Network Access & Switching

Broadcast Domain Segmentation

Without VLANs, all ports on a switch share one broadcast domain — every broadcast reaches every device. VLANs partition this into multiple smaller broadcast domains, reducing unnecessary traffic and improving security. Devices in different VLANs cannot communicate without a Layer 3 device (router or L3 switch).

VLAN Types

• Data VLAN: Carries regular user traffic
• Voice VLAN: Dedicated to VoIP phones; ensures QoS prioritization
• Management VLAN: Used for switch management (SSH, Telnet, SNMP)
• Native VLAN: Frames sent untagged on 802.1Q trunk (default VLAN 1)

Access Port

Assigned to a single VLAN. Frames are sent and received without any 802.1Q tag. Connected to end devices (PCs, printers, IP phones). The switch adds/removes the tag internally.

Config: switchport mode access → switchport access vlan X

Trunk Port

Carries multiple VLANs simultaneously. Frames are tagged with 802.1Q headers (except native VLAN frames). Used on switch-to-switch links and switch-to-router links.

Config: switchport mode trunk → switchport trunk allowed vlan X,Y,Z

Native VLAN

Frames belonging to the native VLAN are transmitted untagged on an 802.1Q trunk. Both ends of the trunk must be configured with the same native VLAN — a mismatch causes STP topology issues, CDP warnings, and potential traffic misdelivery. Best practice: change native VLAN away from VLAN 1 and make it unused.

DTP (Dynamic Trunking Protocol)

Cisco proprietary protocol that auto-negotiates trunk links between switches. Modes: dynamic auto (passive, waits), dynamic desirable (actively negotiates). Best practice: disable DTP with switchport nonegotiate and manually configure trunk/access mode to prevent VLAN hopping attacks.

Router-on-a-Stick

One physical router interface connected to a trunk port. Multiple subinterfaces are created on the router — one per VLAN — each configured with encapsulation dot1q VLAN_ID. Router performs L3 routing between VLANs. Simple but single point of congestion.

SVI (Switched Virtual Interface)

Virtual Layer 3 interface created on a multilayer switch — one SVI per VLAN. The switch performs routing internally between VLANs without needing an external router. More scalable and faster than Router-on-a-Stick. Command: interface vlan X → assign IP → ip routing.

The L2 Loop Problem

Ethernet frames have no TTL (unlike IP packets). If a loop exists, a broadcast frame circulates forever — this is called a broadcast storm. It consumes 100% of bandwidth and CPU, crashing all switches in the loop. STP solves this by logically blocking redundant paths while keeping them as standby failover paths.

STP Port States (802.1D)

• Blocking: Receives BPDUs only; does not forward frames or learn MACs
• Listening (15s): Processes BPDUs, no forwarding, no MAC learning
• Learning (15s): Builds MAC table, still no forwarding
• Forwarding: Full operation — learns MACs and forwards frames
• Disabled: Administratively shut down

Total convergence time: ~30–50 seconds

Bridge ID & Election Process

Bridge ID = 2-byte Priority + VLAN ID + 6-byte MAC
The switch with the lowest Bridge ID becomes the root bridge. Default priority = 32768. If priorities tie, lowest MAC address wins.

All ports on the root bridge are Designated Ports (forwarding).
Best practice: manually set the root bridge priority to ensure predictable topology.

Port Cost (Path to Root)

• 10 Mbps = cost 100
• 100 Mbps = cost 19
• 1 Gbps = cost 4
• 10 Gbps = cost 2
• 100 Gbps = cost 1

Non-root switches elect a Root Port (RP) — the port with the lowest cumulative path cost to the root bridge.

RSTP Improvements

• Convergence: <1 second vs STP's 30–50 seconds
• Only 3 port states: Discarding · Learning · Forwarding
• Backward compatible with 802.1D
• Uses proposal/agreement mechanism for rapid convergence
• Edge ports (PortFast equivalent) go directly to Forwarding

RSTP Additional Port Roles

• Root Port: Same as STP — best path to root
• Designated Port: Same as STP — forwarding on segment
• Alternate Port: Backup path to root bridge (replaces blocked RP)
• Backup Port: Backup to a Designated Port on the same segment (less common)

Alternate port = instant failover if root port fails (no recalculation needed)

PortFast

Allows an access port to skip the Listening and Learning states and go directly to Forwarding. Eliminates the 30-second wait when an end device connects. Only safe on ports connected to end hosts — never use on switch-to-switch links.

Enable: spanning-tree portfast
Global: spanning-tree portfast default

BPDU Guard

If a PortFast-enabled port receives a BPDU (which only switches send), BPDU Guard immediately error-disables the port. Protects against someone accidentally connecting a switch to an access port, which could destabilize the STP topology.

