14 October 2024

CCNA Super Study Guide: Section 1

by C. Casquatch

Space to dump notes for CCNA

End goal is to obtain a CCNA certificate from Cisco and maybe learn networking

Utilities Used

Neil Anderson (Gold CCNA Bootcamp)
Jeremy’s IT Lab 200-301 Video Series on Youtube
Packet Tracer

Environments Used

Packet Tracer
GitHub

CCNA 200-301 Exam Notes: 1.0 Network Fundamentals

1.1 Explain the Role and Function of Network Components

OSI Layers and Network Services

The OSI (Open Systems Interconnection) model is a conceptual framework used to understand network interactions. It consists of 7 layers, each with its specific role in handling communication:

Application Layer:
- Provides network services directly to end-user applications.
- Examples: HTTP, FTP, DNS, SMTP.
Presentation Layer:
- Ensures data is properly formatted, encrypted, and compressed for transmission.
- Examples: Encryption protocols (SSL/TLS), data formats (JPEG, ASCII).
Session Layer:
- Manages and controls the dialog between two systems, establishing, maintaining, and terminating sessions.
- Examples: NetBIOS, RPC.
Transport Layer:
- Provides reliable data transfer, error correction, flow control, and segmentation.
- Protocols: TCP (Transmission Control Protocol), UDP (User Datagram Protocol).
Network Layer:
- Handles logical addressing, routing, and path selection across networks.
- Protocols: IP (Internet Protocol), ICMP (Internet Control Message Protocol).
Data Link Layer:
- Responsible for framing, addressing (MAC), and error detection on the local network.
- Protocols: Ethernet, ARP (Address Resolution Protocol).
Physical Layer:
- Deals with the physical transmission of binary data over the network media (wires, fiber, radio).
- Examples: Electrical signals, optical signals, radio frequencies.

Protocol Data Units (PDU)

Each layer in the OSI model adds a specific header to data, encapsulating it as it moves down the layers:

Layer 1 (Physical Layer): Bits — Transmission of raw binary data over physical media.
Layer 2 (Data Link Layer): Frames — Data is packaged with MAC addresses for local delivery.
Layer 3 (Network Layer): Packets — Data is encapsulated with logical addressing (IP addresses).
Layer 4 (Transport Layer): Segments — Data is divided into segments for reliable transmission.

Encapsulation Process:

Segment: Encapsulates application layer data (Layers 5-7).
Packet: Encapsulates transport layer segments (Layer 4).
Frame: Encapsulates network layer packets (Layer 3).
Physical Layer: Converts frames and packets to binary bits for transmission over the network medium.

TCP/IP Reference Model vs. OSI Model

TCP/IP Model	OSI Model
Application Layer	Session, Presentation, Application Layers
Transport Layer	Transport Layer
Internet Layer	Network Layer
Network Access Layer	Data Link Layer, Physical Layer

The TCP/IP model is more simplified, combining some of the OSI layers, such as the Application Layer merging the functionalities of OSI’s Application, Presentation, and Session layers.

Network Devices and OSI Layers

Each network device operates at a specific layer of the OSI model. Understanding their roles helps in troubleshooting and network design.

Firewall:
- Primarily operates at Layer 7 (Application Layer), though can filter traffic based on lower layers as well.
Wireless Access Point (AP):
- Operates at Layer 2 (Data Link Layer) to connect wireless devices to a wired network.
Wireless LAN Controller (WLC):
- Operates at Layer 2 to manage access points, ensuring consistent network access across multiple APs.
Switch:
- Operates at Layer 2 (Data Link Layer) to switch frames between devices within the same network.
Router:
- Operates at Layer 3 (Network Layer), routing packets between different subnets and networks.
Bridge:
- Operates at Layer 2 (Data Link Layer), connecting two network segments and managing traffic between them.

1.1.a What is a Router?

A Router is a device that forwards packets between networks or subnets based on IP addresses.
Routers do not forward traffic automatically unless configured with routing rules.
Firewall devices can inspect traffic up to Layer 7 and may offer routing capabilities as well, ensuring security across network boundaries.

1.1.b Layer 2 and Layer 3 Switches

Layer 2 Switch:
- Operates at the Data Link Layer (Layer 2), using MAC addresses to forward frames within the same LAN or VLAN.
- Does not route traffic between different subnets.
Layer 3 Switch:
- Functions like a router but with more limited routing features. It can forward packets between different subnets and perform routing within a local network.

1.1.c Next-Generation Firewalls and IPS

Firewall:
- Protects the network from unauthorized access and malicious attacks (viruses, ransomware, phishing).
Next-Generation Firewalls:
- Go beyond traditional packet filtering, providing advanced capabilities such as application-level inspection, intrusion prevention, and user-based security.
- Example: Cisco ASA with FirePower integration.
- Includes features like deep packet inspection up to Layer 7, inspecting not just headers but the entire content of data packets.
Packet Filters:
- A basic form of firewall using Access Control Lists (ACLs) to filter traffic based on IP address and port number without connection tracking.
IDS/IPS (Intrusion Detection/Prevention Systems):
- IDS detects suspicious activities using predefined signatures and anomaly detection techniques.
- IPS not only detects but also prevents attacks by blocking harmful traffic.
- Requires skilled personnel to manage false positives and negatives, ensuring system security without hindering legitimate traffic.

