CCNA Foundation Guide

Chapter 1 — The OSI Model

The OSI (Open Systems Interconnection) model provides a conceptual framework for how network communications work. It has 7 layers — memorise them with: "All People Seem To Need Data Processing" (top-down) or "Please Do Not Throw Sausage Pizza Away" (bottom-up).

Chapter 2 — TCP/IP Model & Key Protocols

The TCP/IP model is what actually runs the internet. It collapses OSI layers 5–7 into "Application."

TCP vs UDP

Common Port Numbers (Must Know)

Chapter 3 — Ethernet & Switching

MAC Addresses

MAC (Media Access Control) addresses are 48-bit hardware addresses burned into NICs. Written as AA:BB:CC:DD:EE:FF. First 24 bits = OUI (manufacturer), last 24 bits = unique device ID.

# View MAC address
ip link show eth0
ifconfig eth0

# Cisco switch: show MAC address table
show mac address-table
show mac address-table dynamic

Switch Operation

• Learn — When a frame arrives, the switch learns the source MAC → port mapping
• Forward — If destination MAC is in table, forward to that port only
• Flood — If destination MAC is unknown, flood to all ports except the source
• Filter — If source and destination are same port, drop the frame

Chapter 4 — IP Addressing

See the Subnetting Lab for detailed practical exercises. Key concepts here:

Private Address Ranges (RFC 1918)

Special Addresses

• 127.0.0.1 — Loopback (localhost)
• 169.254.x.x — APIPA (no DHCP available)
• 0.0.0.0 — Default route / all networks
• 255.255.255.255 — Limited broadcast

Chapter 5 — Subnetting & VLSM

Covered in depth in the Subnetting Lab. Quick reference:

/24 = 254 hosts    /27 = 30 hosts
/25 = 126 hosts    /28 = 14 hosts
/26 = 62 hosts     /30 = 2 hosts (point-to-point links)

Chapter 6 — Static Routing

# Cisco IOS static route syntax:
ip route [network] [mask] [next-hop | exit-interface]

# Route to 192.168.2.0/24 via next-hop 10.0.0.2
ip route 192.168.2.0 255.255.255.0 10.0.0.2

# Default route (gateway of last resort)
ip route 0.0.0.0 0.0.0.0 203.0.113.1

# Verify routing table
show ip route

# Route codes in output:
# C = Connected, S = Static, O = OSPF
# R = RIP, D = EIGRP, B = BGP, * = default route

Chapter 7 — OSPF (Open Shortest Path First)

OSPF is a link-state routing protocol. Routers share LSAs (Link State Advertisements) to build a complete topology map, then run Dijkstra's SPF algorithm to find the best paths.

Key OSPF Concepts

• AD (Administrative Distance) — OSPF = 110
• Metric — Cost based on bandwidth (reference BW 100 Mbps by default)
• Router ID — Highest loopback IP, or highest active interface IP
• DR/BDR — On multi-access networks, elected to reduce LSA flooding
• Area 0 — The backbone area. All other areas must connect to it

# Enable OSPF single-area
router ospf 1
 router-id 1.1.1.1
 network 192.168.1.0 0.0.0.255 area 0
 network 10.0.0.0 0.0.0.3 area 0

# Verify OSPF
show ip ospf neighbor
show ip ospf database
show ip route ospf

# Set OSPF cost on an interface
interface GigabitEthernet0/0
 ip ospf cost 10

Chapter 8 — EIGRP

EIGRP (Enhanced Interior Gateway Routing Protocol) is a Cisco advanced distance-vector protocol. Fast convergence, supports unequal-cost load balancing.

# Enable EIGRP (AS number must match on all routers)
router eigrp 100
 network 192.168.1.0 0.0.0.255
 network 10.0.0.0 0.0.0.3
 no auto-summary

# Verify
show ip eigrp neighbors
show ip eigrp topology
show ip route eigrp

# Key metrics: Bandwidth + Delay (by default)
# AD: internal = 90, external = 170, summary = 5

Chapter 9 — VLANs & Trunking

VLANs (Virtual LANs) logically segment a network at Layer 2 without needing separate physical switches.

# Create a VLAN
vlan 10
 name SALES
vlan 20
 name IT

# Assign port to VLAN (access port)
interface FastEthernet0/1
 switchport mode access
 switchport access vlan 10

# Configure trunk port (carries multiple VLANs)
interface GigabitEthernet0/1
 switchport mode trunk
 switchport trunk encapsulation dot1q
 switchport trunk allowed vlan 10,20,30
 switchport trunk native vlan 99

# Verify
show vlan brief
show interfaces trunk

# Router-on-a-stick (inter-VLAN routing)
interface GigabitEthernet0/0.10
 encapsulation dot1q 10
 ip address 192.168.10.1 255.255.255.0
interface GigabitEthernet0/0.20
 encapsulation dot1q 20
 ip address 192.168.20.1 255.255.255.0

Chapter 10 — Spanning Tree Protocol (STP)

STP prevents Layer 2 loops by blocking redundant paths. Without STP, a broadcast loop would bring down a switched network instantly.

