Jeremy's IT Lab CCNA Notes

Free CCNA v1.1 200-301 | Complete Course 2026

The official YouTube playlist for Jeremy's CCNA course.

Support:

• https://www.linkedin.com/company/jeremysitlab
• https://www.youtube.com/@JeremysITLab
• discord.com/invite/pkBYDnqFD9
• https://www.jeremysitlab.com
• https://x.com/jeremysitlab

---

Labs

This is the YouTube playlist of all the labs from Jeremy's IT CCNA course that I've completed.

Day 1

What is a network?

A computer network is a digital telecommunications network which allows nodes to share resources.

Nodes can consist of the following devices:

• Routers
• Switches
• Firewalls
• Servers
• Clients

---

Clients

Clients are devices that can access a service made available by a server.

---

Servers

A server is a device that provides services or resources to a client.

The same device can be a client in some situations, and a server in other situations.

---

Switches

Switches provide connectivity to hosts within the same LAN (Local Area Network).

---

Routers

Routers are used to provide connectivity between LANs.

---

Firewalls

• They are hardware devices that filter traffic between networks.
• They monitor and control network traffic based on configured rules.
• Can either be placed inside or outside the network.

Host based firewalls are software based applications that run on individual devices.

---

Day 2

Ethernet

Ethernet is a collection of network protocols/standards.

---

Ethernet Standards

• Ethernet standards are defined in the IEEE 802.3 standard in 1983.
• IEE stands for Institute of Electrical and Electronics Engineers.

---

Ethernet Standards (Copper)

Speed	Common Name	IEEE Standard	Informal Name	Maximum Length
10 Mbps	Ethernet	802.3i	10BASE-T	100 m
100 Mbps	Fast Ethernet	802.3u	100BASE-T	100 m
1 Gbps	Gigabit Ethernet	802.3ab	1000BASE-T	100 m
10 Gbps	10 Gig Ethernet	802.3an	10GBASE-T	100 m

---

UTP Cables

UTP = Unshielded Twisted Pair

They're limited to 100 meters.

• Unshielded
  • Means that the wires have no metallic shield, which makes them vulnerable to electromagnetic magnetic interferences.

The twisted wires helps protect against electromagnetic magnetic interferences.

Standard	Pairs Used
10BASE-T / 100BASE-T	2 pairs (4 wires)
1000BASE-T / 10GBASE-T	4 pairs (8 wires)

---

UTP Cables (10BASE-T, 100BASE-T)

Device Type	Transmit (Tx) Pins	Receive (Rx) Pins
Router	1 and 2	3 and 6
Firewall	1 and 2	3 and 6
PC	1 and 2	3 and 6
Switch	3 and 6	1 and 2

---

Fiber-Optic Connections

There are two types of fiber cables:

• Single-mode (SMF)
• Multimode (MMF)

---

Multimode Fiber

• Core diameter is wider than single-mode fiber.
• Allows multiple angles (modes) of light waves to enter the fiberglass core.
• Allows longer cables than UTP, but shorter cables than single-mode fiber.
• Cheaper than single-mode fiber.

---

Single-Mode Fiber

• Core diameter is narrower than multimode fiber.
• Light enters at a single angle (mode) from a laser-based transmitter.
• Allows longer cable lengths than both UTP and multimode fiber.
• More expensive then single-mode fiber.

---

Fiber-Optic Cable Standards

Informal Name	IEEE Standard	Speed	Cable Type	Maximum Length
1000BASE-LX	802.3z	1 Gbps	Multimode or Single-Mode	550 m (MM) / 5 km (SM)
10GBASE-SR	802.3ae	10 Gbps	Multimode	400 m
10GBASE-LR	802.3ae	10 Gbps	Single-Mode	10 km
10GBASE-ER	802.3ae	10 Gbps	Single-Mode	30 km

---

UTP vs Fiber-Optic Cabling

UTP	Fiber-Optic
Lower cost than fiber-optic.	Higher cost than UTP.
Shorter maximum distance than fiber-optic (~100m).	Longer maximum distance than UTP.
Can be vulnerable to EMI (Electromagnetic Interference).	No vulnerability to EMI.
RJ45 ports used with UTP are cheaper than SFP ports.	SFP ports are more expensive than RJ45 ports (single-mode is more expensive than multimode).
Emit (leak) a faint signal outside of the cable, which can be copied (= security risk).	Does not emit any signal outside of the cable (= no security risk).

---

Day 3

Protocols and Standards

A protocol is a set of rules defining how data should be communicated between devices over a network.

---

Who defines the standards?

Most networking standards are developed by independent standards organizations, not a single vendor, with participation from engineers at many companies.

Organization	Role	Examples
IEEE (Institute of Electrical and Electronics Engineers)	Develops many of the technologies used on local area networks	Ethernet (802.3), Wi-Fi (802.11)
IETF (Internet Engineering Task Force)	Open community that defines protocols used on the Internet	TCP, IP, UDP, HTTP, DNS, etc.

---

The TCP/IP Model

---

Layer 1: The Physical Layer

• Responsible for sending and receiving bits as electrical, optical, or radio signals over the medium.
• Defines things like cables, connectors, signal levels, and link speeds.
• Examples: copper UTP cables, fiber-optic cables, Wi-Fi radios and antennas, network interface cards (NICs).

---

Layer 2: The Local Network Layer

• Provides hop-to-hop delivery of messages on a local network.
  • A hop is a one step along the path between two devices: from one router or host, to the next router or host in the path.
• Uses MAC (Media Access Control) addresses to identify interfaces.
  • Each device connected to a LAN has a unique MAC address assigned to it.
• Protocols at this layer include:
  • Ethernet (IEEE 802.3)
  • Wi-Fi (IEEE 802.11)

---

Layer 3: The Internet Layer

• Provides end-to-end delivery between hosts across multiple networks.
• Uses IP addresses to identify hosts on a network.
• Routers operate at this layer, using the message's destination IP address to forward the message toward its final destination host.
• Protocols at this layer include:
  • IP (IPv4, IPv6)
  • ICMP (Internet Control Message Protocol)

---

Layer 4: The Transport Layer

• Provides end-to-end communication between application processes.
• Uses port numbers to identify the processes on each host.
• Runs mainly on the communicating hosts.
• Protocols at this layer include:
  • UDP (User Datagram Protocol)
  • TCP (Transmission Control Protocol)

---

Layer 5: The Application Layer

• The Application layer (layer 5) is where network communications meet applications.
• Defines how application processes format, send, and interpret data.
• Protocols at this layer define message formats and rules for specific tasks, such as:
  • Browsing web pages (HTTP/HTTPS)
  • Transferring files (FTP/TFTP)
  • Sending/Receiving email (SMTP, POP3, IMAP)
• Network infrastructure devices (routers, switches) don't care about application-layer details.

---

Encapsulation & Decapsulation

---

Protocol Data Units

• The combination of data and a L4 header is called a segment (TCP) or datagram (UDP).
• The combination of a segment/datagram and a L3 header is called a packet.
• The combination of a packet and a L2 header/trailer is called a frame. - The frame is what gets sent over the physical medium.

---

The OSI Model

---

Other Versions

---

Day 4

User EXEC Mode

Router>

• The > symbol indicates that you're in user EXEC mode.
• Router is the hostname of the device.
• User EXEC mode is very limited.
• Not able to make changes to the configuration.

---

Privileged EXEC Mode

To enter privileged EXEC mode from user EXEC mode you must run the enable command.

Router>enable
Router#

• The # symbol indicates that you're in privileged EXEC mode.
• Provides complete access to view the device's configuration, restart the device, etc.
• Cannot change the configuration, but can change the time on the device, save the configuration file, etc.

---

Global Configuration Mode

To make changes to any of the configurations on the device you must enter global configuration mode.

Router>enable
Router#configure terminal
Enter configuration commands, one per line. End with CNTL/Z.
Router(config)#

The configure terminal command enters global configuration mode.

---

Enable Password

You don't want just anyone to have the ability to make changes to the network configuration for security purposes, so must protect privileged EXEC mode with a password.

Router(config)#enable password CCNA

CCNA is the password.

• Passwords are case-sensitive.

---

Running-Config / Startup-Config

• There are two separate configuration files kept on the device at once.
• running-config is the current, active configuration file on the device. As you enter commands in the CLI, you edit the active configuration.

