: one VLAN = one IP subnet. VLAN 10 = 192.168.10.0/24, always. Break that symmetry and your routing (Module 5) becomes a debugging nightmare. The exam assumes this rule even when it doesn't state it.

3.2 Access ports, voice ports and the native VLAN concept

An access port serves exactly one data VLAN; frames enter and leave untagged because end devices don't speak VLAN tagging. A voice port is access-plus: a phone tags its own voice traffic with a voice VLAN while passing the PC's untagged data traffic straight through — two VLANs, one physical drop:

S1(config)# interface fa0/5
S1(config-if)# switchport mode access
S1(config-if)# switchport access vlan 10
S1(config-if)# switchport voice vlan 150

The native VLAN only matters on trunks: it's the one VLAN whose frames cross the trunk without a tag. Both ends must agree, and Cisco's best practice is an unused VLAN (never 1) so nothing meaningful rides untagged.

3.3 802.1Q tagging: trunk vs access mode

A trunk carries many VLANs over one link by inserting a 4-byte 802.1Q tag into each frame — TPID 0x8100 marks "tag here," followed by a 12-bit VLAN ID (0–4094) plus three CoS priority bits used later for QoS. Access ports strip tags before delivery; that asymmetry is the whole design. Rule of thumb: device-facing = access, switch-to-switch or switch-to-router = trunk.

3.4 VLAN creation and assignment workflow

S1(config)# vlan 10
S1(config-vlan)# name SALES
S1(config-vlan)# vlan 20
S1(config-vlan)# name TECH
S1(config-vlan)# exit
S1(config)# interface range fa0/2 - 8
S1(config-if-range)# switchport mode access
S1(config-if-range)# switchport access vlan 10
S1(config-if-range)# end
S1# show vlan brief

VLAN Name            Status    Ports
---- --------------- --------- -------------------------------
1    default         active    Fa0/1, Fa0/9, Gi0/1
10   SALES           active    Fa0/2, Fa0/3, Fa0/4, Fa0/5, ...
20   TECH            active

Shortcut worth knowing: assigning an unknown VLAN with switchport access vlan 30 auto-creates VLAN 30. Verify with show vlan brief, and check per-port mode with show interfaces status. If a PC can't ping its neighbor but both link lights are green, suspect they landed in different VLANs before suspecting cabling.

3.5 DTP and why you hardcode everything

DTP (Dynamic Trunking Protocol) lets Cisco ports negotiate trunking automatically via modes: dynamic desirable (older default, actively asks), dynamic auto (modern default, agrees if asked), trunk (forces), access (refuses). Auto + auto = never trunks — a classic surprise. Worse, negotiation protocols are attack surface for VLAN-hopping tools like Yersinia.

*Only if the far side actually responds; †with DTP disabled the trunk side stays down. Production answer: hardcode both ends and kill negotiation entirely:

S1(config-if)# switchport mode trunk
S1(config-if)# switchport nonegotiate

3.6 Inter-switch design: allowing VLAN lists properly

Trunks pass every VLAN by default; pruning the list is hygiene and security — Sales traffic has no business crossing the Tech closet. Configure identically on both ends and keep the native VLAN out of harm's way:

S1(config)# interface gi0/1
S1(config-if)# switchport mode trunk
S1(config-if)# switchport trunk native vlan 99
S1(config-if)# switchport trunk allowed vlan 10,20,99
S1# show interfaces trunk

Port      Mode         Encapsulation  Status    Native vlan
Gi0/1     on           802.1q         trunking  99

Port      Vlans allowed on trunk
Gi0/1     10,20,99

Mismatched native VLANs don't fully break a trunk — traffic leaks into the wrong VLAN and CDP logs "native VLAN mismatch" warnings, which makes this fault deliciously exam-worthy. When a same-VLAN pair works within a switch but dies across the trunk, check the allowed list first.

🎯 Module goal: Take any IPv4 address + prefix and state its network, broadcast, and host range in under 15 seconds — then design a full VLSM plan from a requirements table. This is the highest-ROI skill on the entire exam.

4.1 Binary math refresher → masks demystified

Every octet is eight bits worth 128, 64, 32, 16, 8, 4, 2, 1. The subnet mask is just a binary fence: 1-bits = network side, 0-bits = host side. /24 means 24 ones followed by 8 zeros (255.255.255.0); /26 means 26 ones — the fourth octet is 128+64 = 192. The router finds an address's network by bitwise-ANDing it with the mask; you can do the same trick mentally once you know block sizes.

