CCNA command reference

IPv4 addresses are 32-bit values expressed in dotted decimal and combined with a subnet mask to separate network and host portions. Correct addressing is the foundation for all routing and switching labs.

Subnetting divides a network into smaller segments by borrowing host bits for additional network bits. Fast, accurate subnetting is a core CCNA skill tested heavily on the exam.

VLSM allows a single classful or summarized address block to be subdivided into subnets of different sizes, matching each subnet size to the actual number of hosts required and avoiding address waste.

Static routes are manually configured paths to remote networks, offering predictability and low overhead but requiring manual updates when the topology changes.

A default route is the gateway of last resort used to forward traffic when no more specific route matches, commonly used for internet-bound traffic or stub sites.

OSPF is a classless, link-state interior gateway protocol that builds a topology database via the SPF algorithm and converges quickly. It is heavily tested on the CCNA in single and multi-area designs.

VLANs segment a switch into separate broadcast domains at Layer 2. Each VLAN requires its own IP subnet if hosts need to route between VLANs.

Access ports carry traffic for a single VLAN and are used to connect end devices such as PCs, printers, and APs in access mode.

Trunk links carry traffic for multiple VLANs between switches using 802.1Q tagging, with one VLAN typically left untagged as the native VLAN.

Inter-VLAN routing allows hosts in different VLANs to communicate, implemented via router-on-a-stick subinterfaces or Layer 3 switching with SVIs.

STP prevents Layer 2 loops by placing redundant links into a blocking state, electing a root bridge and calculating loop-free paths.

EtherChannel bundles multiple physical links into one logical link to increase bandwidth and provide redundancy while avoiding STP blocking of individual members.

OSPFv3 is the IPv6 version of OSPF, using the same link-state mechanics as OSPFv2 but running per-link instead of per-subnet and requiring a router ID in dotted-decimal form even without IPv4 configured.

IPv6 uses 128-bit hexadecimal addresses with distinct unicast, multicast, and anycast types. CCNA candidates must recognize address formats and configure them on interfaces.

IPv6 routing supports static routes, RIPng, OSPFv3, and EIGRP for IPv6, alongside address autoconfiguration mechanisms like SLAAC and DHCPv6.

Rapid PVST+ speeds up convergence compared to classic 802.1D STP, and additional guard features protect against topology instability and unauthorized switches.

Advanced EtherChannel topics cover load-balancing behavior, Layer 3 EtherChannels, and consistency checks that prevent channels from forming incorrectly.

CDP is a Cisco proprietary Layer 2 discovery protocol and LLDP is the IEEE 802.1AB open standard equivalent, both used to learn about directly connected neighbor devices.

DHCP automates IPv4 address assignment using the DORA process. IOS routers can act as a DHCP server or client for lab and small-office scenarios.

DHCP relay allows a router to forward DHCP broadcast messages between clients and a DHCP server on a different subnet, using the ip helper-address feature.

NAT translates private IPv4 addresses to public addresses for internet access, using static, dynamic, or PAT (NAT overload) methods.

NTP synchronizes device clocks, syslog centralizes logging, and DNS resolves hostnames, all commonly configured together for operational visibility on IOS devices.

QoS classifies, marks, and prioritizes traffic to manage congestion and ensure critical applications like voice and video receive proper treatment.

Access control lists filter IPv4 traffic based on source and/or destination criteria. They are processed top down with an implicit deny at the end of every list.

IPv6 ACLs are always named, use a different syntax than IPv4 ACLs, and include implicit permit statements required for neighbor discovery to function.

Port security restricts the number and identity of MAC addresses allowed on an access switchport to prevent unauthorized devices and MAC flooding.

Basic device security includes securing local and remote access lines, encrypting passwords, and configuring SSH as a secure replacement for Telnet.

DHCP snooping filters DHCP messages on a switch to prevent rogue DHCP servers and builds a binding table used by other security features like Dynamic ARP Inspection.

Dynamic ARP Inspection validates ARP packets against the DHCP snooping binding table to prevent ARP spoofing and man-in-the-middle attacks on a VLAN.

Covers RF basics, access point modes, and the controller-based architecture used to deploy and manage enterprise WLANs. Focuses on how a WLC and lightweight APs work together using CAPWAP.

Covers authentication and encryption options for WLANs, from open networks to enterprise-grade 802.1X, and how these are configured on a WLC.

Covers the protocols and practices used to manage, monitor, and maintain network devices, including time synchronization, logging, monitoring, and secure file transfer.

Covers the shift from traditional device-by-device CLI management to controller-based networking and automation using APIs and configuration management tools.

Covers a layered, methodical approach to diagnosing network problems, moving through the OSI model to isolate faults efficiently rather than guessing.