Network Device Roles
Know what each device does, which OSI layer it operates at, and when to use it. Exam topic 1.1.
Routers connect different IP networks together. Forwarding decisions are based on the destination IP address and the routing table. Each interface sits on a different subnet.
Traditional firewalls filter by IP/port. NGFWs add deep packet inspection, application awareness, user identity, and integrated IPS.
PoE eliminates separate power adapters for IP phones, APs, and IP cameras by delivering power through Cat5e/Cat6 cables.
Network Topology Architectures
Exam topic 1.2 — know the purpose and characteristics of each design.
Two-Tier (Collapsed Core)
Core and Distribution layers are merged into one. Access switches connect directly to this layer. Used in smaller campus networks where cost matters more than scalability.
Three-Tier (Hierarchical)
Dedicated Core, Distribution, and Access layers. Core = high-speed backbone with no policy. Distribution = ACLs, routing, QoS. Access = end-user ports.
Spine-Leaf
Every Leaf connects to every Spine. No Leaf-to-Leaf or Spine-to-Spine links. Predictable latency — always exactly 2 hops. Scales horizontally by adding Leaf switches.
WAN Topologies
Connect geographically separate sites. Design choices balance redundancy, bandwidth, and cost.
SOHO
Small Office/Home Office — one all-in-one device (router + switch + WAP + firewall) connects users to the internet via broadband.
On-Premises vs Cloud
On-prem: company owns all hardware in its own DC. Cloud: resources hosted by a provider (AWS, Azure, GCP).
Physical Interfaces & Cabling
Exam topics 1.3 and 1.4 — cabling types, distances, speeds, and interface errors.
Switching Concepts
Exam topic 1.13 — MAC learning, aging, frame switching modes, and flooding.
When a frame arrives, the switch reads the source MAC and records it with the ingress port. This is MAC learning — it builds the Content Addressable Memory (CAM) table.
Receives entire frame, checks FCS, then forwards. Filters corrupt frames. Adds latency. Default on modern Cisco switches.
Reads only the first 6 bytes (dst MAC) then forwards immediately. Very low latency but forwards corrupt frames — no FCS check.
Reads first 64 bytes then forwards. Filters runts (collision fragments). Compromise between the other two modes.
| Device | OSI Layer | Broadcast Domain | Collision Domain | Forwarding |
|---|---|---|---|---|
| Hub | L1 | 1 shared | 1 shared | Repeats all bits |
| Switch | L2 | 1 per switch | 1 per port ✓ | MAC address |
| Router | L3 | 1 per interface ✓ | 1 per interface ✓ | IP address |
Virtualization Fundamentals
Exam topic 1.12 — server virtualization, containers, and VRFs.
A hypervisor abstracts physical hardware and lets multiple VMs share one server. Each VM has its own OS, virtual CPU, RAM, and virtual NICs.
Runs directly on hardware. No host OS. Most efficient. Examples: VMware ESXi, Hyper-V, KVM.
Runs on top of a host OS. Less efficient. Examples: VirtualBox, VMware Workstation. Labs and dev use.
| Feature | VMs | Containers |
|---|---|---|
| OS | Full guest OS each | Share host kernel |
| Size | GBs | MBs |
| Startup | Minutes | Seconds / ms |
| Isolation | Strong (full OS) | Process-level |
| Use case | Full OS, legacy apps | Microservices, CI/CD |
VRF creates multiple completely isolated routing tables on a single router. Traffic in one VRF cannot reach another without explicit inter-VRF routing.
NFV moves traditional network appliances (firewalls, routers, load balancers) from dedicated hardware onto VMs or containers running on standard servers.
Verifying IP on Client Operating Systems
Exam topic 1.10 — verify IP address, subnet mask, gateway, and DNS on Windows, macOS, and Linux.