1.1.d Access Points (AP)

Access Points convert electrical signals to electromagnetic waves and vice versa, allowing wireless devices to connect to the network.
APs extend the coverage of a network and support communication between wired and wireless devices.

1.1.e Controllers (Cisco DNA Center and WLC)

Cisco DNA Center:
- An SDN (Software-Defined Networking) controller that simplifies network management by centralizing the configuration and monitoring of devices.
- Helps automate network operations and improve network security in enterprise environments.
Wireless LAN Controller (WLC):
- Manages and configures multiple access points from a central location.
- Autonomous vs. Lightweight APs:
  - Autonomous APs: Standalone devices with full functionality.
  - Lightweight APs: Rely on a WLC for configuration and management.
- CAPWAP Protocol: Used by lightweight APs to communicate with WLC over UDP ports 5246/5247.
- Split-MAC Architecture: APs handle real-time traffic processing, while WLC manages control plane operations (configuration, monitoring).
- FlexConnect: Allows APs in branch offices to forward local traffic directly without routing through the central WLC.

1.1.f Endpoints

Endpoints refer to devices like PCs, laptops, smartphones, and tablets that interact with the network to access applications, transmit, and receive data.
Endpoints are crucial for providing users with network services and applications.

1.1.g Servers

Servers host applications, databases, and other resources for endpoints.
They provide centralized resources and services that are accessed by client devices across the network.

1.1.h Power over Ethernet (PoE)

Power over Ethernet (PoE) allows network cables (Ethernet) to deliver both data and power to devices such as IP phones, access points, and cameras.
PoE simplifies infrastructure by reducing the need for separate power cables for each device.

1.2 Describe Characteristics of Network Topology Architectures

1.2.a Two-Tier Architecture

Collapsed Distribution and Core Layers:
- In a two-tier architecture, the traditional distribution and core layers are combined into a single layer.
- Simplifies network design by reducing complexity and hardware requirements.
- Commonly used in small to medium-sized networks where scalability and redundancy are not as critical.

1.2.b Three-Tier Architecture

Traditional Campus Design:
- The three-tier architecture is a widely used design that includes three distinct layers:
  - Access Layer: Connects end devices (computers, printers, etc.) to the network.
  - Distribution Layer: Aggregates data from access switches and connects to the core layer.
  - Core Layer: The backbone of the network, responsible for high-speed data forwarding across the network.
- This architecture provides a clear separation of roles, promoting scalability, redundancy, and better traffic management.

1.2.c Spine-Leaf Architecture

Modern Topology for Data Centers and Cloud Environments:
- Spine-Leaf architecture is designed for high-performance and scalable data center networks.
- The topology consists of two layers: Spine (core) and Leaf (access).
  - Spine Layer: Connects all leaf switches to provide high-speed, low-latency communication between them.
  - Leaf Layer: Connects endpoints such as servers, storage, and other devices to the network.
Full Mesh Connectivity:
- Each spine switch is connected to every leaf switch, ensuring that traffic between leaf switches can travel through multiple paths for reliability and redundancy.

Components:

Spine Switches: These act as the backbone of the network, providing the core connectivity and forwarding traffic between leaf switches.
Leaf Switches: These switches handle local traffic, connecting servers and endpoints, and forward traffic to the spine switches.

Traffic Types:

East-West Traffic:
- Refers to traffic flowing between servers and devices within the same data center (leaf-to-leaf communication).
- Typically used for inter-server communication, such as database replication or virtual machine migration.
North-South Traffic:
- Refers to traffic that flows between servers and external networks (leaf-to-external communication).
- This includes communication to and from the internet or remote data centers.

Benefits:

Scalability:
- The spine-leaf architecture allows for easy scaling by simply adding more spine or leaf switches as needed.
Predictable Latency:
- With a fully meshed spine network, latency is predictable, as there are multiple paths for traffic.
High Availability:
- Redundancy in the network ensures that if one path fails, traffic can be rerouted through other available paths, minimizing downtime.
Efficient Bandwidth Usage:
- The architecture is designed to avoid bottlenecks and ensure efficient use of available bandwidth by distributing traffic evenly across the network.

1.2.d WAN (Wide Area Network)

Connecting Multiple LANs:
- A WAN connects multiple Local Area Networks (LANs) over large geographic areas, such as different cities, regions, or even countries.
- It facilitates communication and data sharing across long distances.

Technologies:

Leased Lines:
- Dedicated, point-to-point circuits provided by service providers, offering reliable and fixed-bandwidth connectivity.
MPLS (Multiprotocol Label Switching):
- A method for speeding up the flow of traffic on the network by using labels to route data efficiently.
Satellite:
- Provides connectivity for remote locations where wired connections may not be feasible.
SONET/SDH (Synchronous Optical Networking/Synchronous Digital Hierarchy):
- Optical network technology that provides high-speed transmission over fiber-optic cables.
DWDM (Dense Wavelength Division Multiplexing):
- A technology that allows for the transmission of multiple data signals over a single fiber optic cable, increasing bandwidth.
MPLS VPNs (Layer 2/3):
- Virtual private networks that use MPLS technology to create secure, private communication channels over a public network.