AND example:  192.168.10.77/26
Address .77 = 01001101
Mask    /26 = 11000000
AND result =  01000000 = 64   → network 192.168.10.64

Powers of two are your real tool: hosts per prefix = 2^(host bits) − 2 (minus network + broadcast). Memorize the ladder: 2−2=…, /25→126, /26→62, /27→30, /28→14, /29→6, /30→2.

4.2 /8 through /30 patterns; the block-size method for speed

Block size = 256 − (last nonzero mask octet). Networks increment by that size in the "interesting" octet: /26 → blocks of 64 → boundaries at 0, 64, 128, 192. That single subtraction replaces all scary binary arithmetic.

4.3 Network/broadcast/host ranges in under 15 seconds

The five-step sprint — work this exact example with me: find everything about 192.168.10.77/26.

Step 1  Mask octet: /26 → 192 → block = 256-192 = 64
Step 2  Boundaries: 0, 64, 128, 192
Step 3  77 falls between 64 and 127:
          NETWORK    = 192.168.10.64
          BROADCAST  = next boundary - 1 = 192.168.10.127
Step 4  HOST RANGE = 192.168.10.65 - 192.168.10.126
Step 5  Sanity: usable = 126-65+1 = 62 = 2^6 - 2  ✓

One more: 10.1.1.199/28
Block = 256-240 = 16 → 192, 208 → 199 lives in 192-207
Network 10.1.1.192 | Broadcast 10.1.1.207 | Hosts .193-.206

When the interesting octet isn't the last one (e.g. /18, /20), the logic is identical but applied to the third octet: 172.16.37.5/20 → block 16 → networks at 172.16.0, 16, 32 → network 172.16.32.0, broadcast 172.16.47.255, hosts 172.16.32.1–172.16.47.254.

4.4 VLSM design from a requirements table

VLSM (Variable Length Subnet Masking) lets different subnets have different sizes so a 60-host Sales floor doesn't waste a /24. Method: sort requirements largest-first, pick the smallest prefix that fits each, allocate sequentially leaving no gaps:

Given 192.168.1.0/24:
  Sales 60 hosts  → needs 62+ → /26 (block 64)
  Tech  30 hosts  → needs 30+ → /27 (block 32)
  Mgmt  12 hosts  → needs 14+ → /28 (block 16)
  WAN x2 links    → 2 each    → /30 (block 4)

Allocation (largest first):
  SALES  192.168.1.0/26     hosts .1 - .62      bc .63
  TECH   192.168.1.64/27    hosts .65 - .94     bc .95
  MGMT   192.168.1.96/28    hosts .97 - .110    bc .111
  WAN-A  192.168.1.112/30   hosts .113 - .114   bc .115
  WAN-B  192.168.1.116/30   hosts .117 - .118   bc .119

Note how each new subnet starts exactly where the previous broadcast ended plus one — no overlaps, no wasted space. On the exam, sketch the number line and drop blocks in descending order; overlapping subnets are always an answer-choice distractor built from someone allocating out of order.

4.5 Private RFC1918 ranges and a NAT preview

RFC1918 reserved three ranges for internal use — they don't route on the public internet, so every organization reuses them freely:

To reach the internet, these addresses get translated at your edge — that's NAT, Module 8's star. Two neighbors to recognize on sight: 169.254.0.0/16 APIPA (DHCP failed, host self-assigned) and 127.0.0.0/8 loopback. Spotting "this address shouldn't appear on a wire" is a recurring troubleshooting question style.

4.6 Daily drills: make it automatic

Subnetting is a motor skill, not knowledge. Do ten problems daily: five random address/prefix lookups, three VLSM allocations, two "which subnet does X belong to" questions. Time yourself; target 15 seconds each by week's end. Paper first — writing the ladder by hand builds the reflex apps let you skip. When you stop reaching for scratch paper during Packet Tracer labs, you're ready.

🎯 Module goal: Read a routing table like a native speaker, build static and default routes that actually forward, and get VLANs talking to each other twice — with router-on-a-stick AND with SVIs.

5.1 Routing table anatomy: L/C/S codes and longest-prefix match

A router forwards packets by consulting its table of known destinations. Each line starts with a source code: Local (the interface's own /32), Connected (a subnet on an up interface), Static (hand-entered), plus dynamic protocol codes you'll meet in Module 6 (O = OSPF). The L and C entries appear automatically the moment an interface has an IP address — they're the foundation everything else leans on.

