This is the base layer of CCNA - how devices are physically and logically connected, the models we use to describe networking, and the core terminology examiners lean on hardest.
The OSI model has 7 layers: Physical, Data Link, Network, Transport, Session, Presentation, Application. Remember it as 'Please Do Not Throw Sausage Pizza Away'.
The TCP/IP model condenses this into 4 layers: Network Access, Internet, Transport, Application.
Key mappings: switches operate at Layer 2 (Data Link, using MAC addresses), routers operate at Layer 3 (Network, using IP addresses), and firewalls/load balancers often work at Layer 4 (Transport, using ports).
Common mistake: mixing up which layer does what - PDUs matter too. Layer 4 = segments, Layer 3 = packets, Layer 2 = frames, Layer 1 = bits.
Bandwidth is the theoretical maximum capacity of a link (e.g. 1 Gbps). Throughput is what is actually achieved. Latency is delay in milliseconds - critical for VoIP and video. Jitter is the variation in latency.
A switch builds a MAC address table by reading the source MAC of every incoming frame and mapping it to the port it arrived on. If the destination MAC isn't in the table, the frame is flooded out every port except the one it came in on (unicast flooding). Broadcasts and multicasts are always flooded within the VLAN.
A VLAN creates a separate broadcast domain on shared switch hardware. Access ports carry traffic for one VLAN only; trunk ports carry multiple VLANs tagged with 802.1Q, which inserts a 4-byte tag holding a 12-bit VLAN ID (range 1-4094, with 1002-1005 reserved for legacy VLANs). VLAN 1 is the default VLAN and carries untagged traffic plus control-plane traffic on many switches - best practice is to move management off VLAN 1. The native VLAN on a trunk is sent untagged; both ends must agree on it or you get a native VLAN mismatch (a common exam trap and a real security issue, since it can allow VLAN hopping).
EtherChannel bundles up to 8 active physical links into one logical link for bandwidth and redundancy. It negotiates using PAgP (Cisco proprietary, modes desirable/auto) or LACP (open standard, modes active/passive). Both ends need matching speed, duplex, VLAN, and trunk settings or the bundle won't form.
STP (IEEE 802.1D) prevents Layer 2 loops by electing a root bridge (lowest bridge ID: priority + MAC, default priority 32768) and blocking redundant paths. Port states are blocking, listening, learning, forwarding (and disabled) - convergence can take up to 50 seconds with classic STP. Rapid PVST+ (802.1w) converges in seconds using alternate/backup roles. PortFast should only be enabled on ports connecting to end devices, never to another switch, since it skips listening/learning and can create a loop if misused - always pair it with BPDU Guard.
Every router builds a routing table from three sources: directly connected routes, static routes you configure by hand, and dynamic routes learned via a routing protocol. When a packet arrives, the router does a longest prefix match - it picks the route with the most specific (longest) matching subnet mask, not just the first match it finds. If there is no match at all and no default route (0.0.0.0/0), the packet is dropped and the router should send back an ICMP destination unreachable message.
When two different sources offer a route to the same destination, the router picks the one with the lowest administrative distance (AD). Learn these: connected = 0, static = 1, EIGRP internal = 90, OSPF = 110, RIP = 120, and anything unreachable/unknown = 255 (never installed). A common exam trap: metric only breaks ties WITHIN the same protocol - AD decides between protocols first.
Static routes are simple, predictable and use zero CPU/bandwidth for calculation, but do not adapt if the network changes - you must edit them manually. Dynamic routing protocols (OSPF, EIGRP, RIP) automatically discover and adapt to topology changes but add complexity and overhead. A default static route (ip route 0.0.0.0 0.0.0.0 <next-hop>) is the classic 'gateway of last resort' used on stub networks like a small branch office.
