CCNA online course

Local Area Networks (LANs): Concepts, Components, and Cisco Networking Fundamentals

Learn LAN fundamentals for CCNA: Ethernet switching, devices, media, VLANs, IP addressing, wireless integration, security, STP, and Cisco IOS troubleshooting.

A Local Area Network (LAN) connects devices within a limited geographic area, such as a room, office, building, home, or campus. A LAN is typically owned or administered by one organization or household. It provides local communication and access to shared resources while also connecting users to larger networks such as the Internet.

Common LAN goals include sharing files, printers, applications, voice services, and Internet access; allowing devices to communicate; and providing controlled access to network services such as DHCP, DNS, authentication, and centralized storage.

A LAN may be a single Ethernet segment, a switched network containing many switches, or a site containing multiple VLANs. VLANs allow one physical switching infrastructure to carry several separate logical Layer 2 networks.

LAN, WLAN, PAN, MAN, and WAN

A WLAN is not necessarily a separate enterprise network. It is the wireless access portion of a LAN. Wireless clients may use the same IP services, VLANs, and routing infrastructure as wired clients.

Physical and Logical LAN Components

End devices

End devices originate or receive user traffic. Examples include desktops, laptops, servers, network printers, IP phones, cameras, wireless access points, sensors, and other Internet of Things devices. Each network-connected host normally uses a network interface card (NIC). A NIC may be a physical adapter or a logical interface presented by a virtual machine.

Intermediary devices

Other physical elements include switch ports, uplink ports, patch panels, equipment racks, patch cables, horizontal cabling, and structured cabling pathways. A physical topology describes where devices and cables are physically located. A logical topology describes how traffic flows, including VLAN membership, IP subnets, routed boundaries, and redundant paths. Physical and logical topologies can be different: one cable can carry several VLANs, and two physical links can operate as one EtherChannel.

Ethernet LAN Operation

Ethernet is the dominant wired LAN technology family and is standardized primarily by IEEE 802.3. Ethernet sends Layer 2 data in units called frames.

An Ethernet frame conceptually contains a destination MAC address, source MAC address, an EtherType or length field, a payload, and a frame check sequence (FCS). The FCS helps the receiver detect transmission errors. The payload commonly contains an IP packet, but Ethernet can carry other Layer 3 protocols as well.

A MAC address is a Layer 2 address used for local Ethernet delivery. Switches use their MAC address tables to associate source MAC addresses with the ports where they were learned. MAC addresses identify interfaces on the local link; IP addresses identify Layer 3 interfaces and networks.

How a switch forwards frames

1. When a frame arrives, the switch examines its source MAC address and records that address against the ingress port and VLAN.
2. The switch examines the destination MAC address.
3. If the destination is known on another port in the same VLAN, the switch forwards the frame only through that port.
4. If the destination is known on the ingress port, the switch filters the frame instead of sending it back out the same port.
5. If the destination is unknown, the switch performs unknown-unicast flooding: it sends the frame out other ports in the same VLAN, but not the ingress port.

Broadcast frames, such as an ARP request, are flooded to ports in the same VLAN. Multicast handling varies by switch configuration; without appropriate multicast controls, multicast may also be replicated across multiple ports.

Collision Domains and Broadcast Domains

A collision domain is a segment where simultaneous transmissions could collide. A traditional hub creates one shared collision domain because it repeats incoming signals to all ports. A modern switch normally gives each active port its own collision domain. With full-duplex operation, a port can transmit and receive simultaneously, so normal switched Ethernet does not rely on CSMA/CD.

A broadcast domain is the set of devices that receive a Layer 2 broadcast. A VLAN normally defines one broadcast domain. Routers and Layer 3 interfaces separate broadcast domains.

LAN Topologies and Hierarchical Design

A star topology connects endpoints to a central switch. An extended-star topology connects access switches to additional switches in a hierarchy. A point-to-point topology directly connects two devices, commonly with an uplink. A mesh topology provides many interconnections for resilience. A ring topology connects each device to two neighbors, while a bus topology uses one shared cable or medium. Modern Ethernet LANs most commonly use a switched star or extended-star design.

Three-layer campus model

• Access layer: connects endpoints; assigns access VLANs; applies edge policy such as port security, 802.1X where deployed, and BPDU Guard; and supplies PoE to phones and access points.
• Distribution layer: aggregates access switches, provides Layer 3 boundaries and policy, supports redundancy, and can provide inter-VLAN routing.
• Core layer: provides a fast, resilient transport path between distribution blocks and major network services. The core is normally kept simple and highly available.