R1# show ip route
Codes: L - local, C - connected, S - static, O - OSPF...
Gateway of last resort is 203.0.113.1 to network 0.0.0.0

C    192.168.10.0/24 is directly connected, GigabitEthernet0/0
L    192.168.10.1/32 is directly connected, GigabitEthernet0/0
S    10.5.0.0/16 [1/0] via 172.16.0.2
O    172.20.0.0/24 [110/65] via 172.16.0.2, GigabitEthernet0/1
S*   0.0.0.0/0 [1/0] via 203.0.113.1

The bracket shows [administrative distance/metric] — trust ranking when two protocols know the same prefix. But the forwarding rule outranks everything: longest-prefix match wins. A /26 route beats a /24 for the same destination even if the /24 came from a "more trustworthy" source. When two identical-length routes exist, only then does AD break the tie.

5.2 Static routes and default routes (plus floating backups)

R1(config)# ip route 10.5.0.0 255.255.0.0 172.16.0.2
R1(config)# ip route 0.0.0.0 0.0.0.0 203.0.113.1
R1(config)# ip route 10.5.0.0 255.255.0.0 192.168.99.2 254

Line one pins remote subnet 10.5.0.0/16 behind next-hop 172.16.0.2. Line two is the default route — the "everything else" door every internet edge needs; without it your LAN reaches nothing outside its own subnets. Line three re-advertises the same destination with administrative distance 254: it sits unused until the primary static (AD 1) disappears, then springs to life. That's a floating static, poor-man's failover.

On Ethernet links prefer a next-hop IP over an exit-interface alone — pointing at an interface makes the router ARP for every possible destination, which works but bloats memory. The next-hop must itself be reachable via a connected route; if you typo it, the route installs yet never forwards, which is exactly why we verify:

R1# ping 10.5.1.1
R1# traceroute 10.5.1.1
R1# show ip route 10.5.1.1

5.3 Router-on-a-stick: subinterfaces + dot1q for inter-VLAN routing

VLANs isolate traffic, so VLAN-to-VLAN needs a Layer 3 hop. The classic cheap design: one physical router port, chopped into logical subinterfaces, each tagging for a different VLAN across a trunk to the switch:

R1(config)# interface g0/0.10
R1(config-subif)# encapsulation dot1Q 10
R1(config-subif)# ip address 192.168.10.1 255.255.255.0
R1(config-subif)# interface g0/0.20
R1(config-subif)# encapsulation dot1Q 20
R1(config-subif)# ip address 192.168.20.1 255.255.255.0
R1(config-subif)# interface g0/0
R1(config-if)# no shutdown          ! physical port must be UP

Switch side:
SW1(config)# interface gi0/1
SW1(config-if)# switchport mode trunk
SW1(config-if)# switchport trunk allowed vlan 10,20

Each VLAN's hosts set their default gateway to the matching subinterface IP. Watch the classic failure: forgetting no shutdown on the PHYSICAL interface leaves every subinterface down too — subinterfaces inherit the parent's state.

5.4 SVIs: the modern multilayer-switch alternative

DIST-SW(config)# ip routing
DIST-SW(config)# interface vlan 10
DIST-SW(config-if)# ip address 192.168.10.1 255.255.255.0
DIST-SW(config-if)# interface vlan 20
DIST-SW(config-if)# ip address 192.168.20.1 255.255.255.0

A switched virtual interface is a virtual routed port per VLAN living inside the Layer 3 switch itself. No trunk bottleneck to a separate router, no single point of failure beyond the switch, hardware-speed inter-VLAN forwarding. Two requirements people forget: global ip routing must be enabled, and each SVI stays down until at least one active access/trunk port carries that VLAN. ROAS remains perfect for small sites and exam labs; SVIs are what real campuses run.

5.5 Connected vs local routes and next-hop reachability checks

The C entry says "this subnet hangs off this interface"; the paired L entry (/32) is the router's own address — useful for management pings and for understanding why routers answer on their interface even from foreign subnets. Static and dynamic routes both depend on that connected base: IOS installs a route only if its next hop resolves through something in the table. So troubleshooting cascades outward: can't reach 10.5.x? → does the route exist? → does its next hop have a route? → is that interface up/up? → then test hop-by-hop with traceroute and read where replies stop dying.

🎯 Module goal: Bring up OSPF neighbors on demand, read their state machine like a story, and verify routes with the three show commands that solve 90% of real adjacency problems.