To look at the configuration file:

Router#show running-config
Building configuration...

Current configuration : 714 bytes
!
version 15.1
no service timestamps log datetime msec
no service timestamps debug datetime msec
no service password-encryption
!
hostname Router
!
!
!
enable password CCNA
!

To run the startup-config file:

Router#show startup-config
startup-config is not present

startup-config is not present this is because we haven't have saved the running config.

---

Saving The Configuration

Router#write
Building configuration...
 [OK]
Router# copy running-config startup-config
Destination filename [startup-config]?
Building configuration...
 [OK]
Router#

---

Service Password-Encryption

Router#configure terminal
Enter configuration commands, one per line. Ed with CNTL/Z.
Router(config)#service password-encryption

service password-encryption will encrypt all passwords.

service password-encryption is not very secure.

---

Enable Secret

The more secure version to encrypt passwords is the enable secret command.

Router(config)#enable secret Cisco

Cisco is the password.

enable secret uses the MD5 hashing algorithm.

If both the enable secret and enable password are configured, then the whatever password you had setup for enable password will be ignored.

enable secret is always encrypted by default.

---

Cancelling Commands

Router(config)#no service password-encryption

• The no keyword disable encryption for future passwords.
• Passwords that were already encrypted will not be decrypted.

---

Service Password-Encryption Summary

If you enable service password-encryption:

• Current passwords will be encrypted.
• Future passwords will be encrypted.
• The enable secret will not be affected (it's always encrypted).

If you disable service password encryption:

• Current passwords will not be decrypted.
• Future passwords will not be encrypted.
• enable secret will not be affected.

---

Day 5 (Part 1)

Local Area Networks (LANs)

Local area networks are networks confined to a small area like a home or small office.

• Routers are use to connect separate LANs.

---

OSI Model - PDUs

The different stages of preparing data to be forwarded are Protocol Data Units (PDUs).

---

Ethernet Frame

There are 5 fields in the ethernet frame header:

• Preamble
• SFD (Start Frame Delimiter)
• Destination
• Source
• Type (or Length)

There is only 1 field in the ethernet frame trailer:

• FCS (Frame Check Sequence)
  • Used by the receiving device to check if any errors occurred during the transmission.

Key points:

• The header and trailer are 26 bytes in length.
• The minimum size for an Ethernet frame is 64 bytes.
• The minimum payload for the Ethernet frame is 46 bytes.
• If the payload is less than 46 bytes, padding bytes are added.

---

Preamble & SFD

Preamble:

• Length: 7 bytes (56 bits).
• Alternating 1's and 0's.
• Allows devices to synchronize their receiver clocks.

SFD:

• Stands for 'Start Frame Delimiter'.
• Length: 1 byte (8 bits).
• Marks the end of the preamble, and the beginning of the rest of the frame.

The Preamble & SFD is usually not considered part of the Ethernet header. Therefore the size of the Ethernet header + trailer is 18 bytes.

---

Destination & Source

• Indicate the devices sending and receiving the frame.
• Mainly consist of the destination and source MAC address.
• MAC = Media Access Control.
• 6 byte (48 bit) address of the physical device.

---

Type / Length

• 2 bytes (16 bits).
• A value of 1500 or less in this field indicates the length of the encapsulated packet.
• A value of 1536 or greater in this field indicates the type of encapsulated packet, and the length is determined via other methods.

---

Frame Check Sequence (FCS)

• Stands for 'Frame Check Sequence'.
• 4 bytes (32 bits).
• Detects corrupted data by running a 'CRC' algorithm over the received data.
• CRC = 'Cyclic Redundancy Check'.

---

MAC Address

• Is globally unique.
• The first 3 bytes are the OUI (Organizationally Unique Identifier), which is assigned to the company making the device.
• The last 3 bytes are unique to the device itself.
• Written as 12 hexadecimal characters.

---

Day 6 (Part 2)

ARP

• ARP stands for 'Address Resolution Protocol'.
• APR is used to discover the Layer 2 address (MAC address) of a known Layer 3 address (IP address).
• Consists of two messages:
  • ARP Request
  • ARP Reply
• ARP Request is broadcast (sent to all hosts on the network).
• ARP Reply is unicast (the host that sent the request).

---

Ping

• A network utility that is used to test reachability.
• Measures round-trip time.
• Uses two messages:
  • ICMP Echo Request
  • ICMP Echo Reply

---

MAC Address Table

The command to view the MAC address table on a Cisco switch:

SW1#show mac address-table
          Mac Address Table
-------------------------------------------

Vlan    Mac Address       Type        Ports
----    -----------       --------    -----
   1    0c2f.b011.9d00    DYNAMIC     Gi0/0
   1    0c2f.b06a.3900    DYNAMIC     Gi0/2
Total Mac Addresses for this criterion: 2
SW1#

---

Clearing the MAC Address Table

This command will remove all dynamic MAC addresses from the table:

Total Mac Addresses for this criterion: 2
SW1#clear mac address-table dynamic
SW1#show mac address-table
          Mac Address Table
-------------------------------------------

Vlan    Mac Address       Type        Ports
----    -----------       --------    -----
SW1#

clear mac address-table dynamic

If the switch doesn't get any traffic from a certain MAC address for 5 minutes, it will remove the entry from the MAC address table, this process is called aging.

To remove a certain MAC address from the table:

SW1#clear mac address-table dynamic address 0c2f.b011.9d00
SW1#show mac address-table
          Mac Address Table
-------------------------------------------

Vlan    Mac Address       Type        Ports
----    -----------       --------    -----
   1    0c2f.b06a.3900    DYNAMIC     Gi0/2
Total Mac Addresses for this criterion: 1
SW1#

clear mac address-table dynamic address mac-address

You can clear a MAC address from the table by specifying the interface/port:

SW1#clear mac address-table dynamic interface Gi0/0
SW1#show mac address-table
          Mac Address Table
-------------------------------------------

Vlan    Mac Address       Type        Ports
----    -----------       --------    -----
   1    0c2f.b06a.3900    DYNAMIC     Gi0/2
Total Mac Addresses for this criterion: 1
SW1#

clear mac address-table dynamic interface interface-id

---

Day 7 (Part 1)

IPv4 Header

• IP addresses are 32 bits (4 bytes) in length.

---

IPv4 Addresses

An example IPv4 address:

192.168.1.254/24

• Each group is 8 bits.
• Each 8 bit group is called an octet.
• The /24 means the first 24 bits represents the network portion of the address.
• The remaining 8 bits represents the end host portion.

So 192.168.1 is the network portion and .254 is the host portion.

---

IPv4 Address Classes

Class	First octet	First octet numeric range
A	0xxxxxxx	0-127
B	10xxxxxx	128-191
C	110xxxxx	192-223
D	1110xxxx	224-239
E	1111xxxx	240-255

Classes A, B and C are the classes used for hosts, and each has a default prefix length:

Class	First octet	First octet numeric range	Prefix Length
A	0xxxxxxx	0-127	/8
B	10xxxxxx	128-191	/16
C	110xxxxx	192-223	/24

The prefix length determines how many networks each class has, and how many addresses are in each of those networks:

Class	Leading bits	Size of network number bit field	Size of rest bit field	Number of networks	Addresses per network
Class A	0	8	24	128 (27)	16,777,216 (224)
Class B	10	16	16	16,384 (214)	65,536 (216)
Class C	110	24	8	2,097,152 (221)	256 (28)

---

Loopback Addresses

• Addresses range 127.0.0.0 - 127.255.255.255.
• Used to test the network stack on the local device.

---

Netmask

A netmask (also called a subnet mask) is another way of writing the prefix length. It's a 32 bit value where the bits belonging to the network portion are set to 1, and the bits belonging to the host portion are set to 0.

So /24 and 255.255.255.0 mean exactly the same thing: the first 24 bits are the network portion.

Class	Prefix Length	Netmask	Netmask in binary
A	/8	255.0.0.0	11111111 00000000 00000000 00000000
B	/16	255.255.0.0	11111111 11111111 00000000 00000000
C	/24	255.255.255.0	11111111 11111111 11111111 00000000

---

Network Address

• Host portion of the address is all 0's = Network Address.
• The network address cannot be assigned a host.