Redundant links improve availability, but independent redundant Layer 2 links can create loops. STP prevents loops by placing some redundant paths into a blocking or discarding state. EtherChannel can combine compatible physical links into one logical link, allowing the bundle to be used as a single STP path.

LAN Media and Ethernet Standards

Twisted-pair copper is common for endpoint connections. Cat5e supports many 1 Gbps installations, Cat6 offers improved performance and is widely used for access cabling, and Cat6A is commonly selected for higher-bandwidth copper deployments such as 10 Gbps connections. Exact performance depends on the standard, installation quality, distance, and the connected interfaces.

Fiber-optic cabling carries light rather than electrical signals. Multimode fiber is commonly used for shorter building or campus links. Single-mode fiber is commonly selected for longer backbone or provider-style links. Optical transceivers convert between electrical switch signals and optical signals. Common interface terms include SFP for a small form-factor pluggable module and SFP+ for many 10 Gbps modules. RJ-45 identifies a familiar copper Ethernet interface; LC and other fiber connector types identify practical fiber terminations.

Ethernet speed families include 10 Mbps, 100 Mbps, 1 Gbps, 10 Gbps, and higher-speed uplinks. Cable length is limited by the particular Ethernet standard and medium. Choosing the correct category, fiber type, transceiver, connector, and distance rating prevents link failures and unexpected negotiation results.

Speed, Duplex, and Auto-Negotiation

Half duplex allows transmission in only one direction at a time. Full duplex allows simultaneous transmission and reception. Modern switch-to-host and switch-to-switch links normally use full duplex.

Auto-negotiation allows interfaces to advertise and select compatible speed and duplex settings. Both ends should use compatible configuration. A duplex mismatch can cause poor throughput, CRC errors, retransmissions, collisions, or late collisions where half-duplex behavior is involved. Interface verification should include link state, protocol state, negotiated speed, duplex mode, errors, and counters.

VLANs and Inter-VLAN Communication

A Virtual LAN (VLAN) is a logical Layer 2 segmentation method. VLAN planning may follow department, device type, security boundary, or function. For example, a site might use separate VLANs for Administration, Sales, Engineering, voice, and guests.

An access port normally carries one untagged endpoint VLAN. A trunk port carries multiple VLANs, normally using IEEE 802.1Q tags. The native VLAN is the VLAN associated with untagged traffic on an 802.1Q trunk, subject to platform behavior and design policy. Native VLAN mismatches can cause connectivity and security problems.

Devices in different VLANs require Layer 3 routing. Router-on-a-stick uses router subinterfaces over one trunk. A multilayer switch can use an SVI, or Switched Virtual Interface, as the Layer 3 interface for each VLAN. Each SVI commonly supplies the default gateway for its subnet.

See Configure Trunk Ports and Configure Router on a Stick for focused configuration practice.

IP Addressing in a LAN

A host requires an IPv4 and/or IPv6 address, a prefix length or subnet mask, and usually a default gateway. The MAC address delivers a frame across the local Layer 2 network; the IP address identifies the source and destination at Layer 3.

For IPv4, ARP resolves a local IP address to a MAC address. IPv6 uses Neighbor Discovery rather than ARP. When a destination is outside the host's local subnet, the host sends the Ethernet frame to the MAC address of its default gateway, not directly to the remote host's MAC address. The router or multilayer switch then routes the IP packet toward the remote network.

DHCP automatically supplies settings such as an IP address, subnet mask or prefix information, default gateway, and DNS servers. A host with an incorrect DHCP scope, VLAN, prefix, or gateway may have a link but still lack useful connectivity.

Wireless LAN Integration

A wireless access point bridges Wi-Fi clients to the wired LAN. An SSID is the name clients select. Wireless security protects the association and traffic; the exact method depends on the deployment and security policy. An organization can map different SSIDs to different VLANs, such as an employee SSID to an internal VLAN and a guest SSID to an isolated guest VLAN.

The access point's uplink commonly uses Ethernet and may receive power through Power over Ethernet (PoE). The switch port may need to carry multiple VLANs when several SSIDs are mapped to different VLANs.

