CCNA online course

Cisco CCNA Online Course: Networking Fundamentals, Configuration, and Troubleshooting

Study CCNA networking fundamentals with practical Cisco IOS labs covering switching, routing, VLANs, IPv4, IPv6, OSPF, wireless, security, services, automation, and troubleshooting.

This Cisco CCNA online course develops the theory and hands-on skills needed for entry-level networking roles and CCNA certification preparation. You will learn how devices communicate, how Cisco IOS is configured, how networks are secured, and how to isolate faults methodically.

The course assumes basic computer and command-line familiarity, elementary arithmetic, and an introductory understanding of binary and hexadecimal notation. No professional networking experience is required.

CCNA Orientation and Certification Scope

CCNA is a foundational networking credential that validates knowledge of IP addressing, Ethernet switching, routing, wireless networking, security, automation, and common network services. It supports roles such as network administrator, network support technician, systems administrator, infrastructure technician, and help desk technician progressing toward network operations.

Expect a balance of theory and practice. Memorizing commands is not enough: you should understand what a command changes, verify the result, and troubleshoot an incorrect result. A productive study cycle is:

1. Learn the purpose and operation of a technology.
2. Configure it in a lab.
3. Verify the control-plane and data-plane results.
4. Introduce a fault and identify its cause.
5. Document the final configuration and corrective action.

The major learning domains are network fundamentals, network access, IP connectivity, IP services, security fundamentals, and automation and programmability. Cisco IOS CLI practice, subnetting exercises, command interpretation, and scenario-based troubleshooting should accompany every domain.

Building a Home or Virtual Lab

A small lab can use physical Cisco switches and routers, or virtual devices in a network simulator or emulator. Begin with two switches, two routers, and several hosts. Add VLANs, redundant links, a wireless component, and an upstream network as your skills grow. Keep a topology diagram, an address plan, a configuration backup, and a fault log.

Use isolated management credentials and avoid connecting experimental configurations directly to a production network. A lab should support repeated resets, deliberate faults, and verification commands such as show, ping, and traceroute.

Networking Foundations

Network Types and Models

A LAN connects devices across a limited location such as an office. A WAN connects networks across larger geographic areas, commonly through service-provider links. A WLAN is a LAN using wireless radio. The internet is a global interconnection of independently operated networks. An intranet is an organization's private network, while an extranet provides controlled access to selected outside users or partners.

In a client-server model, dedicated servers provide services such as authentication, DNS, file storage, or applications to clients. In a peer-to-peer model, devices can provide services directly to one another without a dedicated central server. Client-server designs are generally easier to control and scale; peer-to-peer designs can be simple for small, informal networks.

Performance Terms

• Bandwidth is the theoretical capacity of a link, usually measured in bits per second.
• Throughput is the actual achieved rate after protocol overhead, congestion, and device limitations.
• Latency is the time required for traffic to travel between points.
• Jitter is variation in packet delay, which can disrupt voice and video.
• Packet loss occurs when traffic is discarded or never reaches its destination.
• Duplex describes whether communication is half-duplex or full-duplex. A duplex mismatch can cause errors and very poor performance.

Common Network Devices

• A switch forwards Ethernet frames within a LAN using MAC addresses.
• A router connects IP networks and selects paths using a routing table.
• An access point bridges wireless clients to a wired network.
• A firewall enforces traffic-control and security policy between zones.
• A wireless LAN controller centrally manages access points, WLAN policy, and often roaming.
• A server provides a network service such as DHCP, DNS, authentication, or file storage.
• An endpoint is a user or application device, such as a laptop, phone, printer, camera, or IP telephone.

OSI and TCP/IP Models

The OSI model is a reference framework for describing network functions. The TCP/IP model groups those functions into fewer practical layers. Models help you identify where a fault is likely to occur; they are not a requirement that every protocol operate in exactly one isolated layer.

Encapsulation adds control information as data moves down the sending stack. An application message becomes a transport-layer segment or datagram, a network-layer packet, a data-link frame, and finally physical-layer bits. Decapsulation removes each header at the receiving device. A router normally removes an incoming frame, examines the packet, makes a routing decision, and encapsulates the packet in a new outgoing frame.