1.2.e Small Office/Home Office (SOHO)

LAN Technologies:
- DSL (Digital Subscriber Line): A high-speed internet connection over traditional phone lines.
- Cable: Provides broadband internet via coaxial cable, often used in residential and small office setups.
- Wireless (4G/5G): Mobile broadband technologies that enable internet connectivity in locations with cellular coverage.
Lacks Corporate SLAs:
- Unlike large enterprises, SOHO networks typically do not have service-level agreements (SLAs) with their internet service providers (ISPs), leading to potential issues with reliability and performance.

1.2.f On-Premises and Cloud

On-Premises:

In-House Equipment:
- On-premises solutions involve the organization owning and maintaining its hardware and software within its physical location.
- Requires capital investment and ongoing maintenance for equipment, facilities, and staff.
Benefits:
- Full control over hardware and data.
- Security and compliance concerns can be directly managed.
Drawbacks:
- High upfront costs and ongoing maintenance expenses.
- Scalability may be limited by physical space and budget constraints.

Cloud:

Shared, On-Demand Computing Resources:
- Cloud computing involves renting resources (storage, compute power) from a third-party provider over the internet.
- It offers flexibility, scalability, and reduced overhead for hardware and infrastructure management.
Benefits:
- Lower upfront costs and no need for on-site hardware.
- Scalable resources that can grow with the business needs.
- Service providers handle maintenance, upgrades, and security.
Drawbacks:
- Potential for data privacy concerns, depending on the provider’s security policies.
- Reliance on internet connectivity for access.

Colocation Facilities:

Renting Space in Third-Party Data Centers:
- Organizations can rent physical space in a data center, where they house their own equipment.
- The colocation provider manages the physical security, power, cooling, and environmental controls.
Facility Services:
- Power, cooling, and physical security are handled by the facility owner, allowing the organization to focus on its hardware and services.

1.3 Compare Physical Interface and Cabling Types

Ethernet Cables

UTP (Unshielded Twisted Pair) vs. STP (Shielded Twisted Pair):
- UTP: Typically used in environments where electromagnetic interference (EMI) and radio frequency interference (RFI) are minimal.
- STP: Provides additional shielding to protect against EMI and RFI, making it more suitable for environments with higher interference, such as industrial or high-density settings.
Categories of Ethernet Cables:
- Cat 5e:
  - Supports speeds of up to 1 Gbps over a maximum distance of 100 meters.
  - Ideal for most basic network applications in small office/home office (SOHO) environments.
- Cat 6:
  - Supports speeds up to 10 Gbps over shorter distances (up to 55 meters for 10 Gbps speeds).
  - More stringent specifications for crosstalk and system noise than Cat 5e, making it suitable for higher-performance networks.
- Cat 6a:
  - An enhanced version of Cat 6 that supports 10 Gbps speeds over distances up to 100 meters.
  - Offers improved EMI/RFI resistance due to better shielding, making it ideal for environments with significant interference or for long cable runs.
- Cat 7:
  - Supports 10 Gbps speeds, with enhanced shielding for each pair of wires and overall cable shielding.
  - Designed for higher-speed applications in environments where electromagnetic interference (EMI) is a concern, ensuring better performance over long distances.

Fiber-Optic Cables

Single-Mode Fiber:
- Used for long-distance communication with a smaller core size (typically 8-10 µm).
- Laser light is used to transmit data, allowing for higher bandwidth and much longer distances compared to multi-mode fiber.
- Typically deployed in telecom and long-haul network environments.
Multi-Mode Fiber:
- Used for shorter distances (typically up to 2 km) with a larger core size (50-62.5 µm).
- Uses LEDs for data transmission, providing sufficient bandwidth for local area networks (LANs) and data centers.
- More cost-effective than single-mode for shorter distances but subject to higher attenuation.
Core Sizes:
- Single-Mode: 8-10 µm – A small core that allows light to travel in a single path, minimizing signal loss and enabling long-distance communication.
- Multi-Mode: 50-62.5 µm – A larger core that allows multiple light paths, making it suitable for shorter distances but with greater potential for signal degradation over long runs.

Serial Connections

RS-232:
- A standard for serial communication that was widely used for connecting computers and peripherals in the past.
- Typically used for legacy device communication, such as connecting modems, printers, or older equipment.
- Uses DB-9 or DB-25 connectors, with DB-9 being the more common of the two.
DB-9/DB-25 Connectors:
- DB-9: A 9-pin connector used in RS-232 serial connections. Commonly found in older computers and networking equipment.
- DB-25: A 25-pin version of the RS-232 connector, historically used for parallel communication but also supported serial communication.
- RS-232 Pinouts: These connectors have specific pinouts that define the various signals (e.g., data, ground, control) used for communication between devices.

Ethernet Standards

Ethernet standards define the speed and media type for network communication over wired connections:

10BASE-T:
- Provides 10 Mbps speed over twisted-pair copper cables (Cat 3 or higher).
- Primarily used in legacy networks but rarely seen in modern installations due to low data rates.
100BASE-TX:
- Supports 100 Mbps speed over Cat 5 or higher twisted-pair cables.
- Fast Ethernet standard, offering significant improvements over 10BASE-T and commonly used in most older networks.
- Ideal for general office applications and smaller networks, though it is being phased out in favor of faster standards.
1000BASE-T:
- Known as Gigabit Ethernet, supporting 1 Gbps speed over Cat 5e or higher twisted-pair cables.
- Common in most modern office and home networks, providing ample bandwidth for general applications, such as video streaming, file sharing, and gaming.
- Widely used in data centers and high-performance environments where faster speeds are needed.
10GBASE-T:
- Supports 10 Gbps speed over Cat 6a or Cat 7 cables, designed for high-performance networks.
- Used in high-traffic networks, such as data centers, enterprise environments, and applications requiring large-scale data transfers, such as cloud computing and virtualization.
- Requires higher-quality cables and advanced infrastructure to handle the increased speed and ensure reliability over longer distances.