6.1 Link-state vs distance-vector intuition

Distance-vector protocols (RIP, EIGRP) trade rumors: "the destination is 3 hops away, ask my neighbor." Each router knows only second-hand summaries. Link-state protocols (OSPF) do something smarter — every router floods its own connections (link-state advertisements) to everyone in the area, so all routers build the identical map of the topology and independently run Dijkstra's SPF algorithm against it.

Why networks care: rumor-based designs converge slowly and loop easily as they grow; link-state designs reconverge in milliseconds after a change and scale cleanly inside structured areas. The cost is memory and CPU for the map — which is exactly why areas exist to keep maps small. On the exam, "fast convergence + full topology knowledge" is the link-state signature answer.

6.2 Router ID, areas and hello/dead timers

Each OSPF router needs a unique 32-bit identity — the Router ID, chosen in strict priority: manual router-id command → highest loopback IP → highest active physical interface IP. Set it explicitly; never let elections surprise you:

R1(config)# router ospf 1
R1(config-router)# router-id 1.1.1.1
R1# clear ip ospf process          ! RID changes need a restart

Reset ALL OSPF processes? [no]: yes

The process ID after router ospf is locally significant — two routers can use different numbers and still become neighbors. CCNA keeps everything in area 0 (the backbone); multi-area is beyond scope but know that areas bound SPF work. On broadcast networks hello packets fire every 10 s with a dead interval of 40 s (4× hello). These values must match between neighbors or no adjacency forms, period.

6.3 Neighbor states: the DOWN→FULL journey

OSPF adjacencies walk a defined ladder, and each stuck rung names your problem:

• DOWN / INIT — sending hellos, hearing nothing back (or one-way hearing).
• 2WAY — hellos exchanged both ways; on multiaccess links non-DR routers park here legitimately.
• EXSTART / EXCHANGE — negotiating who leads DBD exchange; MTU mismatches freeze you here forever.
• LOADING — requesting missing LSAs via LSRs; hangs mean corrupted/missing advertisements.
• FULL — databases synchronized. This is success.

R1# show ip ospf neighbor

Neighbor ID   Pri   State      Dead Time   Address     Interface
2.2.2.2        1    FULL/BDR   00:00:35    10.0.0.2    GigabitEthernet0/1
R1# debug ip ospf adj
OSPF: Hello from 2.2.2.2 with mismatched hello timer...

6.4 network statements and wildcard masks done right

Inside router config mode, network statements decide which interfaces participate. The wildcard mask is an inverse mask: 0 = must match exactly, 255 = don't care. So 192.168.10.0 0.0.0.255 matches any interface whose address starts 192.168.10.x. Flip every subnet-mask octet (255↔0, 240↔15) and you have the wildcard.

R1(config)# router ospf 1
R1(config-router)# network 10.0.0.0 0.0.0.3 area 0     ! WAN link
R1(config-router)# network 192.168.10.0 0.0.0.255 area 0
R1(config-router)# network 192.168.20.0 0.0.0.255 area 0

Modern alternative, per-interface:
R1(config-if)# ip ospf 1 area 0

6.5 Passive interfaces and DR/BDR election

Sending hellos out user-facing ports wastes bandwidth and invites rogue-neighbor attacks. Mark them passive — OSPF still advertises those subnets, it just stops chatting on them:

R1(config-router)# passive-interface default
R1(config-router)# no passive-interface g0/1   ! uplinks only

On Ethernet segments, routers elect a Designated Router and Backup instead of everyone syncing with everyone — n² adjacencies collapse into a hub-and-spoke around the DR. Priority (ip ospf priority 0-255, highest wins; 0 = never) breaks toward the highest Router ID on ties. Crucial subtlety: the election is non-preemptive. A higher-priority router arriving later does NOT steal the role until the current DR actually fails.

6.6 Verification: the commands that matter

R1# show ip ospf neighbor              ! adjacency health first
R1# show ip route ospf                 ! O routes learned
O    192.168.30.0/24 [110/65] via 10.0.0.2, ...
R1# show ip ospf interface brief       ! which ifs run OSPF, cost, timers
R1# show ip protocols                  ! RIDs, networks, passive ifs

The route bracket [110/65]: 110 is OSPF's administrative distance; 65 is the accumulated cost (reference bandwidth ÷ interface bandwidth — FastEthernet = 1 per hop). Read neighbors before routes: if neighbors aren't FULL, no amount of route-hunting helps. Fix layer-by-layer: interface up/up? correct network statements? matching timers? same subnet?

🎯 Module goal: Write ACLs that filter exactly the traffic you intend — first try — and lock down switch ports against rogue devices with port security and its Layer 2 allies.