Ethernet uses MAC addresses for local delivery. ARP maps an IPv4 address to a MAC address on a local network. IPv6 uses Neighbor Discovery rather than ARP.

Ethernet Switching and Layer 2 Operation

An Ethernet frame contains source and destination MAC addresses, a payload, and an error-detection field. A unicast is sent to one destination, a multicast targets a subscribed group, and a broadcast targets all devices in the local broadcast domain.

A switch learns the source MAC address of arriving frames and stores it in a MAC address table associated with an interface and VLAN. If the destination is known, the switch forwards the frame only through the matching port. If the destination is unknown, the switch floods it out other ports in the same VLAN. Broadcast frames are also flooded within that VLAN, but not across a router unless a service specifically relays them.

Each switch port is normally a separate collision domain. A VLAN is a separate broadcast domain. Routers and Layer 3 interfaces separate broadcast domains.

enable
configure terminal
interface gigabitethernet 0/1
description User workstation
speed 1000
duplex full
switchport mode access
switchport access vlan 10
no shutdown
end
show interfaces status
show interfaces gigabitethernet 0/1
show mac address-table

Common Layer 2 symptoms include an interface that is administratively down, excessive errors, a duplex mismatch, an incorrect access VLAN, a missing trunk VLAN, or a loop. Check physical indicators, interface counters, speed and duplex, VLAN membership, the MAC table, and trunk state.

IPv4 Addressing and Subnetting

An IPv4 address contains 32 bits, written as four decimal octets. A prefix length, such as /24, identifies the network portion; the remaining bits identify hosts within that network. The equivalent subnet mask for /24 is 255.255.255.0. A host uses a default gateway to send traffic outside its local subnet.

To subnet, borrow host bits for network bits. The number of equal-size subnets is 2^n, where n is the number of borrowed bits. The number of addresses per subnet is 2^h, where h is the number of host bits. Traditional IPv4 host capacity is usually 2^h - 2, excluding the network and broadcast addresses.

Example: divide 192.168.10.0/24 into /26 networks. Four bits are borrowed, creating four subnets. The block size is 64, so the networks are 192.168.10.0, .64, .128, and .192. For 192.168.10.64/26, the network address is .64, the broadcast address is .127, and usable hosts range from .65 through .126.

CIDR supports variable-length subnet masks (VLSM), allowing different subnet sizes in one addressing plan. Allocate the largest requirements first, then smaller requirements, while recording each network, prefix, gateway, usable range, and broadcast address.

interface gigabitethernet 0/0
 description LAN gateway
 ip address 192.168.10.1 255.255.255.0
 no shutdown
show ip interface brief
ping 192.168.10.25
traceroute 203.0.113.10

IPv6 Addressing and Operation

IPv6 addresses contain 128 bits and are written as eight hexadecimal groups separated by colons. Leading zeroes in a group may be removed, and one contiguous sequence of all-zero groups may be replaced by :: once. For example, 2001:0db8:0001:0000:0000:0000:0000:0010 becomes 2001:db8:1::10.

Stateless Address Autoconfiguration (SLAAC) lets a host form an address using a router advertisement (RA). The RA supplies a prefix and configuration flags; the host creates an interface identifier and performs Duplicate Address Detection (DAD). DHCPv6 may supply additional information or addresses depending on the design.

ipv6 unicast-routing
interface gigabitethernet 0/0
 ipv6 address 2001:db8:10::1/64
 ipv6 address fe80::1 link-local
 no shutdown
ipv6 route ::/0 2001:db8:10::fe
show ipv6 interface brief
show ipv6 neighbors
ping ipv6 2001:db8:20::10

IPv4 commonly uses ARP and broadcast-based discovery. IPv6 uses Neighbor Discovery messages, multicast, link-local next hops, and a much larger address space. Both versions use routing tables, prefixes, next hops, and longest-prefix matching.