---

Broadcast Address

• Host portion of the address is all 1's = Broadcast Address.
• The broadcast address cannot be assigned to a host.

---

Day 8 (Part 2)

Viewing Interfaces

The command to view a summary of all the interfaces on a router:

R1>en
R1#show ip interface brief
Interface              IP-Address      OK? Method Status                Protocol
GigabitEthernet0/0     unassigned      YES unset  administratively down down
GigabitEthernet0/1     unassigned      YES unset  administratively down down
GigabitEthernet0/2     unassigned      YES unset  administratively down down
GigabitEthernet0/3     unassigned      YES unset  administratively down down
R1#

show ip interface brief

• Lists every interface on the device, its IP address, and whether it's up or down.
• unassigned means no IP address has been configured on the interface yet.
• Status is the Layer 1 state, and Protocol is the Layer 2 state.
• administratively down means the interface has been manually disabled, router interfaces are disabled by default.
• This is the default status of Cisco router interfaces.
• Cisco switch interfaces are not administratively down by default.

Switch interfaces do not have the 'shutdown' command applied by default. They will have the up/up state if connected to another device, or the down/down state if they're not.

---

Configuring an Interface

To configure an interface you first have to enter interface configuration mode:

R1#conf t
Enter configuration commands, one per line.  End with CNTL/Z.
R1(config)#interface gigabitethernet 0/0
R1(config-if)#

interface interface-id

• conf t is short for configure terminal, which takes you from privileged EXEC mode into global configuration mode.
• interface gigabitethernet 0/0 selects the interface you want to configure.
• The prompt changes from R1(config)# to R1(config-if)#, which tells you any commands you type now will apply to that interface only.

---

Assigning an IP Address to an Interface

Once you're in interface configuration mode you can give the interface an IP address and enable it:

R1(config-if)#ip address 10.255.255.254 ?
  A.B.C.D  IP subnet mask

R1(config-if)#ip address 10.255.255.254 255.0.0.0
R1(config-if)#no shutdown
R1(config-if)#
*Dec  7 08:29:08.937: %LINK-3-UPDOWN: Interface GigabitEthernet0/0, changed state to up
*Dec  7 08:29:09.938: %LINEPROTO-5-UPDOWN: Line protocol on Interface GigabitEthernet0/0, changed state to up
R1(config-if)#

ip address ip-address netmask

• The ? shows you what the router expects next, in this case the netmask.
• The netmask has to be written out in full (255.0.0.0), you can't use the /8 prefix notation here.
• no shutdown enables the interface, this is what takes it out of the administratively down state.
• The two messages that follow are the router telling you the interface came up:
  • %LINK-3-UPDOWN is Layer 1 (the Status column) coming up.
  • %LINEPROTO-5-UPDOWN is Layer 2 (the Protocol column) coming up.

---

Running Show Commands from Configuration Mode

show commands normally only work in privileged EXEC mode, but you can run them from configuration mode by putting do in front:

R1(config-if)#do show ip interface brief
Interface              IP-Address      OK? Method Status                Protocol
GigabitEthernet0/0     10.255.255.254  YES manual up                    up
GigabitEthernet0/1     unassigned      YES unset  administratively down down
GigabitEthernet0/2     unassigned      YES unset  administratively down down
GigabitEthernet0/3     unassigned      YES unset  administratively down down
R1(config-if)#

do show-command

• Saves you from having to exit back to privileged EXEC mode just to check something.
• Gi0/0 is now the only interface with an IP address, and its Status and Protocol are both up.
• The Method changed from unset to manual, which means the address was configured by hand.

---

Show Interfaces [Interface]

show ip interface brief gives you a summary of every interface, show interfaces gives you everything about one interface:

R1#show interfaces g0/0
GigabitEthernet0/0 is up, line protocol is up
  Hardware is iGbE, address is 0c1b.8444.f000 (bia 0c1b.8444.f000)
  Internet address is 10.255.255.254/8
  MTU 1500 bytes, BW 1000000 Kbit/sec, DLY 10 usec,
     reliability 255/255, txload 1/255, rxload 1/255
  Encapsulation ARPA, loopback not set
  Keepalive set (10 sec)
  Auto Duplex, Auto Speed, link type is auto, media type is RJ45
  output flow-control is unsupported, input flow-control is unsupported
  ARP type: ARPA, ARP Timeout 04:00:00
  Last input 00:00:06, output 00:00:05, output hang never
  Last clearing of "show interface" counters never
  Input queue: 0/75/0/0 (size/max/drops/flushes); Total output drops: 0
  Queueing strategy: fifo
  Output queue: 0/40 (size/max)
  5 minute input rate 0 bits/sec, 0 packets/sec
  5 minute output rate 0 bits/sec, 0 packets/sec
     167 packets input, 30159 bytes, 0 no buffer
     Received 0 broadcasts (0 IP multicasts)
     0 runts, 0 giants, 0 throttles
     0 input errors, 0 CRC, 0 frame, 0 overrun, 0 ignored
     0 watchdog, 0 multicast, 0 pause input
     350 packets output, 39097 bytes, 0 underruns
     0 output errors, 0 collisions, 2 interface resets
     105 unknown protocol drops
     0 babbles, 0 late collision, 0 deferred
     1 lost carrier, 0 no carrier, 0 pause output
     0 output buffer failures, 0 output buffers swapped out

show interfaces interface-id

• g0/0 is shorthand for GigabitEthernet0/0.
• If you leave the interface off the end, it shows this same output for every interface on the device.
• is up, line protocol is up is the same Layer 1 / Layer 2 state as the Status and Protocol columns.
• address is 0c1b.8444.f000 is the MAC address of the interface, and bia (burned in address) is the one that came from the factory.
• Internet address is 10.255.255.254/8 is the IP address and prefix length configured on the interface.
• MTU 1500 bytes is the largest packet the interface will send without breaking it up.
• BW 1000000 Kbit/sec is the bandwidth (1 Gbps).
• The counters at the bottom (input errors, CRC, collisions, etc) are what you use to troubleshoot a link, they should all be 0 on a healthy interface.

---

Show Interfaces Description

R1#show interfaces description
Interface                      Status         Protocol Description
Gi0/0                          up             up
Gi0/1                          up             up
Gi0/2                          up             up
Gi0/3                          admin down     down

show interfaces description

• Gives you a shorter summary than show ip interface brief, no IP addresses, just the state of each interface.
• The Description column is empty because no descriptions have been configured yet.
• A description is just a label you give an interface to remind you what it connects to, it has no effect on how the interface works.
• admin down is the short way of writing administratively down.

---

Adding a Description to an Interface

You add a description from interface configuration mode:

R1(config)#int g0/0
R1(config-if)#description ## to SW1 ##
R1(config-if)#int g0/1
R1(config-if)#desc ## to SW2 ##
R1(config-if)#int g0/2
R1(config-if)#desc ## to SW3 ##
R1(config-if)#do sh int desc
Interface                      Status         Protocol Description
Gi0/0                          up             up       ## to SW1 ##
Gi0/1                          up             up       ## to SW2 ##
Gi0/2                          up             up       ## to SW3 ##
Gi0/3                          admin down     down

description text

• desc is short for description, and int is short for interface.
• You don't have to exit between interfaces, typing int g0/1 while in (config-if) mode just moves you straight to the next interface.
• The ## are not special, they're just there to make the description stand out in the output.
• Gi0/3 has no description because one was never set on it.

---

Day 9

Show Interfaces Status

SW1#show interfaces status
Port      Name               Status       Vlan       Duplex  Speed Type
Fa0/1                        connected    1          a-full  a-100 10/100BaseTX
Fa0/2                        connected    trunk      a-full  a-100 10/100BaseTX
Fa0/3                        connected    1          a-full  a-100 10/100BaseTX
Fa0/4                        connected    1          a-full  a-100 10/100BaseTX
Fa0/5                        notconnect   1            auto   auto 10/100BaseTX
Fa0/6                        notconnect   1            auto   auto 10/100BaseTX
Fa0/7                        notconnect   1            auto   auto 10/100BaseTX
Fa0/8                        notconnect   1            auto   auto 10/100BaseTX
Fa0/9                        notconnect   1            auto   auto 10/100BaseTX
Fa0/10                       notconnect   1            auto   auto 10/100BaseTX
Fa0/11                       notconnect   1            auto   auto 10/100BaseTX
Fa0/12                       notconnect   1            auto   auto 10/100BaseTX

show interfaces status

• Port is the interface, Fa0/1 is short for FastEthernet0/1.
• Name is the description set on the port.
• Status is whether the port is up:
  • connected = something is plugged in.
  • notconnect = nothing is plugged in.
  • disabled = the port was shut down.
• Vlan is the VLAN the port is in, 1 is the default.
  • trunk means the port carries multiple VLANs.
• Duplex is full (send and receive at once) or half (one at a time).
• Speed is the speed of the port in Mbps.
• Type is the physical port, 10/100BaseTX is copper RJ45 that runs at 10 or 100 Mbps.

a- means autonegotiated, the two devices agreed on the speed and duplex themselves.