7.1 ACL logic: top-down, implicit deny, placement direction

An access list is an ordered rule set evaluated top-down, first match wins — once a line matches, processing stops. The invisible final line of every ACL reads "deny any": anything not explicitly permitted is dropped. That implicit deny means a permit-only list needs no deny lines, but also that a one-line ACL permitting a subnet silently kills all other traffic through that interface.

Placement follows from where filtering happens: standard ACLs (source only) go close to the destination so they don't over-block traffic meant for other places; extended ACLs (specific protocols/ports) go close to the source to drop junk before it crosses the network. Direction matters too: in filters packets arriving INTO the interface, out filters packets leaving it. Draw the packet's path with arrows before writing a single line.

7.2 Standard vs extended syntax; wildcard fluency

Standard (1-99): source address only
R1(config)# access-list 10 permit 192.168.10.0 0.0.0.255

Extended (100-199): protocol + source + dest + port
R1(config)# access-list 110 permit tcp 192.168.10.0 0.0.0.255 host 172.16.1.50 eq 443

Wildcards are inverted masks: 0 = match exactly, 1 = ignore. /24 becomes 0.0.0.255; /26 becomes 0.0.0.63. Two shortcuts cover half your needs: host x.x.x.x (= 0.0.0.0) and any (= 255.255.255.255). Named ACLs are the modern style — descriptive names, sequence numbers letting you insert/delete individual lines (numbered ACLs can't be edited in place):

R1(config)# ip access-list extended WEB-ONLY
R1(config-ext-nacl)# 10 permit tcp 192.168.20.0 0.0.0.255 any eq 80
R1(config-ext-nacl)# 15 deny   tcp 192.168.20.0 0.0.0.255 any eq 23
R1(config-ext-nacl)# 20 permit ip any any
R1(config)# interface g0/1
R1(config-if)# ip access-group WEB-ONLY in

7.3 Filtering scenarios: telnet block, web-only subnets

Say Finance (192.168.10.0/24) may reach the server's FTP only, while Sales must be blocked from the server entirely. Order the specific lines first — a broad permit placed above would shadow them forever:

R1(config)# ip access-list extended SERVER-POLICY
R1(config-ext-nacl)# permit tcp 192.168.10.0 0.0.0.255 host 172.16.1.50 eq 21
R1(config-ext-nacl)# permit tcp 192.168.10.0 0.0.0.255 host 172.16.1.50 eq 20
R1(config-ext-nacl)# deny   ip 192.168.30.0 0.0.0.255 host 172.16.1.50
R1(config-ext-nacl)# permit ip any any
R1(config)# interface g0/0.10      ! closest to source
R1(config-if)# ip access-group SERVER-POLICY in

Verify with counters: show access-lists shows match hits per line — if your deny shows zero matches while traffic flows, the packet matched something above it or entered via another path.

7.4 Locking down vty lines for management

The most surgical ACL use: restrict who can even open a management session, independent of routing paths:

R1(config)# ip access-list standard MGMT-ONLY
R1(config-std-nacl)# permit host 192.168.99.5
R1(config-std-nacl)# deny any
R1(config)# line vty 0 4
R1(config-line)# access-class MGMT-ONLY in
R1(config-line)# transport input ssh

7.5 Switchport security: sticky MACs and violation modes

ACLs guard routers; port security guards the wall jack. Limit how many MACs a port learns and optionally pin them:

SW1(config)# interface fa0/5
SW1(config-if)# switchport mode access          ! required first
SW1(config-if)# switchport port-security maximum 2
SW1(config-if)# switchport port-security mac-address sticky
SW1(config-if)# switchport port-security violation shutdown

Sticky copies whatever MAC it learned into running-config automatically — no manual typing. Violation behavior is the exam's favorite table:

Recovering an err-disabled port takes two commands: fix the cause, then shutdown followed by no shutdown.

7.6 DHCP snooping + dynamic ARP inspection overview

Two more Layer 2 guards round out the defense. DHCP snooping treats ports as trusted (real uplinks/DHCP server) or untrusted (user jacks), dropping rogue DHCP OFFERs from attackers impersonating a server, and building a bindings table of legitimate IP↔MAC pairs. DAI consumes that table to validate every ARP reply — spoofed ARP announcements (the heart of man-in-the-middle attacks) get discarded. Know conceptually what each defends against; CCNA tests recognition over deep config.

🎯 Module goal: Configure the three faces of NAT — static, dynamic, PAT — read a translation table line by line, and understand how an enterprise edge actually meets the internet.

