Cisco Certified Network Associate (CCNA) 200-301 · Free study guide

Network fundamentals: from media to forwarding

Network fundamentals are most useful when they form one model rather than a collection of definitions. A frame crosses a physical medium, a switch learns its source, a router moves the packet between prefixes, and an application uses a transport service. Addressing, cabling, device roles, and virtualization all describe different boundaries in that journey.

Start with the job of each component

An endpoint originates or consumes application traffic. A server is an endpoint that provides a service to others, although the distinction is operational, not a different packet format. A Layer 2 switch forwards frames within a VLAN using MAC addresses. A Layer 3 switch can also route between IP prefixes. A router connects routed networks and selects a path from its routing table.

An access point bridges compatible wireless clients into a wired distribution system. A controller can centralize wireless policy, configuration, and control. A next-generation firewall makes policy decisions with context beyond basic addresses and ports, while intrusion prevention inspects traffic for malicious patterns or behavior. Power over Ethernet lets a switch provide power and data on the same supported copper link; power budget and device requirements still have to agree.

Choose topology from traffic and failure domains

A two-tier campus commonly collapses core and distribution functions, reducing device count for a modest site. A three-tier campus separates access, distribution, and core roles to support larger scale and clearer failure and policy boundaries. A spine-leaf fabric gives each leaf a path through every spine, creating predictable east-west connectivity when equal-cost paths are used. It is not simply a campus diagram rotated ninety degrees; its traffic and scaling assumptions differ.

WAN describes connectivity across sites or provider domains. SOHO designs have fewer devices but still need addressing, secure wireless, updates, and recovery. Cloud placement changes ownership and connectivity, not the need for routing, segmentation, identity, and observability. Hybrid designs must make the boundary and responsibility model explicit.

Respect the physical layer

Copper Ethernet is economical and can carry PoE, but its supported length and electromagnetic environment matter. Multimode fiber suits many building and data-center runs; single-mode fiber supports much longer distances with the right optics. Fiber type, connector, wavelength, and transceiver must all be compatible. A lit interface is helpful evidence, not proof that speed, duplex, errors, VLAN, and Layer 3 settings are correct.

Counter patterns narrow faults. CRC errors suggest damaged frames reaching the interface. Late collisions in a modern switched link point toward duplex trouble or an abnormal shared-media condition. A speed or duplex mismatch may leave the link up while performance collapses. Compare both ends and examine counter deltas over a controlled interval instead of treating lifetime totals as a current incident.

Make transport requirements explicit

TCP establishes connection state, numbers bytes, acknowledges delivery, and handles retransmission, ordering, flow control, and congestion response. UDP sends independent datagrams with lower transport overhead and no built-in delivery or ordering guarantee. Neither word means fast or slow in every case. The application decides whether it can tolerate loss, add its own recovery, or benefit from a reliable byte stream.

A DNS query often uses UDP for a compact exchange but can use TCP where needed. Real-time media may prefer timely delivery over retransmitting stale data. File transfer benefits from reliable ordering. Ask which behavior the application requires rather than memorizing a single protocol example.

Treat addressing as a boundary calculation

An IPv4 prefix marks which leading bits describe the network. The remaining bits identify addresses within it. For a conventional subnet, derive the network by clearing host bits and the broadcast by setting them. The usable range sits between those boundaries, subject to the design and platform. Private RFC 1918 space is not globally routed by ordinary Internet policy; NAT is a separate translation function, not a property that makes a private address valid.

IPv6 uses 128 bits and hexadecimal notation. Compress only one longest run of zero groups with ::, and never infer a missing prefix from formatting. Link- local unicast supports local-link operations, global unicast is designed for broader routed use, unique-local provides an internal-use range, multicast addresses groups, and anycast lets multiple interfaces share an address whose routing leads a sender to one instance. Modified EUI-64 is one interface-ID method, not the only way hosts obtain addresses.

Trace host and switching evidence

On a client, confirm interface state, address and prefix, default gateway, and DNS resolver. Windows, macOS, and Linux present these through different tools, but the logic is the same. A correct address with a missing gateway explains remote-prefix failure; a correct gateway with a wrong resolver explains why an IP test succeeds while a name fails.

A switch learns from the source MAC address of received frames. A known unicast is sent toward the learned destination port. An unknown unicast and a broadcast are flooded within the VLAN except back toward the ingress port. Entries age so the table reflects current attachment. MAC learning says nothing about the validity of an IP address.

Separate virtual boundaries

A virtual machine includes a guest operating system on virtualized hardware. A container usually shares the host kernel while isolating processes and packaged dependencies. A VRF separates Layer 3 routing tables on one network device. They solve different problems: compute isolation, application packaging, and routing isolation. A design may use all three.

Diagnostic discipline

Move from layer to layer. Verify power and link, interface counters, VLAN and MAC state, host parameters, routing, transport reachability, then the application. Capture what changed and compare both ends of a link. The most useful fundamental is not a command; it is the habit of naming the boundary you are testing and the evidence that would disprove your current explanation.