OSPF is a link-state protocol using Dijkstra's SPF algorithm, AD 110, and cost as its metric (cost = reference bandwidth ÷ interface bandwidth, default reference 100 Mbps on older IOS). Routers become neighbours by exchanging Hello packets (default 10s on broadcast links, 30s on NBMA) and must agree on: area ID, subnet mask, hello/dead timers, and authentication type. Area 0 is always the backbone - every other area must connect back to it, directly or via a virtual link.
Devices in different VLANs cannot talk without a router or Layer 3 switch. Router-on-a-stick uses one physical interface split into sub-interfaces (each tagged with dot1Q encapsulation for its VLAN) - cheap but limited by the single link's bandwidth. A Layer 3 switch with SVIs (switched virtual interfaces) is the enterprise standard - faster and scales better.
DHCP (Dynamic Host Configuration Protocol) automatically hands out IP addresses, subnet masks, default gateways and DNS servers to hosts, saving manual configuration.
The process is DORA:
If a client roams back onto a subnet where it already has a valid lease, it can skip straight to Request/Acknowledge (a shortened exchange).
When the DHCP server sits on a different subnet from the client, a router does not forward broadcasts by default, so you configure the ip helper-address command on the client-side interface. This turns the broadcast into a unicast and forwards it to the DHCP server, also relaying DNS, TFTP and other UDP broadcast services.
On IOS routers you can build a small DHCP server with ip dhcp pool NAME, then network, default-router and dns-server sub-commands. Use ip dhcp excluded-address to stop the pool handing out addresses reserved for statics like gateways and servers - do this before defining the pool or the router will hand those addresses out first.
Common mistake: forgetting the excluded-address statement, causing an IP conflict with the gateway.
NAT (Network Address Translation) maps private IP addresses (RFC 1918: 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16) to a public address so multiple internal hosts can share limited public IPs and reach the internet.
Key terms: inside local (private address as seen inside), inside global (public address as seen outside). Interfaces must be marked ip nat inside or ip nat outside or translation will not happen.
Common mistake: configuring the NAT pool/ACL correctly but forgetting the inside/outside interface commands.
NTP (Network Time Protocol) synchronises device clocks across a network, which matters for accurate logging, certificate validation and troubleshooting timelines.
NTP uses a stratum hierarchy: stratum 0 devices are reference clocks (atomic/GPS), stratum 1 servers are directly connected to them, and each hop away adds one to the stratum number, up to a maximum of stratum 15 (stratum 16 means unsynchronised).
Devices can operate in client mode (ntp server IP) or peer mode (ntp peer IP) for mutual synchronisation between equals. Check sync state with show ntp status and show ntp associations - look for the sys.peer indicated by an asterisk.
Common mistake: assuming NTP works instantly - convergence can take several minutes as the client gradually steps or slews its clock.
CCNA security fundamentals cover the core concepts you need before touching a firewall CLI: threats, key security principles, and the basic controls Cisco expects you to recognise.
This topic tests whether you understand WHY networks are moving away from box-by-box CLI configuration towards centralised, software-driven control. CCNA does not expect you to write code fluently, but you must know the concepts, the architecture, and the key terms.
Traditional networks are managed device-by-device via CLI (SSH/console), which does not scale and is prone to human error and configuration drift. Controller-based (SDN) networks separate the control plane (decision-making, on a central controller) from the data plane (packet forwarding, on the switches/routers). The controller has a network-wide view and pushes configuration to devices via APIs, giving consistency and speed.
Getting the direction backwards is a very common exam trap - remember 'North looks up to apps, South looks down to devices'.
Automation tools exchange structured data, not screen-scraped CLI text. Know the three formats:
REST APIs use standard HTTP methods: GET (read), POST (create), PUT/PATCH (update), DELETE (remove).
Three tools are named on the exam - know their model and language:
Agentless (Ansible) is simpler to deploy since nothing extra is installed on the managed device.
Students often mix up northbound/southbound, forget that JSON has no closing tags (unlike XML), and confuse push (Ansible/SSH) versus pull (Puppet/Chef, agent-based) automation models. Also remember APIs are typically consumed over HTTPS with authentication tokens, not plain HTTP.