STP Port States

# Show STP status
show spanning-tree
show spanning-tree vlan 10

# Set bridge priority (lower = more likely to become root)
spanning-tree vlan 10 priority 4096

# PortFast — skip listening/learning for access ports
interface FastEthernet0/1
 spanning-tree portfast

# RSTP (802.1w) — much faster convergence than classic STP
spanning-tree mode rapid-pvst

Chapter 11 — Access Control Lists (ACLs)

ACLs filter traffic on routers. An implicit deny all sits at the end of every ACL — if traffic doesn't match any permit statement, it's dropped.

# Standard ACL (filters source IP only, numbers 1-99)
access-list 10 permit 192.168.1.0 0.0.0.255
access-list 10 deny any

# Apply to interface (inbound or outbound)
interface GigabitEthernet0/0
 ip access-group 10 in

# Extended ACL (src, dst, protocol, port — numbers 100-199)
access-list 110 permit tcp 10.0.0.0 0.0.0.255 any eq 80
access-list 110 permit tcp 10.0.0.0 0.0.0.255 any eq 443
access-list 110 deny ip any any

# Named ACL (preferred — easier to edit)
ip access-list extended BLOCK_TELNET
 deny tcp any any eq 23
 permit ip any any

interface GigabitEthernet0/1
 ip access-group BLOCK_TELNET in

# Verify
show access-lists
show ip interface GigabitEthernet0/0

Chapter 12 — NAT & PAT

NAT (Network Address Translation) converts private IPs to public IPs, allowing many devices to share one public IP address.

# PAT (Port Address Translation / NAT Overload)
# Most common — many-to-one translation

# Define inside/outside interfaces
interface GigabitEthernet0/0
 ip nat inside
interface GigabitEthernet0/1
 ip nat outside

# Create ACL for traffic to translate
access-list 1 permit 192.168.0.0 0.0.255.255

# Enable PAT (overload)
ip nat inside source list 1 interface GigabitEthernet0/1 overload

# Verify NAT translations
show ip nat translations
show ip nat statistics

Chapter 13 — DHCP & DNS

# Configure DHCP server on Cisco router
ip dhcp excluded-address 192.168.1.1 192.168.1.10

ip dhcp pool LAN
 network 192.168.1.0 255.255.255.0
 default-router 192.168.1.1
 dns-server 8.8.8.8 8.8.4.4
 lease 7

# Verify
show ip dhcp pool
show ip dhcp binding

# DNS resolution process:
# 1. Client checks local cache
# 2. Client asks configured DNS server
# 3. DNS server checks its cache
# 4. DNS server queries root, then TLD, then authoritative server
# 5. Answer returned and cached

# DNS record types
# A     = hostname → IPv4
# AAAA  = hostname → IPv6
# MX    = mail server
# CNAME = alias
# PTR   = reverse lookup (IP → hostname)
# NS    = authoritative name server
# TXT   = arbitrary text (SPF, DKIM)

Chapter 14 — Network Security

Layer 2 Attacks & Mitigations

# Port Security — limit MACs per port
interface FastEthernet0/1
 switchport port-security
 switchport port-security maximum 2
 switchport port-security violation restrict

# DHCP Snooping
ip dhcp snooping
ip dhcp snooping vlan 10,20
interface GigabitEthernet0/1
 ip dhcp snooping trust   # uplink to real DHCP server

# Dynamic ARP Inspection
ip arp inspection vlan 10
interface GigabitEthernet0/1
 ip arp inspection trust

Chapter 15 — IPv6 Basics

IPv4 is exhausted. IPv6 uses 128-bit addresses providing 340 undecillion unique addresses.

# IPv6 address format: 8 groups of 4 hex digits
2001:0db8:85a3:0000:0000:8a2e:0370:7334

# Can compress consecutive zeros with ::
2001:db8:85a3::8a2e:370:7334

# Special addresses:
::1/128          = loopback
fe80::/10        = link-local (always starts with fe80)
ff02::1          = all-nodes multicast
2001:db8::/32    = documentation/examples

# Configure IPv6 on Cisco interface
ipv6 unicast-routing
interface GigabitEthernet0/0
 ipv6 address 2001:db8:1::1/64
 ipv6 address fe80::1 link-local

# Show IPv6 info
show ipv6 interface brief
show ipv6 route