VLANs, Trunking, and Inter-VLAN Routing

A VLAN logically divides a switch into separate broadcast domains. Use VLANs to separate users, voice devices, guests, servers, and management traffic even when they share physical switches. Devices in different VLANs require Layer 3 routing to communicate.

vlan 10
 name USERS
vlan 20
 name VOICE
interface gigabitethernet 0/2
 switchport mode access
 switchport access vlan 10
interface gigabitethernet 0/24
 switchport mode trunk
 switchport trunk native vlan 99
 switchport trunk allowed vlan 10,20,99
show vlan brief
show interfaces trunk

An IEEE 802.1Q trunk adds VLAN tags to frames so multiple VLANs can cross one link. The native VLAN carries untagged traffic on a trunk; both ends must agree on it. Restricting the allowed VLAN list reduces unnecessary traffic and limits exposure.

Router-on-a-stick uses router subinterfaces on one physical trunk:

interface gigabitethernet 0/0.10
 encapsulation dot1q 10
 ip address 192.168.10.1 255.255.255.0
interface gigabitethernet 0/0.20
 encapsulation dot1q 20
 ip address 192.168.20.1 255.255.255.0
interface gigabitethernet 0/0
 no shutdown

A multilayer switch can route using switched virtual interfaces (SVIs):

ip routing
interface vlan 10
 ip address 192.168.10.1 255.255.255.0
 no shutdown
interface vlan 20
 ip address 192.168.20.1 255.255.255.0
 no shutdown
show ip interface brief
show ip route

For different-VLAN failures, verify access membership, trunk state and allowed VLANs, native VLAN consistency, SVI or subinterface addressing, ip routing, host gateways, and ACLs.

Spanning Tree Protocol

Redundant Layer 2 links provide resilience but can create frames that circulate indefinitely. Spanning Tree Protocol (STP) prevents loops by selecting a loop-free forwarding topology and placing some redundant ports into a non-forwarding state. Rapid STP (RSTP) improves convergence through faster port-state transitions and alternate-port behavior.

The switch with the lowest bridge ID becomes the root bridge. The bridge ID combines a priority value and a MAC address. Each non-root switch selects a root port toward the root. Designated ports forward for their segment; alternate or blocked ports provide backup paths. STP uses path cost to prefer better paths, and topology changes can alter forwarding behavior during convergence.

spanning-tree mode rapid-pvst
spanning-tree vlan 10,20 root primary
interface gigabitethernet 0/5
 spanning-tree portfast
 spanning-tree bpduguard enable
show spanning-tree

Never apply PortFast casually to a switch-to-switch link. If redundant links behave unexpectedly, inspect the root bridge, port roles, costs, blocked paths, EtherChannel state, trunk VLAN lists, and recent topology changes.

EtherChannel and Link Aggregation

EtherChannel bundles multiple physical links into one logical port channel. It increases aggregate capacity, provides redundancy, and gives STP one logical path instead of treating every member as a separate parallel link. Traffic is distributed using a hash of attributes such as source and destination MAC or IP; one flow may remain on one member.

LACP is the standards-based negotiation protocol. PAgP is a Cisco negotiation protocol. All member interfaces must agree on speed, duplex, trunk or access mode, native VLAN, allowed VLANs, and other relevant settings.

interface range gigabitethernet 0/1 - 2
 switchport mode trunk
 switchport trunk allowed vlan 10,20,99
 channel-group 1 mode active
interface port-channel 1
 switchport mode trunk
 switchport trunk allowed vlan 10,20,99
show etherchannel summary
show interfaces port-channel 1

A suspended or partially formed bundle usually indicates inconsistent member configuration, incompatible negotiation modes, cabling problems, or one member being connected to an unexpected device.

Routing Fundamentals

A router removes the incoming data-link header, examines the destination IP address, and searches its routing table. It selects the most specific matching route using longest-prefix match. If multiple routes have the same prefix length, route preference criteria such as administrative distance and metric determine the candidate. The selected route identifies an outgoing interface and, where needed, a next-hop address.

ip route 192.168.20.0 255.255.255.0 10.0.0.2
ip route 0.0.0.0 0.0.0.0 10.0.0.2
ip route 192.168.20.0 255.255.255.0 10.0.0.2 200
ipv6 route 2001:db8:20::/64 2001:db8:1::2
ipv6 route ::/0 2001:db8:1::2
show ip route
show ipv6 route
show ip interface brief

The route with administrative distance 200 in this example is a floating static route: it is retained as a backup and normally loses to a more preferred route. Summary routes reduce table size but must not create black holes for destinations that are not actually reachable.