• Ports with nothing plugged in just say auto because there's nothing to negotiate with.

---

Configuring Interface Speed and Duplex

SW1#conf t
Enter configuration commands, one per line.  End with CNTL/Z.
SW1(config)#int f0/1
SW1(config-if)#speed ?
  10    Force 10 Mbps operation
  100   Force 100 Mbps operation
  auto  Enable AUTO speed configuration
SW1(config-if)#speed 100
SW1(config-if)#duplex ?
  auto  Enable AUTO duplex configuration
  full  Force full duplex operation
  half  Force half-duplex operation
SW1(config-if)#duplex full
SW1(config-if)#description ## to R1 ##

speed 10 | 100 | auto
duplex auto | full | half

• speed and duplex are set in interface configuration mode.
• ? shows you the options you can use with a command.
• The options are the speeds the port supports.
• Setting a speed or duplex forces it, the port stops autonegotiating and uses what you told it.
• auto puts it back to autonegotiating.
• description sets the description for that interface.

---

Interface Range

SW1(config)#interface range f0/5 - 12
SW1(config-if-range)#description ## not in use ##
SW1(config-if-range)#shutdown
00:42:36: %LINK-5-CHANGED: Interface FastEthernet0/5, changed state to administratively down
00:42:36: %LINK-5-CHANGED: Interface FastEthernet0/6, changed state to administratively down
00:42:36: %LINK-5-CHANGED: Interface FastEthernet0/7, changed state to administratively down
00:42:36: %LINK-5-CHANGED: Interface FastEthernet0/8, changed state to administratively down
00:42:36: %LINK-5-CHANGED: Interface FastEthernet0/9, changed state to administratively down
00:42:36: %LINK-5-CHANGED: Interface FastEthernet0/10, changed state to administratively down
00:42:36: %LINK-5-CHANGED: Interface FastEthernet0/11, changed state to administratively down
00:42:36: %LINK-5-CHANGED: Interface FastEthernet0/12, changed state to administratively down
SW1(config-if-range)#

interface range interface-id - interface-id

• interface range lets you configure lots of interfaces at once instead of one at a time.
• f0/5 - 12 means f0/5 up to f0/12, that's 8 interfaces.
• The prompt changes to (config-if-range) to show you're editing a group of interfaces.
• Every command you enter is applied to all of them, so all 8 got the same description and were shut down.
• Shutting down unused ports is good practice, it stops anyone plugging into a spare port to get onto the network.

SW1(config)#int range f0/5 - 6, f0/9 - 12
SW1(config-if-range)#no shut
00:57:07: %LINK-3-UPDOWN: Interface FastEthernet0/5, changed state to up
00:57:07: %LINK-3-UPDOWN: Interface FastEthernet0/6, changed state to up
00:57:07: %LINK-3-UPDOWN: Interface FastEthernet0/9, changed state to up
00:57:07: %LINK-3-UPDOWN: Interface FastEthernet0/10, changed state to up
00:57:07: %LINK-3-UPDOWN: Interface FastEthernet0/11, changed state to up
00:57:07: %LINK-3-UPDOWN: Interface FastEthernet0/12, changed state to up

interface range interface-id - interface-id, interface-id - interface-id

• You can select more than one range at a time by separating them with a comma.
• f0/5 - 6, f0/9 - 12 selects f0/5, f0/6, and f0/9 to f0/12, f0/7 and f0/8 are skipped.
• no shut is short for no shutdown, it turns the interfaces back on.

---

Full/Half Duplex

• Half duplex means that the device cannot send and receive data at the same time. If it is receiving a frame, it must wait before sending a frame.
• Full duplex means that the device can send and receive data at the same time.

Devices connected to hubs must operate in half duplex.

---

CSMA/CD

• Stands for 'Carrier Sense Multiple Access with Collision Detection'.
• Before sending frames, devices listen to the collision domain until they detect that other devices are not sending traffic.
• If a collision does occur, the device sends a jamming signal to inform the other devices that a collision has occurred.
• Each device will wait a random period of time before sending frames again.
• This whole process repeats.

---

Speed/Duplex Autonegotiation

• Interfaces that can run at different speeds (10/100 or 10/100/1000) have default setting of speed auto and duplex auto.
• Interfaces tell the device on the other end what they're capable of, and the two agree on the fastest speed and best duplex they can both do.

If autonegotiation is disabled on the other device, the switch has to work it out on its own:

• Speed: the switch tries to sense what speed the other device is running at.
  • If it can't, it uses the slowest speed it supports (10 Mbps on a 10/100/1000 interface).
• Duplex: the switch picks the duplex based on the speed it ended up with.
  • 10 or 100 Mbps = half duplex.
  • 1000 Mbps or faster = full duplex.

---

Duplex Mismatch

A duplex mismatch is when one end of a link is on full duplex and the other end is on half duplex.

It happens because the switch can sense the speed the other device is using, but it can't sense the duplex, so it has to guess with the rule above.

Here's a switch on auto with 3 PCs that were all set manually:

PC is set to	Switch senses	Switch guesses	Result
10 Mbps / half	10 Mbps	half duplex	match
1000 Mbps / full	1000 Mbps	full duplex	match
100 Mbps / full	100 Mbps	half duplex	mismatch

The last one breaks because the switch always guesses half duplex at 100 Mbps, but the PC was set to full.

What goes wrong:

• The full duplex end sends whenever it wants, it doesn't check if the line is busy.
• The half duplex end is using CSMA/CD, so frames arriving while it's sending look like a collision.
• It stops, waits, then sends the frame again.

The link still works, it's just slow, and it gets worse the more traffic you put through it.

• The half duplex end shows late collisions.
• The full duplex end shows CRC errors and runts.
• Both show up in the counters at the bottom of show interfaces.

The fix is to make both ends match, either put both on auto or set both manually to the same thing.

---

Interface Errors

These are the counters at the bottom of show interfaces:

269 packets input, 71059 bytes, 0 no buffer
Received 6 broadcasts, 0 runts, 0 giants, 0 throttles
0 input errors, 0 CRC, 0 frame, 0 overrun, 0 ignored
7290 packets output, 429075 bytes, 0 underruns
0 output errors, 3 interface resets
0 output buffer failures, 0 output buffers swapped out

• Runts are frames smaller than the minimum frame size (64 bytes).
• Giants are frames larger than the maximum frame size (1518 bytes).
• CRC are frames that failed the CRC (Cyclic redundancy check) check in the Ethernet FCS trailer.
• Frame are frames with an incorrect format, caused by an error.
• Input errors is the total of the above four and a few others.
• Output errors are frames the switch tried to send but couldn't because of an error.

---

Day 10

IPv4 Header - Version Field

• Length: 4 bits.
• Identifies the version of IP being used.
• There are two versions:
  • IPv4 = 4 (0100)
  • IPv6 = 6 (0110)

---

IPv4 Header - Internet Header Length (IHL)

• The final field of the IPv4 header (Options) is dynamic (it can have a variable length), so this field is necessary to indicate the total length of the header.
• Identifies the length of the header in 4-byte increments.
  • Value 5 = 5 * 4-bytes = 20 bytes.
• Minimum value is 5 (20 bytes).
• Maximum value is 15 (15 * 4 = 60, 60 bytes).

---

IPv4 Header - DSCP Field

• Stands for 'Differential Services Code Point'.
• Length: 6 bits.
• Used for QoS (Quality of Service).
• Used to prioritize delay-sensitive data.