LAN Security Fundamentals

Common LAN threats include unauthorized physical access, rogue devices, MAC flooding, VLAN hopping attempts, ARP spoofing, and rogue DHCP servers. Security is layered: protect equipment physically, segment users and device types, secure management access, use strong credentials, and monitor abnormal behavior.

• Port security can limit the number of learned MAC addresses and define a violation action such as protect, restrict, or shutdown, depending on platform and policy.
• DHCP snooping identifies trusted DHCP-server-facing ports and helps block unauthorized DHCP replies.
• Dynamic ARP Inspection can validate ARP information using trusted bindings.
• BPDU Guard protects edge ports by taking action when unexpected STP BPDUs arrive.
• Unused ports should be disabled and assigned to an unused VLAN when appropriate.
• Management should use secure protocols and strong authentication, with management access restricted to authorized networks.

Example edge protection

interface gigabitEthernet 1/0/1
 switchport mode access
 switchport port-security
 switchport port-security maximum 1
 switchport port-security mac-address sticky
 switchport port-security violation restrict

interface range gigabitEthernet 1/0/1-20
 spanning-tree portfast
 spanning-tree bpduguard enable

STP, Redundancy, and EtherChannel

Redundant Layer 2 links can cause frames to circulate indefinitely. The result may be duplicate frames, MAC table instability, broadcast storms, and a network-wide outage. Spanning Tree Protocol (STP) prevents these loops by selecting a loop-free active topology and blocking or discarding redundant paths.

The root bridge is the reference switch for an STP instance. Each non-root switch selects a root port, which provides its best path toward the root. A designated port provides the best path from a segment toward the root. Other redundant ports may be blocking or discarding. Rapid STP, including Rapid PVST+ in Cisco environments, improves convergence after topology changes.

EtherChannel bundles compatible physical links into one logical link. STP sees the bundle as one path, while the channel can provide greater aggregate capacity and link resilience. Member interfaces must have compatible settings, including speed, duplex, trunk or access mode, VLAN permissions, and channel parameters.

Small Office LAN Example

In a simple office, employee PCs, a printer, and an IP phone connect to an access switch. The switch connects to a router or multilayer switch that provides the default gateway and Internet path. One IPv4 subnet can be adequate for an initial small design, but a single large broadcast domain becomes harder to secure, troubleshoot, and scale as more devices are added.

Department-Based VLAN Example

Create separate VLANs for Administration, Sales, Engineering, Voice, and Guest devices. Assign endpoint-facing interfaces as access ports in the appropriate VLAN. Configure the uplink to the multilayer switch as an 802.1Q trunk, then create one SVI per VLAN. Enable routing on the multilayer switch and apply appropriate access-control and guest-isolation policy.

configure terminal
vlan 10
 name USERS
interface gigabitEthernet 1/0/1
 switchport mode access
 switchport access vlan 10
 no shutdown

interface gigabitEthernet 1/0/24
 switchport mode trunk
 switchport trunk allowed vlan 10,20,30
 switchport trunk native vlan 999

ip routing
interface vlan 10
 ip address 192.168.10.1 255.255.255.0
 no shutdown
interface vlan 20
 ip address 192.168.20.1 255.255.255.0
 no shutdown

MAC Learning Example

A workstation sends a frame to a printer on the same VLAN. The switch learns the workstation's source MAC address on the ingress port. If the printer's destination MAC is unknown, the switch floods the frame within that VLAN. When the printer responds, the switch learns the printer's MAC address and can forward later workstation-to-printer frames as known unicasts through the correct port.

LAN Troubleshooting Methodology

Use a layered method: physical, data link, network layer, services, and policy. Start with the simplest explanation and compare the affected device with a working device. Document port assignments, VLANs, IP addressing, trunks, gateways, and topology so that verification has a known reference.

Useful Cisco IOS commands

show interfaces status
show interfaces gigabitEthernet 1/0/1
show interfaces counters errors
show mac address-table
show mac address-table dynamic
show vlan brief
show interfaces trunk
show interfaces switchport
show ip interface brief
show ip arp
ping 192.168.10.1
traceroute 192.168.20.10

Use show interfaces status for a quick port summary. Use detailed interface output and error counters to investigate physical faults, speed, duplex, and protocol state. Use VLAN and trunk commands to verify Layer 2 placement and propagation. Use MAC-table output to confirm learning. Finally, test the gateway first, then a remote subnet, to separate local LAN faults from routing or service faults.