Cisco Certified Network Associate (CCNA) 200-301 · Free study guide

Network access: segmentation without accidental isolation

The access layer turns physical ports and radio associations into deliberate broadcast domains. Most failures in this domain are consistency failures: a VLAN exists on one switch but not another, a trunk omits it, an EtherChannel member disagrees with its peers, spanning tree protects the wrong edge, or a wireless policy maps clients to an unexpected segment.

Build VLANs as an end-to-end service

Creating a VLAN is only the first step. An access port must be placed in the correct data VLAN, a voice VLAN may be advertised to a supported phone, trunks must carry the VLAN between switches, and a Layer 3 gateway must exist if hosts need other prefixes. The default VLAN is a real operational choice, not a placeholder that automatically provides safe user segmentation.

Verify each boundary. Check the VLAN database, switchport operational mode, access and voice assignments, trunk state, allowed VLANs, native VLAN, and the gateway interface. A host can have perfect IP parameters and still fail because its access port belongs to a different broadcast domain.

Understand 802.1Q rather than memorizing trunk commands

An 802.1Q trunk identifies most carried VLANs with a tag. The native VLAN is sent untagged by default on a conventional trunk, so both ends must agree. Allowed lists restrict what crosses the link. A trunk can be operational while one required VLAN is pruned, which is why a generic link-up check is inadequate.

A native-VLAN mismatch can leak traffic into unexpected broadcast domains and produce control-plane warnings. Make the native choice explicit and avoid using it as an ordinary user VLAN. Confirm the operational trunk, not only configured intent.

Use discovery as inventory evidence

Cisco Discovery Protocol and LLDP advertise local identity and interface facts to directly connected neighbors. They are valuable for mapping cables, device names, platform capabilities, and port relationships. LLDP is vendor-neutral; CDP is Cisco-specific. Neither proves IP reachability, authentication, or the correct VLAN. Discovery can also expose information, so enable it according to the environment's policy rather than everywhere by reflex.

Aggregate links only when members agree

EtherChannel presents several physical links as one logical port channel. LACP negotiates compatible membership. Active mode initiates; passive waits, so two passive peers do not form a bundle. Layer 2 members share switching parameters. Layer 3 members are routed and must be made routed consistently before the logical interface receives Layer 3 configuration.

Speed, duplex, trunk mode, native VLAN, and allowed VLAN inconsistencies can suspend members or prevent formation. Apply policy to the port-channel where appropriate and verify member flags, protocol, and logical state. More cables do not provide more capacity if only one actually joined.

Read Rapid PVST+ as a loop-prevention decision

Rapid PVST+ elects a root bridge for each VLAN. Every non-root switch selects a root port offering its best path toward that root. Each segment has a designated port, and redundant paths may become alternate. Rapid states can be understood as discarding, learning, and forwarding. Roles say why a port was selected; states say what it currently does.

PortFast lets an edge port move quickly toward forwarding because it should not connect another bridge. BPDU guard complements that assumption by disabling an edge that unexpectedly receives a BPDU. Root guard prevents a port from making an attached switch the root. Loop guard protects against a unidirectional loss of BPDUs on non-designated paths. BPDU filter suppresses BPDUs and can remove spanning-tree protection; it is not a safer version of BPDU guard.

Map wireless control and data paths

In an autonomous design, an AP holds more local control. A controller-based design centralizes functions and policy, while cloud-managed systems use a provider-hosted management plane. AP modes exist for different jobs: serving clients locally, extending remote-site behavior, monitoring RF, capturing traffic, or supporting specialized functions. A mode name must be tied to its traffic and control path.

Physical switch connections matter. An AP may use an access port for its management or tunnel endpoint design, while a controller commonly connects by trunk and may aggregate links. Client VLANs, management VLANs, and controller interfaces must agree with switch configuration. A healthy radio does not repair a missing wired VLAN.

Interpret a WLAN GUI methodically

Read controller screens as structured configuration: WLAN enabled state, SSID, mapped interface or policy, authentication and encryption, QoS profile, and advanced client options. Do not assume a recognizable SSID proves the intended security. Two profiles can broadcast the same name with different policy.

Start with the user requirement, then inspect every field that implements it. For a voice WLAN, QoS and roaming choices matter alongside authentication. For a guest WLAN, segmentation and policy mapping matter alongside the portal.

Secure the management path

Console access is local recovery and bootstrap access. Telnet and HTTP expose management sessions without the protections SSH and HTTPS provide. TACACS+ and RADIUS centralize AAA with different strengths and common use patterns. Cloud- managed access introduces an external management plane whose identity, logging, connectivity, and recovery model must be understood.

Use named administrators, least privilege, encrypted protocols, controlled source networks, and recorded activity. A secure transport does not replace authorization or accountability.

Troubleshoot by finding the first disagreement

Draw the path from endpoint to gateway and annotate VLAN, tag state, port channel, spanning-tree role, wireless mapping, and management boundary. Compare configured and operational state at both ends. The earliest inconsistency is usually more useful than the loudest downstream symptom.