---

IPv4 Header - ECN Field

• Stands for 'Explicit Congestion Notification'.
• Length: 2 bits.
• Provides end-to-end (between two endpoints) notification of network congestion without dropping packets.
• Optional feature that requires both endpoints, as well as the underlying network infrastructure, to support it.

Further Reading: https://www.geeksforgeeks.org/computer-networks/what-is-ecnexplicit-congestion-notification/

---

IPv4 Header - Total Length Field

• Length: 16 bits.
• Indicates the total length of the packet.
• Measured in bytes (not 4-byte increments like Internet Header Length (IHL)).
• Minimum value of 20 (with no encapsulated data).
• Maximum value of 65,535 (maximum 16-bit value).

---

IPv4 Header - Identification Field

• Length: 16 bits.
• If a packet is fragmented due to being too large, this field is used to identify which packet the fragment belongs to.
• All fragments of the same packet will have their own IPv4 header with the same value in this field.
• Packets are fragmented if larger than the MTU (Maximum Transmission Unit).
• The MTU is usually 1500 bytes.
• Fragments are reassembled by the receiving host.

---

IPv4 Header - Flags Field

• Length: 3 bits.
• Used to control/identify fragments.
• Bit 0: Reserved, always set to 0.
• Bit 1: Don't Fragment (DF bit), used to indicate a packet that should not be fragmented.
• Bit 2: More Fragments (MF bit), set to 1 if there are more fragments in the packet, set to 0 for the last fragment.

---

IPv4 Header - Fragment Offset Field

• Length: 13 bits.
• Used to indicate the position of the fragment within the original unfragmented IP packet.
• Allows fragmented packets to be reassembled even if the fragments arrive out of order.

---

IPv4 Header - Time To Live Field

• Length: 8 bits.
• A router will drop a packet with a TTL of 0.
• It prevents a packet from circulating around the network forever.
• Indicates a 'hop count': each time the packet arrives at a router, the router decreases the TTL by 1.
• Recommended default TTL is 64.

---

IPv4 Header - Protocol Field

• Length: 8 bits.
• Indicates the protocol used at layer 4.
• Example protocols:
  • 6: TCP
  • 17: UDP
  • 1: ICMP
  • 89: OSPF (dynamic routing protocol)

https://en.wikipedia.org/wiki/List_of_IP_protocol_numbers

---

IPv4 Header - Header Checksum Field

Used to check whether the IPv4 header has been corrupted or changed while traveling across the network

• Length: 16 bits.
• A calculated checksum used to check for errors in the IPv4 header.
• When a router receives a packet, it calculates the checksum of the header and compares it to the one in this field of the header.
• If they do not match, the router drops the packet.
• Not used to check for errors in the encapsulated data.
• IP relies on the encapsulated protocol to detect errors in the encapsulated data.
• Both TCP and UDP have their own checksum fields to detect errors in the encapsulated data.

---

IPv4 Header - Source/Destination IP Address Fields

• Length: 32 bits.
• Source IP Address = IPv4 address of the sender of the packet.
• Destination IP Address = IPv4 address of the intended receiver of the packet.

---

IPv4 Header - Options

• Length: 0 - 320 bits.
• Rarely used.
• If the IHL field is greater than 5, it means that Options are present.

Field	Size (bits)	Description
Copied	1	Set to 1 if the options need to be copied into all fragments of a fragmented packet.
Option Class	2	A general options category. 0 is for "control" options, and 2 is for "debugging and measurement". 1 and 3 are reserved.
Option Number	5	Specifies an option.
Option Length	8	Indicates the size of the entire option (including this field). This field may not exist for simple options.
Option Data	Variable	Option-specific data. This field may not exist for simple options.

---

Wireshark Packet Capture

---

Day 11 (Part 1)

What is Routing?

Routing is the process that routers use to determine the path that IP packets should take over a network to reach their destination. Routers typically store routes to all of their known destinations in a routing table. When a router receives a packet, it looks at the routing table to find the best route to forward the packet.

There are two main routing methods:

• Dynamic Routing: Routers use dynamic routing protocols (i.e OSPF) to share routing information with each other automatically and build their routing tables.
• Static Routing: A network engineer/admin manually configures routes on the router.

A route tells the router: to send a packet to destination X, you should send the packet to next-hop (the next router in the path to the destination) Y. -> or, if the destination is directly connected to the router, send the packet directly to the destination. -> or, if the destination is the router's own IP address, receive the packet for yourself.

If a router receives a packet and it doesn't have a route that matches the packet's destination, it will drop the packet.

---

Routing Table (show ip route)

Use the command show ip route to view the routing table.

R1#show ip route
Codes: L - local, C - connected, S - static, R - RIP, M - mobile, B - BGP
       D - EIGRP, EX - EIGRP external, O - OSPF, IA - OSPF inter area
       N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2
       E1 - OSPF external type 1, E2 - OSPF external type 2
       i - IS-IS, su - IS-IS summary, L1 - IS-IS level-1, L2 - IS-IS level-2
       ia - IS-IS inter area, * - candidate default, U - per-user static route
       o - ODR, P - periodic downloaded static route, H - NHRP, l - LISP
       a - application route
       + - replicated route, % - next hop override, p - overrides from PfR

Gateway of last resort is not set

      192.168.1.0/24 is variably subnetted, 2 subnets, 2 masks
C        192.168.1.0/24 is directly connected, GigabitEthernet0/2
L        192.168.1.1/32 is directly connected, GigabitEthernet0/2
      192.168.12.0/24 is variably subnetted, 2 subnets, 2 masks
C        192.168.12.0/24 is directly connected, GigabitEthernet0/1
L        192.168.12.1/32 is directly connected, GigabitEthernet0/1
      192.168.13.0/24 is variably subnetted, 2 subnets, 2 masks
C        192.168.13.0/24 is directly connected, GigabitEthernet0/0
L        192.168.13.1/32 is directly connected, GigabitEthernet0/0

The Codes legend at the top lists the different protocols routers can use to learn routes. The two in this output are:

• L - local is a route to the actual IP address configured on the interface (with a /32 netmask).
• C - connected is a route to the network the interface is connected to (with the actual netmask configured on the interface).

When you configure an IP address on an interface and enable it with no shutdown, 2 routes per interface are automatically added to the routing table:

• A connected route.
• A local route.

---

Connected and Local Routes

      192.168.1.0/24 is variably subnetted, 2 subnets, 2 masks
C        192.168.1.0/24 is directly connected, GigabitEthernet0/2
L        192.168.1.1/32 is directly connected, GigabitEthernet0/2
      192.168.12.0/24 is variably subnetted, 2 subnets, 2 masks
C        192.168.12.0/24 is directly connected, GigabitEthernet0/1
L        192.168.12.1/32 is directly connected, GigabitEthernet0/1
      192.168.13.0/24 is variably subnetted, 2 subnets, 2 masks
C        192.168.13.0/24 is directly connected, GigabitEthernet0/0
L        192.168.13.1/32 is directly connected, GigabitEthernet0/0

A connected route is a route to the network the interface is connected to.

• R1's G0/2 IP address is 192.168.1.1/24.
• The network address is 192.168.1.0/24.
• It provides a route to all hosts in that network (i.e. 192.168.1.10, 192.168.1.100, 192.168.1.232, etc).
• R1 knows: "If I need to send a packet to any host in the 192.168.1.0/24 network, I should send it out of G0/2".

A local route is a route to the exact IP address configured on the interface.

• A /32 netmask is used to specify the exact IP address of the interface.
• /32 means all 32 bits are 'fixed', they can't change.
• Even though R1's G0/2 is configured as 192.168.1.1/24, the local route is to 192.168.1.1/32.
• R1 knows: "If I receive a packet destined for this IP address, the message is for me".

A route matches a packet's destination if the packet's destination IP address is part of the network specified in the route.

---

Route Selection

      192.168.1.0/24 is variably subnetted, 2 subnets, 2 masks
C        192.168.1.0/24 is directly connected, GigabitEthernet0/2
L        192.168.1.1/32 is directly connected, GigabitEthernet0/2

A packet destined for 192.168.1.1 is matched by both of those routes, so which one does R1 use? It chooses the most specific matching route.