OSPF Routing

OSPF is a link-state routing protocol. Routers exchange link-state information, build a common link-state database within an area, and calculate shortest paths. A router ID uniquely identifies an OSPF router. Neighbors must form an adjacency before route information is exchanged. An area groups routers and limits the scope of some information; CCNA study commonly starts with single-area OSPF.

router ospf 1
 router-id 1.1.1.1
 network 10.0.0.0 0.0.0.3 area 0
 network 192.168.10.0 0.0.0.255 area 0
 passive-interface gigabitethernet 0/1
 default-information originate
show ip ospf neighbor
show ip ospf interface
show ip protocols
show ip route ospf

For IPv6, enable IPv6 routing and activate OSPF on interfaces:

ipv6 unicast-routing
ipv6 router ospf 1
 router-id 1.1.1.1
interface gigabitethernet 0/0
 ipv6 ospf 1 area 0
show ipv6 ospf neighbor
show ipv6 route ospf

An OSPF neighbor that remains down may have different IP subnets, area numbers, hello or dead timers, network types, authentication settings, or router IDs. Also check whether an interface is passive, whether the interface is operational, and whether an ACL blocks protocol traffic. Compare both ends with show ip ospf interface, show running-config, and show ip protocols.

Wireless Networking

A wireless LAN consists of client devices, access points, wired switching, and optionally a WLAN controller. An SSID is the human-readable WLAN name. A BSSID identifies a specific wireless basic service set, commonly using an access-point radio MAC address. A WLAN is a configured wireless network with its own policy and security settings. Roaming allows a client to move between access points while maintaining connectivity when coverage and design support it.

Radio-frequency design balances coverage and capacity. Channel overlap, walls, distance, transmit power, client density, and non-Wi-Fi interference affect performance. The 2.4 GHz band generally travels farther but has fewer non-overlapping channels and more interference. 5 GHz commonly offers more capacity and channels with shorter range. 6 GHz can provide additional clean spectrum for compatible clients and access points, subject to regional rules and device support.

Personal security commonly uses a pre-shared key. Enterprise security uses centralized authentication, commonly through 802.1X and an AAA service. Prefer modern encryption and strong unique credentials; do not treat a hidden SSID as a security control.

For deployment, survey coverage, place access points for capacity rather than maximum range, plan channels and power, separate guest traffic with VLANs and policy, and verify roaming. Troubleshoot in order: client association, authentication, signal and interference, DHCP, VLAN and trunk transport, routing, DNS, and application reachability.

IP Services

DHCP and DNS

DHCP automatically supplies addresses and options such as the default gateway and DNS server. A common exchange is Discover, Offer, Request, and Acknowledgment. A router does not forward broadcasts by default, so an ip helper-address can relay DHCP requests to a remote server.

ip dhcp pool USERS
 network 192.168.10.0 255.255.255.0
 default-router 192.168.10.1
 dns-server 192.168.10. DNS
interface vlan 10
 ip helper-address 192.168.100.10

Replace the illustrative DNS value with a valid server address in a real configuration. DNS resolves names to addresses and supports records such as A for IPv4, AAAA for IPv6, CNAME for aliases, MX for mail routing, and PTR for reverse lookup. Test an IP address separately from a hostname so DNS failure is not confused with routing failure.

NTP, Monitoring, Logging, and QoS

NTP synchronizes device clocks, which improves log correlation, authentication, and troubleshooting. SNMP allows monitoring systems to collect status and performance information and, in some designs, receive notifications. Syslog sends event messages to local or remote collectors; severity ranges from emergency through debugging, with lower numeric values representing more serious conditions.

ntp server 192.168.100.20
logging host 192.168.100.30
show clock
show logging

Quality of Service (QoS) manages congestion. Classification identifies traffic, marking assigns a value, queuing determines service order, and scheduling controls transmission. Voice is sensitive to delay, jitter, and loss, so QoS designs commonly classify and prioritize voice while preventing priority traffic from consuming all capacity.