Enable: spanning-tree bpduguard enable
Recovery: shutdown → no shutdown

What EtherChannel Does

Bundles 2–8 physical links into one logical Port-Channel interface. STP sees a single logical link — no links are blocked. Provides load balancing across all member links based on a hash (src/dst MAC, IP, or port). If one link fails, traffic shifts to remaining links automatically.

EtherChannel Negotiation Protocols

• LACP (802.3ad): IEEE open standard. Modes: active (initiates) / passive (responds). Active-Active or Active-Passive = forms. Passive-Passive = does NOT form.
• PAgP: Cisco proprietary. Modes: desirable (initiates) / auto (responds). Desirable-Desirable or Desirable-Auto = forms.
• Static (on/on): No negotiation protocol. Both sides must be on. Simple but no mismatch detection.

Infrastructure vs Ad-Hoc

• Infrastructure mode: Devices communicate through an Access Point (AP). Standard enterprise and home deployment.
• Ad-hoc (IBSS): Devices communicate directly with each other — no AP required. Peer-to-peer, limited range, no central management.

BSS, ESS & SSID

• BSS (Basic Service Set): One AP + its associated clients. BSSID = AP's MAC address.
• SSID: The network name clients see and connect to.
• ESS (Extended Service Set): Multiple APs sharing the same SSID. Enables seamless roaming between APs as clients move. Each AP has a unique BSSID but the same SSID.

Autonomous AP

Self-contained AP that is individually configured per device. All wireless intelligence (SSID config, security, RF settings) resides on the AP itself. Suitable for small deployments. Does not scale well — managing 50+ APs individually is impractical.

Lightweight AP + WLC

Lightweight APs are "thin" — they forward all wireless traffic to the WLC (Wireless LAN Controller) via CAPWAP tunnels. WLC centrally manages RF channels, power, security policies, QoS, roaming, and firmware for all APs. Scales easily to hundreds of APs. CCNA exam favors this model for enterprise.

Control And Provisioning of Wireless APs

• Protocol between lightweight AP and WLC
• UDP 5246 — CAPWAP control channel (AP management, config)
• UDP 5247 — CAPWAP data channel (encapsulated 802.11 traffic)
• All wireless frames encapsulated in CAPWAP and sent to WLC
• WLC decapsulates, applies policy, and forwards to wired network

MAC Flooding

Attacker sends thousands of frames with fake source MACs, filling the switch's CAM table. Once full, the switch cannot learn new entries and begins flooding all frames to all ports — acting like a hub. Attacker can capture all traffic. Mitigated by Port Security.

VLAN Hopping

Two methods: Double Tagging — attacker sends frame with two 802.1Q tags; switch strips outer tag, inner tag lands in victim VLAN; DTP Switch Spoofing — attacker tricks switch into forming a trunk using DTP. Mitigated by disabling DTP (switchport nonegotiate) and changing native VLAN.

DHCP Attacks

DHCP Starvation: Attacker exhausts DHCP pool with fake MAC requests — legitimate clients cannot get IPs. DHCP Spoofing: Rogue DHCP server responds with malicious gateway/DNS — man-in-the-middle attack. Both mitigated by DHCP Snooping.

ARP Spoofing / Poisoning

Attacker sends gratuitous ARP replies associating their MAC with a legitimate IP (often the gateway). Victims update their ARP cache — traffic flows to attacker instead. Enables man-in-the-middle attacks. Mitigated by Dynamic ARP Inspection (DAI).

Port Security

Limits the number of valid MAC addresses per switch port. Violation modes:
Protect: Drops violating frames silently, no log
Restrict: Drops frames + increments violation counter + syslog
Shutdown (default): Error-disables the port immediately, sends SNMP trap
Sticky MACs: dynamically learned and saved to running-config

DHCP Snooping

Switch feature that classifies ports as trusted (uplinks to real DHCP server) or untrusted (access ports to clients). Blocks DHCP OFFER/ACK on untrusted ports. Builds a DHCP snooping binding table (MAC, IP, port, VLAN) used by DAI and IP Source Guard. Enable globally + per VLAN + mark uplinks trusted.

Dynamic ARP Inspection (DAI)

Validates ARP packets by checking them against the DHCP snooping binding table. If the MAC-IP mapping in an ARP reply doesn't match the binding table, the frame is dropped. Operates on untrusted ports. Requires DHCP snooping to be enabled first to populate the binding table.

Storm Control

Limits the rate of broadcast, multicast, or unknown unicast frames on a port. If the rate exceeds a configured threshold (as % of bandwidth or pps), frames are dropped or the port is shut down. Prevents broadcast storms from affecting the rest of the network.