IT Course Directory: VMware, Linux, Networking, and Raspberry Pi

CCENT ICND1 Networking Fundamentals and Cisco IOS Configuration Course

Learn networking fundamentals, IPv4 subnetting, Cisco IOS configuration, routing, switching, VLANs, ACLs, NAT, IPv6, and practical troubleshooting for entry-level Cisco networking exams.

This course introduces the networking concepts and Cisco IOS skills needed for entry-level Cisco networking certification study. It starts with Ethernet, addressing, and protocol models, then progresses through subnetting, routing, switching, services, security controls, IPv6, and verification-driven troubleshooting.

You should be comfortable using a computer and basic command-line tools. Binary arithmetic, routing, and switching are introduced from the beginning.

Course outcomes

• Describe how devices communicate across LANs and WANs.
• Use the OSI and TCP/IP models to explain encapsulation, decapsulation, and troubleshooting.
• Calculate IPv4 subnets, usable host ranges, gateways, and broadcast addresses.
• Configure and verify basic Cisco IOS router and switch settings.
• Build small routed, switched, VLAN, DHCP, NAT, ACL, and IPv6 topologies.
• Compare static routing, RIP, EIGRP, and OSPF.
• Use show commands, ping, traceroute, and carefully controlled debug commands to isolate faults.

1. Networking foundations

A computer network connects devices so they can exchange data and share services such as files, printers, applications, internet access, and centralized authentication. Networks improve availability and management by allowing resources to be located where they are most useful rather than on every individual computer.

A local area network (LAN) connects devices in a limited location such as an office, home, or campus building. A wide area network (WAN) connects networks across longer distances using service-provider or private infrastructure. Ethernet is the dominant wired LAN technology. Wireless LANs use radio, but commonly connect into the same switching and routing infrastructure.

Communication requires a sender, receiver, transmission medium, addressing, a shared protocol, and a method for handling errors or unavailable destinations. Endpoints create and consume application data. Switches forward frames within a LAN, while routers forward packets between IP networks.

Common network devices

A bridge and a switch both make Layer 2 forwarding decisions from MAC addresses. A switch is generally a multiport, hardware-optimized bridge with additional management and VLAN features. A hub forwards every signal, so devices compete for the same medium. A router does not forward Layer 2 broadcasts between interfaces by default.

Cisco hierarchical design

• Access layer: connects end devices and applies access controls, VLAN membership, and edge policies.
• Distribution layer: aggregates access switches and commonly performs inter-VLAN routing, policy enforcement, and route summarization.
• Core layer: provides fast, resilient transport between distribution blocks.

2. Reference models and data movement

The OSI model divides communication into seven conceptual layers. A protocol data unit (PDU) is the form of data associated with a layer. Encapsulation adds a layer's control information as data moves down the sending stack. Decapsulation removes that information as data moves up the receiving stack.

The TCP/IP model groups the OSI session, presentation, and application functions into its application layer. Its transport, internet, and link layers correspond broadly to OSI Layers 4, 3, and 2. Models are teaching tools; real protocols may span more than one conceptual layer.

For a web request, an application creates HTTPS data. TCP adds source and destination ports plus sequencing information, producing a segment. IPv4 adds source and destination IP addresses, producing a packet. Ethernet adds source and destination MAC addresses and a frame check sequence, producing a frame. The physical layer transmits the frame as bits. The receiver reverses these operations through decapsulation.

• Port number: identifies an application endpoint on a host.
• IP address: identifies a logical source or destination interface across routed networks.
• MAC address: identifies a local Layer 2 interface on an Ethernet segment.

3. Ethernet and Layer 1/Layer 2 fundamentals

Ethernet defines frame formats and rules for sending data over common media. An Ethernet frame includes a destination MAC address, source MAC address, type or length field, payload, and frame check sequence. The preamble and start-of-frame delimiter help synchronize reception and are commonly considered separately from the main frame fields.

A MAC address is a Layer 2 address, usually represented as six hexadecimal octets. Unicast traffic has one intended destination. Multicast traffic targets a defined group. Broadcast traffic targets every device in the local broadcast domain and uses the Ethernet destination ff:ff:ff:ff:ff:ff.

Half-duplex communication allows transmission in one direction at a time. Full-duplex communication allows simultaneous transmission and reception and does not use collision detection. CSMA/CD, or Carrier Sense Multiple Access with Collision Detection, was used on shared, half-duplex Ethernet: a device listened, transmitted when the medium was free, detected collisions, and retried after a random backoff. Modern switched full-duplex Ethernet largely eliminates its practical role.

A collision domain is a portion of a network where simultaneous transmissions can collide. A broadcast domain is the set of devices that receive a Layer 2 broadcast. Each switch port normally creates a separate collision domain, while each VLAN is a separate broadcast domain. Routers and Layer 3 interfaces divide broadcast domains.

