CCNA foundations — study plan and your first network

This guide will help you connect separate CCNA topics into one working picture: trace a packet, build a small network, and find a fault methodically. In the example lab, two logically separate segments (VLANs) communicate through routing, receive addresses through DHCP, and have traffic limited by an access control list (ACL); every step maps to a part of the exam. As of 12 September 2026, Cisco lists 200-301 CCNA v1.1 as the current exam. A “domain” here means one category of exam requirements. The six domains are network fundamentals, network access, IP connectivity, IP services, security fundamentals, and automation and programmability. Cisco has published v2.0 topics, but the refreshed exam launches on 3 February 2027. Check Cisco's exam page again before booking.

How data crosses a network

The layered model splits communication into levels, each adding what its own stage needs. An application creates data, the transport layer adds TCP or UDP ports, IP adds source and destination addresses, and Ethernet adds MAC addresses for the current link. Adding these headers is called encapsulation. Each router builds a new layer-2 frame, while the destination IP normally stays unchanged. Understand that process first, then connect it to protocol data unit (PDU) names: data, segment/datagram, packet, and frame.

Devices and Ethernet switching

A switch learns source MAC addresses and forwards according to its MAC table. It floods unknown unicast and broadcast within a VLAN. A router separates broadcast domains and selects a next hop from its routing table. Access points bridge wireless clients, firewalls enforce policy, and controllers centralize parts of management.

VLANs, trunks, STP, and EtherChannel

A VLAN logically divides one physical layer-2 infrastructure into separate segments. An access port normally carries one VLAN; an 802.1Q trunk carries multiple tagged VLANs. Native VLAN settings must agree. STP (Spanning Tree Protocol) prevents loops by selecting a root switch and blocking redundant paths. EtherChannel combines compatible links into one logical channel; LACP (Link Aggregation Control Protocol) negotiates the bundle. Practice finding mismatched VLANs, trunk modes, and channel parameters.

IPv4, IPv6, and subnetting

Calculate network, broadcast, host range, and a new prefix by hand, then use a calculator to verify. Start with IPv4, CIDR, and VLSM. ARP maps local IPv4 to layer-2 addresses. IPv6 uses Neighbor Discovery and link-local, global, and unique-local addresses with no broadcast; see the IPv6 guide.

Routing and OSPF

A router chooses the longest matching prefix. A route may come from a directly connected network, a static entry, or a dynamic protocol in which routers exchange information. The default route applies only when no more-specific route matches. For OSPF (Open Shortest Path First), learn neighbor formation, router ID, path cost, DR/BDR selection on a shared network, and single-area configuration. Understand which parameters must agree between neighbors.

IP services and wireless

DHCP supplies address settings, DNS turns names into addresses, NTP synchronizes time, and SNMP and syslog provide device and event visibility. NAT translates addresses, QoS prioritizes traffic handling, and SSH provides encrypted management in place of unprotected Telnet. In Wi-Fi, distinguish radio frequency (RF), channel, band, network name (SSID), authentication, and encryption; coverage, interference, and capacity problems have different symptoms.

Security fundamentals

Apply least privilege, AAA, strong authentication, segmentation, and secure management protocols. A standard ACL focuses primarily on source address; an extended ACL can include protocol, addresses, and ports. Rule order matters and an implicit deny follows the list. Also learn port security, DHCP snooping, dynamic ARP inspection, and VPN and wireless-security basics.

Automation and programmability

Controller-based networking separates parts of decision-making and management from forwarding devices. REST APIs use methods such as GET, POST, PUT/PATCH, and DELETE and return HTTP status codes. JSON contains objects, arrays, and typed values. Be able to read nested responses and distinguish authentication from authorization. Automation still requires protocol knowledge: a bad template scales faster than a manual mistake.

A disciplined troubleshooting method

1. Define the symptom, scope, and last known change.
2. Check physical state, interface status, and error counters.
3. Verify VLANs, trunks, the MAC table, and STP.
4. Check address, prefix, gateway, ARP/ND, and the routing table.
5. Test local stack, gateway, next hop, DNS, and application in order.
6. State one hypothesis, change one variable, and record the result.

Lab: two VLANs, DHCP, and an ACL

Prepare a separate, isolated lab: router R1 with 802.1Q subinterfaces, layer-2 switch S1, and two PCs. The port names below match a Cisco 1941 and Catalyst 2960 layout that can be reproduced in a compatible simulator. Start with unconfigured devices, disconnected from your home or work network and the Internet. If your model uses different port names, replace them consistently throughout the example.