NAT and PAT

Network Address Translation (NAT) changes address information between network domains. Port Address Translation (PAT), also called NAT overload, lets many private hosts share one public address by distinguishing sessions with transport-layer ports.

access-list 10 permit 192.168.10.0 0.0.0.255
interface gigabitethernet 0/0
 ip nat inside
interface gigabitethernet 0/1
 ip nat outside
ip nat inside source list 10 interface gigabitethernet 0/1 overload
show ip nat translations
show ip nat statistics

Network Security Fundamentals

The core principles are confidentiality, integrity, and availability. Least privilege grants only the access needed, and defense in depth uses multiple protective layers. Common threats include phishing, malware, spoofing, denial-of-service attacks, and man-in-the-middle attacks.

Secure administrative access with strong unique credentials, an encrypted enable secret, local or centralized AAA, SSH instead of insecure remote protocols, restricted VTY access, management VLAN controls, time synchronization, logging, backups, and documented change procedures.

hostname EDGE-R1
enable secret Use-a-strong-secret
service password-encryption
username admin privilege 15 secret Use-a-unique-secret
ip domain-name lab.example
crypto key generate rsa
line console 0
 login local
line vty 0 4
 login local
 transport input ssh
banner motd ^CAuthorized access only.^C
copy running-config startup-config

An access control list (ACL) matches traffic and permits or denies it. Standard IPv4 ACLs primarily match source addresses; extended ACLs can match protocols, source and destination addresses, and ports. Statements are evaluated top to bottom, first match wins, and an implicit deny exists at the end. Place extended ACLs near the source when practical, and standard ACLs near the destination to avoid unintended blocking.

access-list 110 deny ip 192.168.50.0 0.0.0.255 10.0.0.0 0.255.255.255
access-list 110 permit ip any any
interface gigabitethernet 0/0
 ip access-group 110 in
show access-lists
show running-config interface gigabitethernet 0/0

Layer 2 protections include port security to limit learned MAC addresses, DHCP snooping to identify trusted DHCP paths, Dynamic ARP Inspection to reduce ARP spoofing, and BPDU Guard to protect edge ports. A VPN provides an encrypted logical connection over an untrusted network. A firewall enforces stateful or policy-based boundaries. AAA means authentication, authorization, and accounting; RADIUS and TACACS+ are centralized AAA protocols with different operational characteristics.

Network Automation and Programmability

Traditional management configures each device independently through the CLI. Controller-based and API-driven approaches represent policy centrally or interact programmatically with devices. The control plane builds decisions such as routing and topology. The data plane forwards packets and frames. The management plane carries administrative access. An overlay is a logical network built over an underlying transport network.

An API is an interface for software-to-software communication. REST commonly uses HTTP methods such as GET to retrieve, POST to create or invoke, PUT or PATCH to modify, and DELETE to remove. JSON represents structured data with objects, keys, values, and arrays:

{
  "interface": "GigabitEthernet0/1",
  "enabled": true,
  "vlan": 10
}

Python and Ansible can retrieve device facts, render intended configurations, apply changes, and validate results. Automation improves consistency, repeatability, pre-change validation, and auditability. Secure API access with authentication, authorization, encryption, secret management, rate limits, logging, input validation, and a rollback plan. Test changes against a lab or a limited device group before broad deployment.

Cisco IOS Configuration and Device Management

Cisco IOS is Cisco's network-device operating system. The CLI has executive mode, privileged EXEC mode, global configuration mode, and subordinate modes such as interface, VLAN, and line configuration. Use ? for contextual help, the up-arrow for command history, and filters such as | include, | section, and | begin.

enable
configure terminal
hostname SW1
interface vlan 99
 description Management
 ip address 192.168.99.2 255.255.255.0
 no shutdown
exit
ip default-gateway 192.168.99.1
end
show running-config
show startup-config
show running-config | section interface
copy running-config startup-config
copy startup-config running-config

The running configuration is active in RAM. The startup configuration is stored for use after a reboot. Save only after verifying the change. Back up configurations to an approved location, compare intended and actual state, record interface and address changes, and plan a rollback before making a remote change.