• The route to 192.168.1.0/24 includes 256 different IP addresses (192.168.1.0 to 192.168.1.255).
• The route to 192.168.1.1/32 includes only 1 IP address (192.168.1.1), so it is the more specific of the two.

The most specific matching route is the matching route with the longest prefix length.

So R1 selects the route to 192.168.1.1/32, which is the local route:

• R1 receives the packet for itself, rather than forwarding it out of G0/2.
• A local route means keep the packet, don't forward it.

---

Day 11 (Part 2)

Routing Packets: Default Gateway

For hosts to send packets outside of their local network, they must send the packets to their default gateway.

The default gateway configuration is also called a default route. It is a route to 0.0.0.0/0 = all netmask bits set to 0. It includes addresses from 0.0.0.0 to 255.255.255.255.

End hosts usually have no need for any more specific routes. -> They just know: to send packets outside of my local network, I should send them to my default gateway.

---

Static Route Configuration

To configure a static route on a Cisco router:

R1(config)# ip route ip-address netmask next-hop

• ip-address is the destination IP address.
• netmask the netmask/subnet for the destination IP address.
• next-hop the IP address for the next hop destination in the path.

An example:

R1(config)# ip route 192.168.4.0 255.255.255.0 192.168.13.3

---

Static Route Configuration with Exit-Interface

---

Default Route

• A default route is a route to 0.0.0.0/0.
  • 0.0.0.0/0 is the least specific route possible; it includes every possible destination IP address.
• If the router doesn't have a more specific route for the packet's destination IP address, it will forward the packet using the default route.
• A default route is often used to direct traffic to the internet.

How to configure a default route on a Cisco router:

R1(config)# ip route 0.0.0.0 0.0.0.0 203.0.113.2
R1(config)# do show ip route
!most codes omitted
       ia - IS-IS inter area, * - candidate default, U - per-user static route
!most codes omitted

Gateway of last resort is 203.0.113.2 to network 0.0.0.0

S*    0.0.0.0/0 [1/0] via 203.0.113.2
S     10.0.0.0/8 [1/0] via 192.168.12.2
S     172.16.0.0/16 [1/0] via 192.168.13.3
      192.168.12.0/24 is variably subnetted, 2 subnets, 2 masks
C        192.168.12.0/24 is directly connected, GigabitEthernet0/1
L        192.168.12.1/32 is directly connected, GigabitEthernet0/1
      192.168.13.0/24 is variably subnetted, 2 subnets, 2 masks
C        192.168.13.0/24 is directly connected, GigabitEthernet0/0
L        192.168.13.1/32 is directly connected, GigabitEthernet0/0
      203.0.113.0/24 is variably subnetted, 2 subnets, 2 masks
C        203.0.113.0/24 is directly connected, GigabitEthernet0/2
L        203.0.113.1/32 is directly connected, GigabitEthernet0/2

• ip route 0.0.0.0 0.0.0.0 203.0.113.2 is the same ip route command as any other static route, but with all zeros for the destination and netmask (0.0.0.0/0), so it matches every destination.
• Gateway of last resort is now set to 203.0.113.2. That's where R1 sends packets it has no other route for. The new S* entry is the route itself: S for static, * for candidate default.
• It doesn't override the other routes, because R1 still picks the most specific match. 0.0.0.0/0 has the shortest prefix length possible, so it's only used when nothing else matches.

---

Day 12

---

Day 13 (Part 1 - Subnetting)

CIDR (Classless Inter-Domain Routing)

• The IETF (Internet Engineering Task Force) introduced CIDR in 1993 to replace 'classful' addressing system.

With CIDR, the requirements of...

• Class A = /8
• Class B = /16
• Class C = /24

were removed.

• This allowed larger networks to be split into smaller networks, allowing greater efficiency.
• These smaller networks are called 'subnetworks' or 'subnets'.

---

CIDR Notation

CIDR notation is the /x way of writing a netmask, where x is the number of bits set to 1:

Dotted Decimal	CIDR Notation
255.255.255.128	/25
255.255.255.192	/26
255.255.255.224	/27
255.255.255.240	/28
255.255.255.248	/29
255.255.255.252	/30
255.255.255.254	/31
255.255.255.255	/32

---

Day 14 (Part 2 - Subnetting)

Subnets/Hosts (Class C)

Prefix Length	Number of Subnets	Number of Hosts
/25	2	126
/26	4	62
/27	8	30
/28	16	14
/29	32	6
/30	64	2
/31	128	0 (2)
/32	256	0 (1)

---

Subnets/Hosts (Class B)

Prefix Length	Number of Subnets	Number of Hosts
/17	2	32766
/18	4	16382
/19	8	8190
/20	16	4094
/21	32	2044
/22	64	1022
/23	128	510
/24	256	254
/25	512	126
/26	1024	62
/27	2048	30
/28	4096	14
/29	8192	6
/30	16384	2
/31	32768	0 (2)
/32	65536	0 (1)

---

Day 15 (Part 3 - Subnetting)

Variable-Length Subnet Masks

• VLSM (Variable-Length Subnet Masks) is the process of creating subnets of different sizes, to make your use of network addresses more efficient.
• It's more complicated than FLSM.

---

VLSM - Steps

1. Assign the largest subnet at the start of the address space.
2. Assign the second-largest subnet after it.
3. Repeat the process until all subnets have been assigned.

---

Day 16 (Part 1 - VLANs)

What is a LAN?

• A LAN is a single broadcast domain, including all devices in that broadcast domain.
• A broadcast domain is the group of devices which will receive a broadcast frame (destination MAC FFFF.FFFF.FFFF) sent by any one of the members.
• A switch will not forward traffic between VLANs, including broadcast/unknown unicast traffic.
• Switches do not perform inter-VLAN routing. It must send the traffic through the router.

---

What is a VLAN?

A VLAN (Virtual Local Area Network) is a way to logically divide one physical network into multiple separated networks.

• VLANs are configured on switches on a per-interface basis.
• They logically separate end hosts at Layer 2.

Benefits of VLANs:

• Security
• Performance
• Segmentation

---

VLAN Configuration

SW1#show vlan brief

VLAN Name                             Status    Ports
---- -------------------------------- --------- -------------------------------
1    default                          active    Gi0/0, Gi0/1, Gi0/2, Gi0/3
                                                Gi1/0, Gi1/1, Gi1/2, Gi1/3
                                                Gi2/0, Gi2/1, Gi2/2, Gi2/3
                                                Gi3/0, Gi3/1, Gi3/2, Gi3/3
1002 fddi-default                     act/unsup
1003 token-ring-default               act/unsup
1004 fddinet-default                  act/unsup
1005 trnet-default                    act/unsup

show vlan brief shows a quick summary of the VLANs on the switch: each VLAN's number, name, status, and which ports belong to it.

• VLAN 1 is the default VLAN. Every interface is in VLAN 1 until you assign it somewhere else.
• VLANs 1002-1005 exist by default too. They were made for old technologies (FDDI and Token Ring), so their status is act/unsup (active but unsupported).
• VLAN 1 and VLANs 1002-1005 cannot be deleted.

SW1(config)#interface range g1/0 - 3
SW1(config-if-range)#switchport mode access
SW1(config-if-range)#switchport access vlan 10
% Access VLAN does not exist. Creating vlan 10

These commands put ports Gi1/0 to Gi1/3 into VLAN 10.

• interface range g1/0 - 3 selects all four ports at once, so you don't have to configure them one by one.
• switchport mode access makes the ports access ports. An access port belongs to one VLAN and usually connects to an end host like a PC.
• switchport access vlan 10 assigns the ports to VLAN 10.
• VLAN 10 didn't exist yet, so the switch created it automatically.

SW1(config)#vlan 10
SW1(config-vlan)#name ENGINEERING
SW1(config-vlan)#vlan 20
SW1(config-vlan)#name HR
SW1(config-vlan)#vlan 30
SW1(config-vlan)#name SALES

These commands give VLANs a name so it's easier to tell what each one is for.

• vlan 10 enters VLAN config mode for VLAN 10. If the VLAN doesn't exist yet, it gets created.
• name ENGINEERING names VLAN 10 ENGINEERING.
• You can go straight to the next VLAN with vlan 20 without leaving config mode first.
• If you don't give a VLAN a name, the switch names it automatically (for example, VLAN0010).