Connections: PC-A — S1 Fa0/1 (VLAN10); PC-B — S1 Fa0/2 (VLAN20); S1 G0/1 — R1 G0/0 (802.1Q trunk).

1. Configure switch S1

Connect the listed ports with Ethernet cables and enter these commands in the S1 console. The Catalyst 2960 uses 802.1Q trunks and needs no trunk-encapsulation selection command. VLAN10 and VLAN20 are tagged, rather than being used as the native VLAN.

enable
configure terminal
hostname S1
vlan 10
 name LAB_A
exit
vlan 20
 name LAB_B
exit
interface FastEthernet0/1
 switchport mode access
 switchport access vlan 10
 no shutdown
exit
interface FastEthernet0/2
 switchport mode access
 switchport access vlan 20
 no shutdown
exit
interface GigabitEthernet0/1
 switchport mode trunk
 switchport trunk allowed vlan 10,20
 no shutdown
end

2. Configure routing and DHCP on R1

Each subinterface is the gateway for one VLAN. R1 serves DHCP on both directly connected subnets, so this variant needs no relay or ip helper-address. Exclusions .1–.9 protect the gateway and eight addresses kept outside the pool.

enable
configure terminal
hostname R1
service dhcp
interface GigabitEthernet0/0
 no ip address
 no shutdown
exit
interface GigabitEthernet0/0.10
 encapsulation dot1Q 10
 ip address 192.168.10.1 255.255.255.0
exit
interface GigabitEthernet0/0.20
 encapsulation dot1Q 20
 ip address 192.168.20.1 255.255.255.0
exit
ip dhcp excluded-address 192.168.10.1 192.168.10.9
ip dhcp excluded-address 192.168.20.1 192.168.20.9
ip dhcp pool LAB_A
 network 192.168.10.0 255.255.255.0
 default-router 192.168.10.1
exit
ip dhcp pool LAB_B
 network 192.168.20.0 255.255.255.0
 default-router 192.168.20.1
end

3. Check the baseline before filtering

Set both PCs to use DHCP. Wait for the ports to forward traffic, then read their addresses with ipconfig in the PC console. Record the actual PC-A and PC-B addresses; do not assume the server always leases the first available address. Tests use numeric addresses, so this lab does not configure DNS.

The first ping may lose a packet during ARP resolution; repeat it. If replies remain absent, check the states above and the PC firewall. Establish working connectivity before adding the ACL so that you can assess one change at a time.

4. Add an ACL and compare traffic direction

On R1, deny packets from VLAN20 to VLAN10 as they enter G0/0.20. The final permit leaves other traffic available for the exercise; this is not a complete firewall policy.

configure terminal
ip access-list extended LAB20_IN
 deny ip 192.168.20.0 0.0.0.255 192.168.10.0 0.0.0.255
 permit ip any any
exit
interface GigabitEthernet0/0.20
 ip access-group LAB20_IN in
end
show ip access-lists LAB20_IN

Repeat the ping from PC-B to PC-A’s actual address: replies are no longer expected, and the deny match counter should increase if the platform reports counters. PC-B’s ping to 192.168.20.1 should still work. A ping started from PC-A to PC-B can also fail: the return packet PC-B → PC-A matches the deny rule. This ACL does not track connection state.

Return to the baseline on R1:

configure terminal
interface GigabitEthernet0/0.20
 no ip access-group LAB20_IN in
end

Check the client-to-client ping again. The states above are expectations derived from the configuration, not a record of a device test performed by IPTools. Syntax and behavior were checked against Cisco documentation for inter-VLAN routing, the DHCP server, and ACLs; compatibility with a particular IOS image or simulator must be checked in your own run.

Eight-week plan and further labs

After completing the exercise above, build separate labs with a second switch, STP, EtherChannel, and routing between routers. DHCP relay, OSPF, NAT, and IPv6 require additional topology and configuration; they are not part of the ready-to-follow example above.

1. Week 1: models, Ethernet, addressing.
2. 2: subnetting and VLSM.
3. 3: VLANs, trunks, STP, EtherChannel.
4. 4: static routing and OSPF.
5. 5: IPv6 and IP services.
6. 6: wireless and security.
7. 7: automation, APIs, JSON.
8. 8: full labs and practice questions mapped to the current blueprint.

This page is a study map, not a replacement for the official blueprint or a complete course. Confirm the version and domain weights directly with Cisco.