8.1 Inside/outside, local/global terminology untangled

NAT's four terms trip everyone once, so anchor them with one sentence: NAT rewrites addresses at a boundary router, and every address has both a local (as seen inside its network) and a global (as seen outside) identity. So: inside local = your PC's real private IP (192.168.1.10); inside global = the public IP the world sees representing that PC (203.0.113.5); outside local/global = how you perceive the remote end (usually identical unless the outside also gets translated).

The router marks interfaces ip nat inside and ip nat outside; translations happen only for packets crossing between those two worlds. If you forget to tag one interface, everything else can be perfect and nothing translates.

8.2 Static NAT for published servers

Static NAT pins one inside address permanently to one outside address — the standard way to publish an internal web server. Outside users never learn the private IP; they aim at the public mapping and the router forwards:

R1(config)# ip nat inside source static 192.168.1.50 203.0.113.5
R1(config)# interface g0/0
R1(config-if)# ip nat inside
R1(config-if)# interface g0/1
R1(config-if)# ip nat outside

Port-forwarding flavor (one port only):
R1(config)# ip nat inside source static tcp 192.168.1.50 80 203.0.113.5 80

8.3 PAT overload — how your home router works, configured

Port Address Translation multiplexes thousands of private IPs behind ONE public IP by tagging each session with a unique source port — exactly what every home broadband box does. The router keeps a table of (private IP, port) → (public IP, translated port) so return traffic finds its way back:

R1(config)# access-list 1 permit 192.168.1.0 0.0.0.255
R1(config)# ip nat inside source list 1 interface g0/1 overload
R1(config)# interface g0/0
R1(config-if)# ip nat inside
R1(config-if)# exit
R1(config)# interface g0/1
R1(config-if)# ip nat outside

Read it as: "traffic from ACL 1 going out g0/1 gets rewritten to g0/1's address, with ports distinguishing sessions." The word overload is what turns dynamic NAT into PAT — omit it and you get one-to-one pool behavior instead, which is the classic lab-killer mistake.

8.4 Verifying translations line by line

R1# show ip nat translations
Pro  Inside global      Inside local       Outside local    Outside global
tcp  203.0.113.5:1024   192.168.1.10:49152 198.51.100.7:443 198.51.100.7:443
tcp  203.0.113.5:80     192.168.1.50:80    ---              ---

R1# show ip nat statistics
Total translations: 2 (0 static, 2 dynamic, 0 extended)
Outside interfaces: GigabitEthernet0/1
Inside interfaces:  GigabitEthernet0/0
Hits: 1843  Misses: 12
R1# clear ip nat translation *   ! wipe dynamic entries while testing

The first line reads like a story: your PC .10 spoke from local port 49152; the world saw 203.0.113.5 port 1024 talking to 198.51.100.7 on 443. The static entry (port 80) has no expiry — it lives until removed. Hits climbing while pings fail means translation works but routing beyond doesn't; hits frozen at zero means NAT isn't even being consulted.

8.5 WAN topologies survey and internet edge design

Beyond NAT sits the WAN itself, and CCNA wants survey-level literacy: leased-line point-to-point links (simple, expensive, dying), MPLS provider clouds connecting many sites (hub-and-spoke or partial mesh, provider handles paths), broadband/cable/fiber with VPN overlays across the internet (cheap, ubiquitous), and modern SD-WAN that picks a path per-application across all of them. The exam cares that you match topology to requirement: two sites → point-to-point; fifty sites on a budget → MPLS or VPN hub-and-spoke; branch resilience → dual WAN + floating default routes from Module 5.

The internet edge bundles these lessons: edge router runs PAT toward the ISP, static NAT publishes any servers into a DMZ zone, and an ACL from Module 7 filters inbound sessions before they touch inside networks.

8.6 QoS concepts: classification basics

NAT and WAN links share one truth: bandwidth at the edge is scarce, so routers need rules about which packets matter. QoS starts with classification and marking — identifying traffic types (voice, video, transactional data, bulk backup) and stamping them, typically in the DSCP field of the IP header (EF for voice, AF classes for data tiers). Marking happens once at a trust boundary near the source; downstream devices then trust the mark and queue accordingly: voice gets priority queuing, backups get whatever remains. CCNA tests the vocabulary and the concept — classify, mark, queue — not deep policy math.

🎯 Module goal: Stand up the services every real network leans on daily — DHCP, DNS, NTP, syslog and discovery protocols — and manage device software like an administrator, not a tourist.