---

Day 17 (Part 2 - VLANs)

Trunk Ports

A trunk port is a network switch port that carries traffic for multiple VLANs simultaneously.

Key points:

• Switches will 'tag' all frames that they send over a trunk link. This allows the receiving switch to know which VLAN the frame belongs to.
• Trunk ports = 'tagged' ports.
• Access ports = 'untagged' ports.

---

VLAN Tagging

• There are two main trunking protocols: ISL (Inter-Switch Link) and IEEE 802.1Q (dot1q).
• IEEE 802.1Q is an industry standard protocol created by the IEEE (Institute of Electrical and Electronics Engineers).

---

802.1Q Tag

The ethernet header frame components including the 802.1Q tag.

• The 802.1Q tag is inserted between the Source and Type/Length fields of the Ethernet frame.
• The tag is 4 bytes (32 bits) in length.
• The tag consists of two main fields:
  • Tag Protocol Identifier (TPID)
  • Tag Control Information (TCI)
• The TCI consists of three sub-fields.

https://en.wikipedia.org/wiki/IEEE_802.1Q

---

802.1Q Tag - TPID (Tag Protocol Identifier)

• 16 bits (2 bytes) in length.
• Always set to a value of 0x8100 (8100). This indicates that the frame is 802.1Q-tagged.

---

802.1Q - PCP (Priority Code Point)

• 3 bits in length.
• Used for Class of Service (CoS), which prioritizes important traffic in congested networks.

---

802.1Q Tag - DEI (Drop Eligible Indicator)

• 1 bit in length.
• Used to indicate frames that can be dropped if the network is congested.

---

802.1Q Tag - VID (VLAN ID)

• 12 bits in length.
• Identifies the VLAN the frame belongs to.
• 12 bits in length = 4096 total VLANs (2¹²), range of 0 - 4095.
• VLANs 0 and 4095 are reserved and can't be used.
• The actual range of VLANs is 1 - 4094.

---

VLAN Ranges

• The range of VLANs is divided into two section:
  • Normal VLANs: 1 - 1005
  • Extended VLANs: 1006 - 4094

---

Native VLAN

A native VLAN is the VLAN that carries untagged traffic on a trunk port.

• 802.1Q has a feature called native VLAN.
• The native VLAN is VLAN 1 by default on all trunk ports, however this can be manually configured on each trunk port.
• The switch does not add an 802.1Q tag to frames in the native VLAN.
• When a switch receives an untagged frame on a trunk port, it assumes the frame belongs to the native VLAN.

---

Trunk Configuration

SW1(config)#interface g0/0
SW1(config-if)#switchport mode trunk
Command rejected: An interface whose trunk encapsulation is "Auto" can not be configured to "trunk" mode.
SW1(config-if)#switchport trunk encapsulation ?
  dot1q      Interface uses only 802.1q trunking encapsulation when trunking
  isl        Interface uses only ISL trunking encapsulation when trunking
  negotiate  Device will negotiate trunking encapsulation with peer on
             interface

SW1(config-if)#switchport trunk encapsulation dot1q
SW1(config-if)#switchport mode trunk
SW1(config-if)#

These commands make Gi0/0 a trunk port, which carries traffic for multiple VLANs.

• switchport mode trunk was rejected at first. Some switches support more than one trunking encapsulation, and they won't let you turn on trunk mode while the encapsulation is still set to Auto.
• Typing ? after a command shows the available options. Here the choices are dot1q, isl, and negotiate.
• switchport trunk encapsulation dot1q picks 802.1Q, the standard used today. ISL is an old Cisco-only protocol.
• Once the encapsulation is set, switchport mode trunk works and the port becomes a trunk.

To set the native VLAN:

---

SW1#show interfaces trunk

Port        Mode             Encapsulation  Status        Native vlan
Gi0/0       on               802.1q         trunking      1

Port        Vlans allowed on trunk
Gi0/0       1-4094

Port        Vlans allowed and active in management domain
Gi0/0       1,10,30

Port        Vlans in spanning tree forwarding state and not pruned
Gi0/0       1,10,30
SW1#

show interfaces trunk lists the trunk ports on the switch and how each one is set up.

• Mode on means the port was manually set to trunk mode, and Status trunking means it's actually working as a trunk.
• Encapsulation 802.1q is the tagging standard being used, and Native vlan 1 is the VLAN whose frames are sent untagged.
• Vlans allowed on trunk shows 1-4094, which is the default. A trunk allows every VLAN unless you limit it.
• Vlans allowed and active in management domain shows 1,10,30. These are the VLANs that are both allowed and actually exist on the switch, so these are the only ones the trunk really carries.

---

SW1(config-if)#switchport trunk allowed vlan 10,30
SW1(config-if)#do show interfaces trunk

Port        Mode             Encapsulation  Status        Native vlan
Gi0/0       on               802.1q         trunking      1

Port        Vlans allowed on trunk
Gi0/0       10,30

Port        Vlans allowed and active in management domain
Gi0/0       10,30

Port        Vlans in spanning tree forwarding state and not pruned
Gi0/0       10,30
SW1(config-if)#

switchport trunk allowed vlan 10,30 limits the trunk so it only carries VLAN 10 and VLAN 30.

• The allowed list went from 1-4094 (all VLANs) down to just 10,30.
• VLAN 1 is no longer allowed, so its traffic won't cross this trunk anymore.
• Limiting the allowed VLANs is good practice. It keeps unnecessary traffic off the link.

---

SW1(config-if)#switchport trunk allowed vlan ?
  WORD    VLAN IDs of the allowed VLANs when this port is in trunking mode
  add     add VLANs to the current list
  all     all VLANs
  except  all VLANs except the following
  none    no VLANs
  remove  remove VLANs from the current list

These are the options for switchport trunk allowed vlan.

• WORD = you type the VLAN IDs yourself, like 10,30 or 10-20. This replaces the whole list.
• add = adds VLANs to the list that's already there.
• all = allows every VLAN (this is the default).
• except = allows every VLAN apart from the ones you list.
• none = allows no VLANs at all.
• remove = takes VLANs off the current list.

---

Router on a Stick (ROAS)

R1(config)#interface g0/0
R1(config-if)#no shutdown
R1(config-if)#
*Apr 15 04:29:49.681: %LINK-3-UPDOWN: Interface GigabitEthernet0/0, changed state to up
*Apr 15 04:29:50.682: %LINEPROTO-5-UPDOWN: Line protocol on Interface GigabitEthernet0/0, changed state to up
R1(config-if)#interface g0/0.10
R1(config-subif)#encapsulation dot1q 10
R1(config-subif)#ip address 192.168.1.62 255.255.255.192

This is the router side of router-on-a-stick, where one physical router port handles the traffic of multiple VLANs.

• no shutdown turns on the physical interface. Router interfaces are shut down by default.
• interface g0/0.10 creates a subinterface. It's a virtual interface that lives on the physical port, and you make one per VLAN.
• encapsulation dot1q 10 tells the subinterface to handle traffic tagged for VLAN 10.
• ip address gives the subinterface an IP, which becomes the default gateway for the hosts in that VLAN.

Key points:

• ROAS is used to route between multiple VLANs using a single interface on the router and switch.
• The router interface is configured using subinterfaces. You configure the VLAN tag and IP address on each subinterface.
• The router will tag frames sent out of each subinterface with the VLAN tag configured on the subinterface.

---

Day 18 (Part 3 - VLANs)

Native VLAN on a router (ROAS)

There are 2 methods of configuring the native VLAN on a router:

• Use the command encapsulation dot1q vlan-id native on the router subinterface.
• Configure the IP address for the native VLAN on the router's physical interfaces.

First method example:

R1(config)#int g0/0.10
R1(config-subif)#encapsulation dot1q 10 native
R1(config-subif)#

Second method example:

R1(config)#no interface g0/0.10
R1(config)#interface g0/0
R1(config-if)#ip address 192.168.1.62 255.255.255.192
R1(config-if)#

---

Layer 3 (Multilayer) Switches

• Multilayer switches are capable of both switching and routing.
• Operates both at layer 2 (Data Link layer) and layer 3 (Network layer).
• You can assign IP addresses to its interfaces, like a router.
• You can create virtual interfaces for each VLAN, and assign IP addresses to those interfaces.
• You can configure routes on it.
• It can be used for inter-VLAN routing.