🪟 Windows
🍎 macOS
🐧 Linux
The OSI model is a 7-layer theoretical framework used for understanding and troubleshooting. The TCP/IP model is the 4-layer practical model that modern networks actually implement. Cisco exams expect you to map between both and know which protocols live at each layer.
| OSI Layer | Name | TCP/IP Layer | PDU | Key Protocols | Cisco Device |
|---|---|---|---|---|---|
| 7 | Application | Application | Data | HTTP, HTTPS, FTP, DNS, DHCP, SSH, Telnet, SNMP | — |
| 6 | Presentation | Data | SSL/TLS, JPEG, ASCII | — | |
| 5 | Session | Data | NetBIOS, RPC, SIP | — | |
| 4 | Transport | Transport | Segment | TCP, UDP | Firewall (port) |
| 3 | Network | Internet | Packet | IP, ICMP, OSPF, EIGRP, BGP | Router, L3 Switch |
| 2 | Data Link | Network Access | Frame | Ethernet, 802.11, PPP, HDLC, ARP | Switch, Bridge |
| 1 | Physical | Bits | Cables, RJ-45, SFP, radio waves | Hub, Repeater |
Every Ethernet frame wraps a payload with addressing and error-checking fields. Understanding the frame helps with troubleshooting CRC errors, MTU issues, and 802.1Q tagging.
Before a device can send a frame, it must know the MAC address of the next-hop destination. ARP resolves an IP address to a MAC address on the local network segment.
1. Sender checks ARP cache — if entry found, use it
2. If not found → sends ARP Request as broadcast (FF:FF:FF:FF:FF:FF)
3. Target with matching IP replies with ARP Reply (unicast) containing its MAC
4. Sender caches the MAC:IP mapping (typically 4-hour TTL)
DHCP automates IP configuration. A client broadcasts to find a server, which offers an IP lease. The 4-way DORA handshake must complete before the client can communicate on the network.
ip helper-address — forwards broadcasts to server across routerDNS translates human-readable names (like cisco.com) to IP addresses. It uses a hierarchical distributed database. Understanding DNS query types is tested in network troubleshooting scenarios.
nslookup cisco.com or dig cisco.com to test resolution. If ping by IP works but ping by name fails → DNS issue, not routing.TCP provides reliable, ordered, connection-oriented delivery. UDP is lightweight and connectionless — used when speed matters more than reliability.
| Feature | TCP | UDP |
|---|---|---|
| Connection | Connection-oriented (3-way handshake) | Connectionless |
| Reliability | Guaranteed delivery, retransmission on loss | Best-effort, no retransmission |
| Ordering | Sequence numbers ensure in-order delivery | No ordering |
| Flow control | Sliding window, congestion control | None |
| Header size | 20–60 bytes | 8 bytes |
| Speed | Slower (overhead) | Faster (low overhead) |
| Use cases | HTTP/S, FTP, SSH, Telnet, SMTP | DNS, DHCP, TFTP, SNMP, VoIP, video streaming |
Ports 0–1023 are well-known (IANA assigned). Ports 1024–49151 are registered. Ports 49152–65535 are ephemeral (dynamic client ports). ACL configuration requires knowing port numbers precisely.
| Port | Protocol | Transport | Notes |
|---|---|---|---|
| 20/21 | FTP | TCP | 20=data, 21=control |
| 22 | SSH | TCP | Secure remote management |
| 23 | Telnet | TCP | Cleartext — avoid |
| 25 | SMTP | TCP | Email sending |
| 53 | DNS | UDP/TCP | UDP for queries, TCP for transfers |
| 67/68 | DHCP | UDP | 67=server, 68=client |
| 69 | TFTP | UDP | Trivial FTP — no auth |
| 80 | HTTP | TCP | Web cleartext |
| 110 | POP3 | TCP | Email retrieval |
| 143 | IMAP | TCP | Email retrieval (folder sync) |
| 161/162 | SNMP | UDP | 161=agent polling, 162=trap |
| 443 | HTTPS | TCP | Web encrypted (TLS) |
| 514 | Syslog | UDP | Log forwarding |
| 1812/1813 | RADIUS | UDP | Auth/Accounting |
A collision domain is a network segment where simultaneous transmissions cause collisions. A broadcast domain is the set of all devices that receive a Layer 2 broadcast. Reducing both improves performance and security.
| Device | Collision Domains | Broadcast Domains | Notes |
|---|---|---|---|
| Hub | 1 (all ports share) | 1 | Half-duplex, CSMA/CD required |
| Bridge (2-port) | 2 (one per port) | 1 | Segments collision domains |
| Switch (24-port) | 24 (one per port) | 1 per VLAN | Full-duplex, no collisions |
| Router | One per interface | One per interface | Breaks both domains |
Packet Tracer Labs
Hands-on fundamentals walkthroughs — open Cisco Packet Tracer alongside these steps.
Topic Checklist
Tick each topic as you learn it. Progress saves automatically.