9.1 DHCP: DORA process, pools, exclusions and relay

A new client needs four broadcast steps — Discover (client shouts "any DHCP servers?"), Offer (server proposes an address + lease), Request (client formally asks for one offer), Acknowledgment (server confirms, lease starts). Remember it as DORA. Everything rides on broadcasts, which is why a central DHCP server can't serve remote subnets without help.

R1(config)# ip dhcp pool LAN10
R1(dhcp-config)# network 192.168.10.0 255.255.255.0
R1(dhcp-config)# default-router 192.168.10.1
R1(dhcp-config)# dns-server 8.8.8.8
R1(config)# ip dhcp excluded-address 192.168.10.1 192.168.10.19
R1# show ip dhcp binding          ! who has which lease

RELAY on a non-DHCP router facing the clients:
R2(config)# interface g0/0
R2(config-if)# ip helper-address 192.168.99.5

The ip helper-address converts the client's broadcast into a unicast aimed at the server — the relayed packet even records the original subnet so the server picks the right pool. Exclude static ranges (routers, printers, servers) or you'll hand out addresses that already belong to someone.

9.2 DNS record types and resolution debugging

DNS turns names into numbers through a hierarchy: your resolver asks root servers, then the .com TLD, then the domain's authoritative server. The record types that matter:

• A — hostname → IPv4 address (the everyday workhorse).
• PTR — reverse lookup: IP → name (mail servers check these).
• MX — where mail for this domain goes, with preference numbers.
• CNAME — alias pointing one name at another name.

Debug from the bottom up: nslookup www.example.com shows both the answer and WHICH server answered it. Wrong IP returned → stale cache or bad record; timeouts → resolver unreachable; works by IP but not name → DNS layer, not connectivity.

9.3 NTP: why time equals logging sanity

When three devices log the same incident with timestamps minutes apart, forensics is guesswork — certificates also fail validation on skewed clocks. NTP synchronizes everything against a hierarchy of strata: stratum 0 is the atomic/GPS source, each hop down adds one, so internal servers sit at stratum 2–3 serving the fleet. In Packet Tracer, point routers at a server's NTP service (or make one router authoritative):

R1(config)# ntp server 192.168.99.10
R2(config)# ntp master 3            ! lab-only fallback source
R1# show ntp status
Clock is synchronized, stratum 4
R1# show ntp associations

9.4 Syslog severities and where logs go

Syslog ranks events 0–7, and the numbering feels backwards at first — lower number = more severe:

Configure a severity ceiling per destination: console gets critical only, while a central collector receives everything worth keeping:

R1(config)# logging host 192.168.99.20
R1(config)# logging trap warning      ! send level 0-4 upward
R1(config)# service timestamps log datetime msec

9.5 CDP/LLDP discovery maps

Cisco Discovery Protocol and vendor-neutral LLDP let devices announce themselves to neighbors — model, port, management IP. They build honest topology maps when documentation lies:

SW1# show cdp neighbors detail
Device ID: R1.cisco.local
  IP Address: 10.0.0.1
  Port ID: GigabitEthernet0/0 | Local Port: Gi0/1
SW1# show lldp neighbors

Both are information leakage on edge devices facing untrusted networks — best practice disables them there (no cdp enable) while leaving them running internally.

9.6 Backup/restore configs; IOS upgrade awareness

Running-config lives in RAM and dies on reboot; startup-config lives in NVRAM and survives. Saving is non-negotiable after every intentional change:

R1# copy running-config startup-config     ! or: write memory
R1# copy running-config tftp://192.168.99.30/R1-backup.cfg
R1# copy tftp://192.168.99.30/R1-backup.cfg running-config
R1# show flash:                            ! IOS images stored here

An IOS upgrade follows the same rhythm at scale: back up config AND current image, download the new .bin via TFTP/USB into flash, verify its integrity, point boot system at it, reload, confirm version, keep the old image as rollback. Know the sequence conceptually — CCNA tests awareness, not production change windows.

🎯 Module goal: Understand controller-based wireless, speak the automation era's data languages, and walk into the exam with a rehearsed game plan instead of hope.

10.1 WLC + LAP architecture; autonomous vs controller APs

An autonomous AP is self-contained — its own config, its own SSIDs, managed one at a time. Fine for a café, unmanageable at fifty APs. The modern split is Lightweight Access Points (LAPs) that hold only radios, paired with a Wireless LAN Controller (WLC) that centralizes every decision: which SSIDs exist, which VLANs clients land in, roaming, security policy, firmware. LAPs join their WLC over CAPWAP tunnels — one control channel (management) and one data channel carrying client traffic to be centrally switched or forwarded locally.