1.4 Identify Interface and Cable Issues (Collisions, Errors, Mismatched Duplex, and/or Speed)

Interface Speed and Duplex Parameters

Speed and Duplex settings are critical for successful communication between network devices.
Duplex Modes:
- Half Duplex: Data transmission occurs in one direction at a time. This mode is less efficient and can lead to collisions.
- Full Duplex: Data transmission occurs simultaneously in both directions. This mode is preferred for higher network efficiency and eliminates collisions.
Speed Settings:
- Network interfaces have a specific speed setting, such as 10Mbps, 100Mbps, 1Gbps, etc.
- The clockrate command is used on serial interfaces to configure the speed for the DCE (Data Circuit-terminating Equipment) side.

Mismatched Speed or Duplex Settings

Mismatched settings between two devices can cause communication issues, including:
- Collisions (in half-duplex mode).
- Errors in data transmission, leading to network instability.
- Reduced performance due to improper negotiation of speeds and duplex modes.
Symptoms of Mismatched Duplex:
- Interface performance issues, such as high error rates and reduced throughput.
- CRC (Cyclic Redundancy Check) errors in the output of the show interface command.
Fixing Mismatched Duplex:
- Ensure both ends of the link are set to the same speed and duplex settings. It is recommended to set both sides to auto-negotiate if possible.

Broadcast and Collision Domains

Collision Domain:
- A segment of the network where data packets can collide with one another when being transmitted over shared media (in half-duplex mode).
- Switches: Divide collision domains as each port on a switch is a separate collision domain, minimizing the impact of collisions.
Broadcast Domain:
- A network segment in which all devices receive broadcast packets.
- Routers: Separate broadcast domains as they do not forward broadcast packets across interfaces.
Key Points:
- Using switches helps reduce the size of collision domains.
- Using routers helps reduce the size of broadcast domains, improving network efficiency.

1.5 Compare TCP to UDP

TCP (Transmission Control Protocol)

Connection-oriented:
- Establishes a connection between the sender and receiver before data transmission begins.
- Uses a handshake process to set up the connection, ensuring both parties are ready for communication.
Flow Control and Sequencing:
- Flow control ensures that data is sent at a manageable rate, preventing network congestion.
- Sequencing ensures that data is delivered in the correct order, even if packets take different paths.
Error Recovery:
- Includes mechanisms for error detection and error correction.
- If packets are dropped or corrupted, they are retransmitted automatically, ensuring reliable delivery.
Efficiency:
- Due to the overhead from the handshake, flow control, and error recovery, TCP is generally slower than UDP.
- The additional packet processing increases latency, making TCP less efficient for time-sensitive applications.

UDP (User Datagram Protocol)

Connectionless:
- Does not establish a connection before transmitting data, meaning there is no handshake.
- Data is sent as independent packets, with no guarantee of delivery.
Error Checking:
- Checksums (Cyclic Redundancy Check - CRC) are used for error detection.
- If a packet is found to be erroneous, it is simply discarded.
- There is no retransmission of lost packets, making UDP a best-effort protocol.
Speed and Efficiency:
- UDP is faster than TCP due to the lack of connection establishment, retransmissions, and error correction.
- Lower latency makes it ideal for real-time applications, such as video streaming or online gaming, where speed is more critical than reliability.
Use Cases:
- UDP is typically used for applications that can tolerate some packet loss and prioritize speed, such as live broadcasts, VoIP, and DNS queries.

Inter-Application Communication

The Session ID is used to facilitate logical communication between application processes, ensuring each session is uniquely identified.
OSI Session Layer: Responsible for establishing, managing, and terminating sessions between applications. It ensures synchronization and recovery in case of interruptions.
For each session, such as a file download, a unique session ID is generated to track and maintain the session.
Port numbers (also known as socket numbers) identify specific applications on a server. Each port corresponds to a unique service or application.
When data is sent, the server uses the port number to route packets to the appropriate application.

Table 2: TCP/UDP Port Assignment

Protocol	Port	Type
Telnet	TCP 23	TCP
SMTP	TCP 25	TCP
FTP	TCP 21	TCP
HTTP	TCP 80	TCP
SNMP	UDP 161	UDP
DNS	TCP/UDP 53	Both
HTTPS	TCP 443	TCP
SSH	TCP 22	TCP
TFTP	UDP 69	UDP

1.6 Configure and Verify IPv4 Addressing and Subnetting

IPv4 Addressing

IPv4 Addresses:
- IPv4 addresses consist of 32 bits, typically written in dotted decimal notation as x.x.x.x (where each x represents an octet or 8 bits).
- An example of an IPv4 address is 192.168.1.1.
Router Interface:
- For a router’s interface to become active, it must be manually enabled using the command:
```
no shut
```
  - This command removes the administrative shutdown state and activates the interface.