Network Troubleshooting Methodology

Use a repeatable process:

1. Identify the symptom, scope, time, affected users, and recent changes.
2. Form a hypothesis based on the evidence.
3. Choose a test that can confirm or reject the hypothesis.
4. Apply the smallest safe corrective change.
5. Validate both the original failure and nearby functionality.
6. Document the root cause, correction, evidence, and prevention step.

Bottom-up troubleshooting starts with cabling and interfaces. Top-down starts with the application and moves toward the network. Divide-and-conquer tests a boundary such as the default gateway. Follow-the-path checks each hop from source to destination. Choose the method that best fits the symptom.

• Physical failures involve power, media, optics, radio signal, or interface state.
• Layer 2 failures involve VLANs, trunks, MAC learning, loops, STP, and EtherChannel.
• Layer 3 failures involve addressing, gateways, routes, ARP or Neighbor Discovery, and ACLs.
• Service failures involve DHCP, DNS, NTP, NAT, authentication, or application ports.
• Security failures involve policy blocks, credentials, encryption, or unauthorized traffic.

Use ping to test reachability, traceroute to identify the path, show commands to inspect state, and logs to correlate events. Use debug cautiously because it can consume CPU and generate substantial output; disable it after a controlled test.

Fault-Isolation Examples

Different VLANs cannot communicate: check show vlan brief, show interfaces trunk, show ip interface brief, show ip route, and show access-lists. Look for wrong access membership, a trunk that omits the VLAN, an inactive or misaddressed SVI or subinterface, disabled routing, or an ACL denial.

OSPF remains down: check show ip ospf neighbor, show ip ospf interface, show running-config, and show ip protocols. Compare subnet, area, timers, network type, authentication, passive-interface status, and interface state on both routers.

A host has an address but cannot reach the internet: test the host's gateway, then a remote IP address, then a hostname. Inspect the default route, inside and outside NAT designations, the NAT ACL, translations, and DNS.

Redundant switch links are unstable: inspect STP root placement, port roles, EtherChannel consistency, PortFast use, and trunk VLAN lists. A switch-to-switch link should not be configured as an endpoint edge port.

SSH fails: verify a reachable management address, domain name, RSA keys, local authentication, VTY configuration, SSH status, and any ACL affecting the administrator's source address.

Hands-On Lab Progression

1. Device access lab: connect to IOS, navigate modes, configure a hostname, enable secret, console and VTY access, banner, descriptions, and configuration save.
2. Basic switching lab: configure access ports, inspect MAC learning, change speed and duplex where supported, and diagnose an incorrect VLAN.
3. Subnetting and addressing lab: calculate IPv4 networks, assign gateways and host addresses, configure IPv6 prefixes, and verify local and remote reachability.
4. VLAN and routing lab: create user, voice, guest, and management VLANs; configure trunks; use router-on-a-stick or SVIs; and apply a guest-isolation ACL.
5. Redundancy lab: build redundant switch links, bundle them with LACP, select an intended STP root, and confirm loop-free forwarding.
6. Routing lab: configure connected, static, default, floating, and summary routes, then deploy single-area OSPF for IPv4 and IPv6.
7. Services lab: configure DHCP or relay, DNS tests, NTP, syslog, NAT overload, and verification of translations and logs.
8. Security lab: enable SSH, restrict VTY access, create standard and extended ACLs, and test permitted and denied traffic.
9. Automation lab: represent intended VLAN or interface state in JSON, retrieve device facts conceptually through an API, and report differences between actual and intended state.

Integrated Final Lab

Design a small office with user, voice, guest, and management VLANs; assign IPv4 subnets and IPv6 prefixes; configure trunks and inter-VLAN routing; connect a branch router to an upstream network; add a default route and PAT; deploy single-area OSPF between three routers; configure DHCP, NTP, syslog, SSH, and ACLs; add redundant switch links with EtherChannel and STP; then introduce faults involving VLAN membership, OSPF area, NAT, DNS, and VTY access.

Recommended Review Resources

• OSI Reference Model for layer functions and protocol mapping.
• Computer Network Expained for additional networking foundations.
• Configure NTP On A Cisco Device for time synchronization practice.
• Configure OSPF for routing configuration and verification.
• Configure Passwords In IOS for device-access protection.