The exam framing: "split-MAC architecture" = time-critical bits (beacons, acknowledgments, encryption) stay on the AP; everything policy-related lives on the WLC. When a question mentions zero-touch provisioning or seamless roaming across a campus, it's describing controller-based wireless.

10.2 2.4/5 GHz channels, non-overlapping design, RSSI basics

The 2.4 GHz band offers ~14 channels but only three are non-overlapping in practice: 1, 6 and 11. Adjacent-AP designs must cycle through those three so neighboring cells never share spectrum. The 5 GHz band brings many more channels (some reserved for radar/DFS), less interference from microwaves and Bluetooth, shorter range and weaker wall penetration — that trade-off defines coverage planning.

Signal strength is read as RSSI in dBm, always negative: −50 dBm is excellent, −67 dBm is the practical floor for voice/video, below −80 you're fighting for scraps. Compare against noise floor for SNR; interference raises noise even with decent signal. Design goal: overlapping coverage areas but NON-overlapping channels.

10.3 WPA2/WPA3-Personal vs Enterprise config differences

Personal mode gives everyone the same passphrase — leak it once and strangers are inside until you rotate it everywhere. Enterprise authenticates each user individually against RADIUS, enabling per-user revocation and logging; WPA3-Personal's SAE replaces the crackable PSK four-way handshake with a modern key exchange resistant to offline guessing. Exam shorthand: PSK + no server = Personal; RADIUS + per-user = Enterprise.

10.4 Controller GUI walkthrough in Packet Tracer

Packet Tracer ships a WLC (3504/2504) plus lightweight APs — enough for the real workflow: ① connect the WLC's management port to the switch, give both a management VLAN; ② let APs discover and join (they need DHCP option 43 or same-subnet discovery); ③ in the WLC GUI, create a WLAN: set SSID, map it to an interface/VLAN, choose WPA2-PSK with your passphrase; ④ enable and watch clients associate. Click through Status → WLANs and MONITOR pages until the join/associate lifecycle feels familiar — the CCNA simlets mirror this screen layout closely.

10.5 Automation era: JSON/YAML literacy, REST APIs, Ansible

Networks are becoming software-driven: controllers expose APIs, devices ship REST interfaces, engineers script changes instead of typing them. Three literacies cover the CCNA scope. First, structured data: JSON (curly braces, key-value pairs, arrays — what machines exchange):

{
  "hostname": "R1",
  "interfaces": [
    { "name": "GigabitEthernet0/0", "enabled": true }
  ]
}

YAML (indentation-based, human-friendly — what automation tools are written in):

hostname: R1
interfaces:
  - name: GigabitEthernet0/0
    enabled: true

Second, REST APIs: HTTP verbs as actions — GET reads, POST creates, PUT/PATCH updates, DELETE removes — answered with status codes (200/201 success, 404 missing, 401 unauthorized). Third, tools like Ansible push idempotent playbooks across hundreds of devices: run it twice and nothing changes the second time. You won't configure these on the exam; you WILL read JSON/YAML snippets and match them to descriptions.

10.6 Exam game plan: question types, time budgeting, lab sims

The 200-301 runs about 120 minutes for roughly 100+ questions: multiple choice, multi-select ("choose two"), drag-and-drop categorization, and occasional lab/simlet items where you actually enter IOS commands. Budget ≈1 minute per question: answer instantly when certain, FLAG and move when stuck — flagged questions take seconds to revisit and a stalled minute-one question costs three easy ones later. For sims, type fast and verify with show commands before submitting; partial credit exists for correct configuration steps.

• Read the LAST line of long scenario questions first — it states what's actually asked.
• In multi-select, count the required answers before reading options; eliminate to fit.
• Never leave blanks: unanswered questions score zero, guesses score sometimes.

10.7 Final review cadence: weak-area loop plus two timed mocks

Last two weeks follow a loop, not linear rereading: take a timed mock → catalog every miss by topic → rebuild that topic hands-on in Packet Tracer within 48 hours → re-test only those topics → repeat. Two full timed mocks minimum, target ≥85% each; if mock two lands there, the real exam holds no surprises. Stop learning new material five days out — final days belong to subnetting drills, ACL order-of-operations, and sleeping properly. Book the exam while momentum carries you: candidates who schedule a date finish preparation dramatically more often than those waiting to "feel ready."