Subnetting

Classful Addressing:
- Classful addressing divides IP addresses into predefined classes (A, B, C) based on their first few bits.
Classless Inter-Domain Routing (CIDR):
- CIDR allows for more flexible and efficient IP address allocation by removing the strict class boundaries.
- Example of CIDR notation: 172.10.10.10/20.
  - /20 represents the subnet mask 255.255.240.0, which is used to define the network portion of the address.
Subnetting:
- Subnetting involves borrowing bits from the host portion of the address to create additional subnets.
- Formula for the number of subnets:
  2^subnet-bits
- Formula for the number of hosts per subnet:
  (2^host-bits - 2)
  - The subtraction of 2 accounts for the network address and broadcast address which cannot be assigned to hosts.
  Example Calculations:
  - Class C /28 subnet:
    - Number of subnets: 2^4 = 16 subnets.
    - Number of hosts per subnet: 2^4 - 2 = 14 hosts.
  - Class B /28 subnet:
    - Number of subnets: 2^12 = 4096 subnets.
    - Number of hosts per subnet: 2^12 - 2 = 4094 hosts.

Variable Length Subnet Masks (VLSM)

VLSM allows for subnets of varying sizes based on the required number of hosts.
- It is especially useful for optimizing IP address space usage, as it permits you to create subnets that are tailored to specific needs.
Design Considerations for VLSM:
- Start by allocating larger subnets to areas with the highest host requirements.
- Plan for future growth by leaving room for expansion.
Example of VLSM:
- An engineering department needs 28 hosts.
- A sales department needs 14 hosts.
- A router link requires a small subnet, for example, just 2 hosts.

Private IPv4 Addressing

RFC 1918 defines the private IPv4 address ranges, which are reserved for internal networks and not routable on the internet.
Network Address Translation (NAT):
- NAT allows private IP addresses to be translated into public IP addresses for internet access. This enables multiple devices on an internal network to share a single public IP address.

Private IPv4 Address Ranges (as per RFC 1918):

Class A:
- 10.0.0.0 – 10.255.255.255
- Subnet Mask: 10.0.0.0/8
Class B:
- 172.16.0.0 – 172.31.255.255
- Subnet Mask: 172.16.0.0/12
Class C:
- 192.168.0.0 – 192.168.255.255
- Subnet Mask: 192.168.0.0/16

1.7 Describe Private IPv4 Addressing

Private IP Addressing (RFC 1918)

RFC 1918 specifies a set of private IP address ranges that are reserved for internal use within a private network and are not routable on the public internet.
These private address spaces are used in internal networks where devices need to communicate with each other but don’t require direct access to the internet.
Network Address Translation (NAT) is used in private networks to allow devices with private IP addresses to access external resources by translating their private IP addresses into a public IP address for communication with the internet.

Private Address Ranges

Private IPv4 addresses are divided into three classes:

Class A Private Addresses

Range: 10.0.0.0 – 10.255.255.255
Subnet Mask: 255.0.0.0 or /8
Address Block: 10.0.0.0/8
- Provides a large address space, supporting up to 16 million hosts.
- Typically used for large networks requiring a vast number of IP addresses.

Class B Private Addresses

Range: 172.16.0.0 – 172.31.255.255
Subnet Mask: 255.240.0.0 or /12
Address Block: 172.16.0.0/12
- Supports up to 1 million hosts.
- Often used in medium-sized networks, providing a balance between address space and network efficiency.

Class C Private Addresses

Range: 192.168.0.0 – 192.168.255.255
Subnet Mask: 255.255.0.0 or /16
Address Block: 192.168.0.0/16
- Supports up to 65,000 hosts.
- Commonly used in small networks, such as home or small office setups.

Key Concepts

Private IP Addresses: Used for devices within an internal network that do not need to be directly accessible from the internet.
NAT (Network Address Translation): Mechanism that translates private IP addresses into a single public IP address (or a range of public IP addresses) to enable internet access.
Private Address Space: Provides flexibility and security for internal communication without the need for public IP addresses, which are limited and costly.

1.8 Configure and Verify IPv6 Addressing and Prefix

To configure IPv6:
- Command: ipv6 unicast-routing
To verify IPv6 configuration:
- Command: show ipv6 interface brief

IPv6 Addressing Format

IPv6 Address:
- IPv6 uses a 128-bit address, compared to IPv4’s 32-bit address.
- The address is written as: X:X:X:X:X:X:X:X
- Each X is a 16-bit hexadecimal field (hex values: 0-9, A-F).
- Example: 2001:0DB8:0000:0001:0000:0000:0000:0001
- Each segment is 16 bits, often called “hextets,” “pieces,” or “quartets.”
Address Shortening:
- Remove leading zeros in each field.
  - Example: 2001:0DB8:0000:0001:0000:0000:0000:0001 becomes 2001:DB8:0:1:0:0:0:1.
- Collapse consecutive zero fields to ::.
  - Example: 2001:0DB8:0000:0001:0000:0000:0000:0001 becomes 2001:DB8:0:1:0:0:0:1, or 2001:DB8:0:1::1.
- Successive zero fields can only be shortened once to avoid confusion:
  - 2001:0:0:1:0:0:0:B can be shortened to 2001::1:0:0:0:B or 2001:0:0:1::B.
- It cannot be shortened as 2001::1::B.