---

Inter-VLAN Routing via SVI

• SVIs (Switch Virtual Interfaces) are the virtual interfaces you can assign IP addresses to in a multilayer switch.
• You can configure hosts to use SVI as their gateway address.
• To send traffic to different subnets/VLANs, hosts will send traffic to the switch, and the switch will route the traffic.

R1(config)#no interface g0/0.10
R1(config)#no interface g0/0.20
R1(config)#no interface g0/0.30
R1(config)#default interface g0/0
Interface GigabitEthernet0/0 set to default configuration
R1(config)#do show ip interface brief
Interface              IP-Address      OK? Method Status                Protocol
GigabitEthernet0/0     unassigned      YES NVRAM  up                    up
GigabitEthernet0/0.10  unassigned      YES manual deleted               down
GigabitEthernet0/0.20  unassigned      YES manual deleted               down
GigabitEthernet0/0.30  unassigned      YES manual deleted               down
GigabitEthernet0/1     unassigned      YES NVRAM  administratively down down
GigabitEthernet0/2     unassigned      YES NVRAM  administratively down down
GigabitEthernet0/3     unassigned      YES NVRAM  administratively down down
R1(config)#

This removes the old router-on-a-stick setup from R1, so the multilayer switch can do the inter-VLAN routing instead.

• no interface g0/0.10 deletes a subinterface. You need one command per subinterface.
• default interface g0/0 resets the physical interface back to its default settings, wiping any config on it.

SW2(config)#default interface g0/1
Interface GigabitEthernet0/1 set to default configuration
SW2(config)#ip routing
SW2(config)#interface g0/1
SW2(config-if)#no switchport
SW2(config-if)#ip address 192.168.1.193 255.255.255.252
SW2(config-if)#do show ip interface brief
Interface              IP-Address      OK? Method Status                Protocol
GigabitEthernet0/0     unassigned      YES unset  up                    up
GigabitEthernet0/2     unassigned      YES unset  up                    up
GigabitEthernet0/3     unassigned      YES unset  up                    up
GigabitEthernet0/1     192.168.1.193   YES manual up                    up

This turns a port on the multilayer switch into a routed port, so it behaves like a router interface.

• ip routing turns on routing. A multilayer switch won't route between VLANs without it.
• no switchport changes the port from a Layer 2 switchport into a Layer 3 routed port.
• Once it's a routed port, you can give it an ip address just like you would on a router.
• In the output, G0/1 now has an IP address while the other ports show unassigned, because they're still normal switchports.

SW2(config)#interface vlan10
SW2(config-if)#ip address 192.168.1.62 255.255.255.192
SW2(config-if)#no shutdown

This creates an SVI for VLAN 10, which acts as the gateway for the hosts in that VLAN.

• interface vlan10 creates the virtual interface for VLAN 10. You make one per VLAN you want to route.
• The ip address you give it is what the hosts in VLAN 10 use as their default gateway.
• no shutdown turns the SVI on. SVIs are shut down by default.

The conditions required for an SVI to be configured:

1. The VLAN must exist on the switch.
2. The switch must have at least one access port in the VLAN in an up/up state, AND/OR one trunk port that allows the VLAN that is in an up/up state.
3. The VLAN must not be shutdown.
4. The SVI must not be shutdown.

---

Day 19

DTP (Dynamic Trunking Protocol)

• It's a Cisco proprietary protocol that allows Cisco switches to dynamically determine their interface status (access or trunk) without manual configuration.
• It's enabled by default on all Cisco switch interfaces.
• For security purposes, manual configuration is recommended.
• DTP should be disabled on all switchports.

SW2(config-if)#switchport mode dynamic ?
  auto       Set trunking mode dynamic negotiation parameter to AUTO
  desirable  Set trunking mode dynamic negotiation parameter to DESIRABLE

• A switchport in dynamic desirable mode will actively try to form a trunk with other Cisco switches. It will form a trunk if connected to another switchport in the following modes:

  • switchport mode trunk
  • switchport mode dynamic desirable
  • switchport mode dynamic auto

• A switchport in dynamic auto mode will not actively try to form a trunk with other Cisco switches, however it will form a trunk if the switch connected to it is actively trying to form a trunk. It will form a trunk with a switchport in the following modes:

  • switchport mode trunk
  • switchport mode dynamic desirable

Administrative Mode	Trunk	Dynamic Desirable	Access	Dynamic Auto
Trunk	Trunk	Trunk	X	Trunk
Dynamic Desirable	Trunk	Trunk	Access	Trunk
Access	X	Access	Access	Access
Dynamic Auto	Trunk	Trunk	Access	Access

More key points:

• On older switches, switchport mode dynamic desirable is the default administrative mode.
• On newer switches, switchport mode dynamic auto is the default administrative mode.
• You can disable DTP negotiation on an active interface with this command: switchport nonegotiate.
• Configuring an access port with switchport mode access also disables DTP negotiation on an interface.
• It is recommended that you disable DTP on all switchports and manually configure them as access or trunk ports.
• Switches that support both 802.1Q and ISL trunk encapsulations can use DTP to negotiate the encapsulation they will use.
• ISL is favored over 802.1Q, so if both switches support ISL it will be selected.
• DTP frames are sent in VLAN1 when using ISL, or in the native VLAN when using 802.1Q.

SW1 output:

SW1(config-if)#switchport mode dynamic desirable
SW1(config-if)#do show interfaces g0/0 switchport
Name: Gi0/0
Switchport: Enabled
Administrative Mode: dynamic desirable
Operational Mode: trunk
Administrative Trunking Encapsulation: negotiate
Operational Trunking Encapsulation: isl
Negotiation of Trunking: On

---

VTP (VLAN Trunking Protocol)

• VTP allows you to configure VLANs on a central VTP server switch, and other switches (VTP clients) will synchronize their VLAN database to the server.
• It is designed for large networks with many VLANs, so that you don't have to configure each VLAN on every switch.
• Not recommended that you use it.
• It is rarely used.
• There are three VTP versions: 1, 2, and 3.
• There are three VTP modes: server, client, and transparent.
• Cisco switches operate in VTP server mode by default.

VTP Servers:

• They can add/modify/delete VLANs.
• Store the VLAN database in non-volatile RAM (NVRAM).
• Will increase the revision number every time a VLAN is added/modified/deleted.

• They will advertise the latest version of the VLAN database on trunk interfaces.
• VTP servers also function as VTP clients.
  • Therefore, a VTP server will synchronize to another VTP server with a higher revision number.

VTP Clients:

• They cannot add/modify/delete VLANs.
• They don't store the VLAN database in NVRAM. (in VTPv3, they do)
• Will synchronize their VLAN database to the server with the highest revision number in their VTP domain.
• Will advertise their VLAN database, and forward VTP advertisements to other clients over their trunk ports.

SW1#show vtp status
VTP Version capable             : 1 to 3
VTP version running             : 1
VTP Domain Name                 :
VTP Pruning Mode                : Disabled
VTP Traps Generation            : Disabled
Device ID                       : 0c09.f956.1300
Configuration last modified by 0.0.0.0 at 0-0-00 00:00:00
Local updater ID is 0.0.0.0 (no valid interface found)

Feature VLAN:
--------------
VTP Operating Mode              : Server
Maximum VLANs supported locally : 1005
Number of existing VLANs        : 5
Configuration Revision          : 0
MD5 digest                      : 0x57 0xCD 0x40 0x65 0x63 0x59 0x47 0xBD
                                  0x56 0x9D 0x4A 0x3E 0xA5 0x69 0x35 0xBC

SW1(config)#vtp domain cisco
Changing VTP domain name from NULL to cisco
SW1(config)#
*May  4 02:14:47.276: %SW_VLAN-6-VTP_DOMAIN_NAME_CHG: VTP domain name changed to cisco.
SW1(config)#vlan 10
SW1(config-vlan)#name engineering
SW1(config-vlan)#exit

The vtp domain command set the VTP domain name for the switch.

VTP Transparent mode:

• Does not participate in the VTP domain.
• Maintains its own VLAN database in NVRAM. It can add/modify/delete VLANs, but they won't be advertised to other switches.
• Will forward VTP advertisements that are in the same domain as it.

---

Day 20 (Part 1 - Spanning Tree Protocol)