Stateless Address AutoConfiguration (SLAAC)

Addressing Options:
- IPv6 addresses can be assigned via static addressing, DHCPv6, or SLAAC.
- DHCPv6: Stateful addressing (server tracks MAC-to-IP assignments).
- SLAAC: Stateless addressing (router advertises subnet, host generates its own address).
  - Modern operating systems randomize the host portion for privacy.
  - The router does not track host addresses but provides the default gateway.
  - DHCPv6 is still required for non-IP configurations (e.g., DNS servers).

Router Advertisements

Router Advertisements:
- When a global unicast IPv6 address is configured, Router Advertisements advertise the network prefix.
- Sent via ICMP messages to the “All Nodes” multicast address from the router’s link-local address.
- Hosts may also send a Router Solicitation message to request information.

The Unspecified Address

:: is the unspecified or unknown address.
- Equivalent to IPv4’s 0.0.0.0 0.0.0.0.
- Used as the source address when an interface is trying to acquire an address.

Neighbor Discovery

Neighbor Discovery:
- IPv6’s version of ARP (Address Resolution Protocol).
- Uses ICMP Neighbor Solicitations and Neighbor Advertisements instead of ARP requests and replies.
- Neighbor Solicitation messages are sent to the Solicited-Node multicast address, reaching all hosts on the subnet.

Verification Commands

Verify IPv6 neighbors:
- Command: show ipv6 neighbors

1.9 Describe IPv6 Address Types

IPv6 defines several types of addresses, each serving different purposes. These address types allow for flexible and efficient addressing, with some mandatory for interface configurations, while others are optional. Multiple addresses can exist on the same interface for different purposes.

1.9.a Unicast (Global, Unique Local, and Link Local)

Unicast:
- A unicast address is used for one-to-one communication. It can be classified into three types:
  - Global Unicast Addresses (GUA)
  - Unique Local Addresses (ULA)
  - Link Local Addresses (LLA)
Global Unicast Addresses (GUA):
- Similar to IPv4 public addresses, these addresses are globally reachable unless blocked by security policies (e.g., firewall).
- Assigned from the 2000::/3 range by Internet authorities.
- Typically assigned a /48 prefix (e.g., 2001:10:10::/48 for an organization).
- IPv6 standards recommend using /64 subnets for host addresses.
- Example: If a company is assigned 2001:10:10::/48, they can create subnets such as 2001:10:10:0::/64 to 2001:10:10:FFFF::/64, providing 65,536 subnets.
- Each subnet can support 18,446,744,073,709,551,616 hosts.
- Using /64 simplifies addressing and enables the use of EUI-64 addresses for host configuration.
Unique Local Addresses (ULA):
- Similar to IPv4 RFC 1918 private addresses, these addresses are not publicly reachable.
- Assigned from the FC00::/7 range.
- Typically used for internal networks and should be assigned /64 addresses.
Link Local Addresses (LLA):
- Valid only for communication within the local link (i.e., not routable outside of the local network segment).
- Assigned from the FE80::/10 to FEB0::/10 range.
- Hosts should be assigned /64 addresses.
- Used for local communications like routing protocol traffic, neighbor discovery, and other link-specific tasks.
- Mandatory on IPv6-enabled interfaces, such as those on Cisco routers.
- Automatically generated using the EUI-64 method, though they can be manually configured.
- The same Link Local Address can be used across multiple interfaces since they are only valid within the local link.

1.9.b Anycast

Anycast:
- A one-to-nearest communication method, where a packet is delivered to the “nearest” interface, as determined by the Interior Gateway Protocol (IGP).
- Anycast addresses are allocated from the unicast address space.

1.9.c Multicast

Multicast:
- A one-to-many communication method, where an address is assigned to a group of interfaces.
- Multicast addresses are used to deliver packets to multiple interfaces, replacing the need for IPv4 broadcast.
- Note: IPv6 does not have a broadcast address.

1.9.d Modified EUI-64

EUI-64 (Extended Unique Identifier-64):
- A Cisco router can automatically generate an IPv6 address based on the device’s MAC address.
- The MAC address (48 bits) is extended to 64 bits by inserting FF:FE in the middle.
- The 7th bit (Universal/Local bit) is inverted.
- This allows the host portion of the IPv6 address to be derived from the MAC address, ensuring a globally unique address.
Limitations and Recommendations:
- EUI-64 is useful for generating host addresses on individual devices but is not recommended for routers, as static, memorable addresses are easier to troubleshoot.
- Static addresses like 2001:DB8:0:1::1 are preferred for router interfaces over EUI-64.
- EUI-64 addresses are well-suited for host interfaces where automatic address generation is useful.

Configuring Static Link Local Addresses

Static Link Local Addresses:
- Configuring a static link-local address will override any existing EUI-64 generated address.
- Example command for configuration: ipv6 address FE80::1 link-local.

IPv6 Stateless Address Autoconfiguration (SLAAC)

SLAAC:
- Stateless Address Autoconfiguration allows IPv6 hosts to automatically configure their addresses using the router’s advertisement without requiring a DHCP server.
- A router advertisement is sent out with the network prefix, which the host uses to generate its own IPv6 address.
- SLAAC is stateless, meaning the router does not track which host has which address.
- DHCPv6 may still be used alongside SLAAC to provide additional information like DNS servers.
Privacy Concerns:
- EUI-64 addressing uses the MAC address to generate the host portion of the address, which can raise privacy concerns as MAC addresses can be traced.
- Modern operating systems randomize the host portion of the address to mitigate these privacy concerns.

IPv6 Router Advertisements and Solicitation

Router Advertisements (RA):
- When a global unicast address is configured, the router sends Router Advertisements (RA) to inform hosts of the network prefix.
- These ICMP messages are sent to the “All Nodes” multicast address from the router’s link-local address.
Router Solicitation:
- Hosts may also send a Router Solicitation message to request router information, such as the network prefix.

Special IPv6 Addresses

Unspecified Address (::):
- The :: address is used to indicate an unspecified or unknown address.
- In routing, the ::/0 address is the default route, similar to IPv4’s 0.0.0.0/0.
Neighbor Discovery (ND):
- IPv6 Neighbor Discovery (ND) replaces IPv4’s ARP.
- Neighbor Solicitation (NS) and Neighbor Advertisement (NA) messages are used to discover neighbors and resolve addresses on the local network.

IPv6 Routing and Dual-Stack

IPv4 and IPv6 Routing:
- IPv4 and IPv6 have separate routing tables.
- Dual-stack routers can run both IPv4 and IPv6 simultaneously, supporting both address families.

1.10 Verify IP Parameters for Client OS (Windows, Mac OS, Linux)

To verify IP parameters on different operating systems, use the following commands:

Windows:
- Command: ipconfig
- Displays IP configuration details such as IP address, subnet mask, default gateway, and DNS servers.
Mac OS:
- Command: ifconfig
- Displays network configuration details, including IP address, netmask, and interface status.
Linux:
- Command: ifconfig or ip a
- The ifconfig command shows network configuration, while the ip a command provides a more detailed, modern output for network interfaces, including IP address and subnet mask.

These commands help ensure that the correct IP parameters are configured on the system, aiding in troubleshooting network connectivity.

1.11 Describe Wireless Principles

Wireless Local Area Networks (WLANs) cannot use CSMA/CD (Carrier Sense Multiple Access with Collision Detection) because wireless communication is half duplex.

1.11.a Non-overlapping Wi-Fi Channels

2.4 GHz Band:
- Non-overlapping channels are 1, 6, and 11.
- Each channel is 20 MHz wide, with channel centers separated by 5 MHz.
- The total available spectrum is only 100 MHz wide, which causes overlap and interference on other channels.
5 GHz Band:
- Channels are also 20 MHz wide but have less overlap compared to the 2.4 GHz band.
- Neighboring Access Points (APs) should be separated by at least one channel to avoid interference.

1.11.b SSID (Service Set Identifier)

SSID is the unique name shared by all devices on the same wireless network.
In public places, the SSID is set on the Access Point (AP) and broadcast to all wireless devices within range.
SSID Characteristics:
- Case-sensitive text string with a maximum length of 32 characters.
- It is the minimum requirement for a WLAN to operate.
- Default SSID on many Linksys APs is “linksys”.

1.11.c RF (Radio Frequency)

Wireless channels operate on specific radio frequencies, with each channel corresponding to a frequency range within the wireless spectrum.

1.11.d Encryption

Some common wireless security standards include:

WEP (Wired Equivalent Privacy) – Introduced in 1999, uses RC4 encryption.
WPA (Wi-Fi Protected Access) – Introduced in 2003, uses RC4 encryption with TKIP (Temporal Key Integrity Protocol).
WPA2 (Wi-Fi Protected Access 2) – Introduced in 2004, uses AES (Advanced Encryption Standard) encryption with CCMP (Counter Cipher Mode with Block Chaining Message Authentication Code Protocol).
WPA3 (Wi-Fi Protected Access 3) – Introduced in 2018, uses AES encryption, CCMP, and provides protection against KRACK (Key Reinstallation Attack).

WPA Personal vs. WPA Enterprise

WPA Personal: Uses pre-shared keys (PSKs) for authentication.
WPA Enterprise: Uses a AAA (Authentication, Authorization, and Accounting) Server for authentication, providing more robust security.

1.12 Explain Virtualization Fundamentals (Server Virtualization, Containers, and VRFs)

Virtualization is a core technology that enables cloud computing by allowing multiple customers to share the underlying hardware. While cloud computing has popularized virtualization, the technology itself has been around for much longer.

Virtualization allows multiple virtual systems to run on a single physical machine, offering flexibility and cost reduction. Redundancy can be achieved by adding multiple physical systems, each hosting virtual systems.

Clustering combines physical systems into a single virtual system, providing both redundancy and increased performance.

Popular Type 1 (Bare Metal) Hypervisors

Type 1 Hypervisors run directly on the system hardware without needing an underlying operating system.
- VMware ESXi (part of the vSphere suite)
- Microsoft Hyper-V
- Red Hat KVM
- Oracle VM Server
- Citrix XenServer

Popular Type 2 Hypervisors

Type 2 Hypervisors run on top of a host operating system.
- VMware Workstation, Player, and Fusion
- VirtualBox
- QEMU
- Parallels

Containers vs. Type 1 Hypervisors

Containers are similar to virtual machines but virtualize software layers above the operating system level. They package an application or microservice with the dependencies needed to run it (e.g., system executables, libraries).
Advantages of Containers:
- Smaller in size compared to virtual machines.
- Lightweight, fast to provision, and portable across different environments.
Docker is the most well-known container engine.

Example of Virtual Switching with Nexus 1000V

Virtual Switching allows network switches to be virtualized to provide greater flexibility and scalability within a virtualized environment. The Nexus 1000V is a virtual switch used in these scenarios.

Firewall Virtualization with Contexts (e.g., ASA)

Firewall Virtualization allows multiple virtual firewalls to run on a single physical firewall appliance.
In the case of ASA (Adaptive Security Appliance), this can be done using contexts where each context acts as a separate virtual firewall.

Example of Virtual Routing and Forwarding (VRFs)

Virtual Routing and Forwarding (VRF) is a technology that allows multiple routing tables to exist on the same physical router, providing network isolation and flexibility.
VRFs are commonly used in enterprise environments to segment traffic and provide secure, isolated networks within the same physical infrastructure.

1.13 Describe Switching Concepts

1.13.a MAC Learning and Aging

MAC Learning:

Definition and Function: MAC learning is a fundamental process in Ethernet switching. When a switch receives a data frame from a source device, it examines the source MAC address and associates it with the incoming port in its MAC address table. This process allows the switch to dynamically learn the MAC addresses of devices connected to its ports.
- Source: Demystifying Switching Concepts: MAC Learning and Aging, Frame Switching, Frame Flooding, and MAC Address Table - Ben Paxton
MAC Aging: To maintain an accurate and up-to-date MAC address table, switches implement MAC aging. Entries in the MAC address table are given a predetermined aging time, and if no traffic is received from a specific MAC address within that time, the entry is removed.
- Source: Demystifying Switching Concepts: MAC Learning and Aging, Frame Switching, Frame Flooding, and MAC Address Table - Ben Paxton

How MAC Learning Works:

Frame Reception: When a switch receives a frame on one of its ports, it checks the source MAC address in the frame header.
MAC Address Table Update: The switch updates its MAC address table with the source MAC address and the corresponding ingress port.
Address Table Entry: Each entry includes the MAC address, the associated port, and a timestamp showing when the entry was last updated.

Example Scenario:

Consider a switch receiving frames from three devices (Device A, B, and C) connected to Ports 1, 2, and 3, respectively.
- Initial State: MAC address table is empty.
- Frame Reception:
  - A frame from Device A arrives on Port 1, the switch learns the MAC address (MAC_A) and associates it with Port 1.
  - The MAC address table is updated: MAC_A: Port 1
- Similar processes happen for Devices B and C.
- MAC Address Table After Learning:
  - MAC_A: Port 1
  - MAC_B: Port 2
  - MAC_C: Port 3

Importance of MAC Learning:

Efficient Forwarding: MAC learning ensures switches forward frames only to the correct ports, reducing unnecessary traffic.
Auto-Configuration: Switches dynamically update their MAC address tables as devices connect or disconnect.
Plug-and-Play Connectivity: Devices can be connected to any port on a switch without manual configuration.

How MAC Aging Works:

Aging Process: Entries are periodically checked, and if a MAC address has not been updated within the aging time, it is removed from the table.
- Example Scenario (continued from above):
  - Initial State (with a 5-minute aging time):
    - MAC_A: Port 1 (Last updated: 10:00 AM)
    - MAC_B: Port 2 (Last updated: 10:02 AM)
    - MAC_C: Port 3 (Last updated: 10:05 AM)
  - At 10:10 AM, the switch checks for entries older than 5 minutes.
  - Removed: MAC_A (last updated at 10:00 AM).
  - Remaining: MAC_B and MAC_C.
- Resulting MAC Address Table:
  - MAC_B: Port 2 (Last updated: 10:02 AM)
  - MAC_C: Port 3 (Last updated: 10:05 AM)

Significance of MAC Aging:

Resource Optimization: Removes stale entries, conserving memory and processing power.
Network Security: Prevents unauthorized devices from “hijacking” MAC addresses.
Adaptability: Allows switches to update their tables based on changing network conditions.

1.13.b Frame Switching

Switching Decision: Upon receiving a data frame, the switch uses the destination MAC address to decide the outgoing port. The frame is then forwarded only to the port where the destination device resides.
Store-and-Forward vs Cut-Through Switching:
- Store-and-Forward: The entire frame is received before being forwarded. This allows error checking for data integrity.
- Cut-Through: The frame is forwarded as soon as the destination MAC address is identified, resulting in lower latency but no error checking.

1.13.c Frame Flooding

Broadcast and Unknown Unicast Frames: When a switch receives a broadcast frame (destined for all devices) or an unknown unicast frame (destination MAC address not found in the table), it engages in frame flooding. This means the frame is broadcast to all ports except the incoming port, helping ensure it reaches its destination.
Reducing Frame Flooding: Techniques like Spanning Tree Protocol (STP) and Rapid STP (RSTP) help minimize frame flooding by creating loop-free network topologies and preventing broadcast storms.

1.13.d MAC Address Table

Structure and Content: The MAC address table (also known as the CAM table) contains entries with MAC addresses and their corresponding ports. This table helps the switch make forwarding decisions based on the destination MAC address.
Dynamic and Static Entries:
- Dynamic Entries: Learned through MAC learning and aging.
- Static Entries: Manually configured by network administrators to ensure specific MAC addresses are always associated with particular ports.

tags: ccna - study - cisco