IEEE Ethernet standards specify speed, encoding, and media. Common examples include 10BASE-T, 100BASE-TX, 1000BASE-T over copper twisted pair, and fiber-based Gigabit Ethernet variants. Cable category, distance, connectors, electromagnetic interference, and duplex negotiation affect the physical link.

4. IPv4 addressing

IPv4 uses 32-bit addresses, written as four decimal octets such as 192.168.10.25. A subnet mask or CIDR prefix divides the address into a network portion and a host portion. For example, 192.168.10.25/24 uses 24 network bits and 8 host bits.

Private addresses are not globally routed on the public internet and commonly use NAT. Legacy classful categories classify Class A as first octet 1-126, Class B as 128-191, and Class C as 192-223, but modern networks use classless CIDR prefixes. Class D addresses support multicast, and Class E is reserved for experimental use. Special categories include the network address, directed broadcast address, loopback 127.0.0.0/8, unspecified address 0.0.0.0, and link-local APIPA addresses 169.254.0.0/16.

APIPA, or Automatic Private IP Addressing, is a host behavior used when DHCP configuration fails. A host with an APIPA address can communicate only with suitable local-link peers, not normally with routed networks. The default gateway is the local router address a host uses for destinations outside its subnet.

5. IPv4 subnetting

Subnetting divides one IP network into smaller networks. It conserves address space, limits broadcasts, separates departments, and supports security and administrative boundaries. A prefix such as /26 means that 26 of the 32 bits are network bits; its dotted-decimal mask is 255.255.255.192.

For traditional IPv4 host calculations, usable hosts equal 2^h - 2, where h is the number of host bits. The two excluded addresses are the subnet network address and broadcast address. Point-to-point links commonly use /30 networks, providing two usable addresses.

Worked subnetting example

Suppose 192.168.50.0/24 must support three departments. Choose /26 subnets, each with 62 usable hosts. The increment is 64:

• Sales: network 192.168.50.0, usable range 192.168.50.1-62, broadcast 192.168.50.63.
• Engineering: network 192.168.50.64, usable range 192.168.50.65-126, broadcast 192.168.50.127.
• Administration: network 192.168.50.128, usable range 192.168.50.129-190, broadcast 192.168.50.191.

Reserve the first usable address in each subnet as the default gateway when that convention fits the design. Select a prefix by finding the smallest host-bit count that satisfies the required number of hosts, then verify that enough subnet blocks remain.

6. TCP/IP transport and core protocols

TCP is connection-oriented and provides sequencing, acknowledgments, retransmission, checksum validation, flow control, and an ordered byte stream. Its three-way connection setup uses SYN, SYN-ACK, and ACK. UDP is connectionless and best-effort. It has less overhead and is useful when low delay, simple request-response behavior, or application-managed recovery is preferred.

Use TCP when reliable ordered delivery matters, such as file transfers and most web sessions. Use UDP where small overhead or timely delivery matters, such as DNS queries, DHCP, streaming, voice, and some routing protocols. A socket is commonly identified by an IP address, transport protocol, and port number.

IPv4 forwarding fields

Important IPv4 header fields include source and destination address, time to live, protocol identifier, total length, identification and fragmentation controls, header checksum, and optional fields. Routers use the destination address and routing table to select a path, decrement TTL, and discard a packet when TTL reaches zero.

ARP, the Address Resolution Protocol, maps an IPv4 address to a MAC address on the local link. A host broadcasts an ARP request and the owner of the IPv4 address replies, usually by unicast. ICMP reports errors and supports diagnostics such as echo request and echo reply used by ping.

7. Application and management protocols

8. Cisco IOS access and operation

Cisco IOS is the operating system used by many Cisco routers and switches. Devices can be accessed through the console port, auxiliary port where available, or remote protocols such as SSH. Console access is local and does not require network reachability; remote access requires an addressed, reachable interface and an enabled management service.

At startup, the device performs hardware and bootstrap checks, loads an IOS image from an appropriate location such as flash, initializes hardware, and then loads the startup configuration from NVRAM when available. If no usable startup configuration exists, setup behavior may be offered.

IOS provides context-sensitive help with ?, command completion with the Tab key, command history, and editing keys. Use show commands before and after changes. A safe workflow is to identify the interface or process, make one logical change, verify the result, and save only after testing.

9. Basic Cisco IOS configuration

enable
configure terminal
hostname R1
banner motd #Authorized access only#
enable secret StrongSecret
service password-encryption
line console 0
 password ConsolePassword
 login
exit
line vty 0 4
 transport input ssh
 login local
exit
interface gigabitEthernet 0/0
 description LAN uplink
 ip address 192.168.10.1 255.255.255.0
 no shutdown
end
copy running-config startup-config

The running-config is the active configuration in RAM. The startup-config is the saved configuration in NVRAM and is used after reboot. An enable secret is stored more securely than a legacy enable password. service password-encryption obscures many plain-text line passwords, but it is not a substitute for strong authentication or encrypted management protocols.

For SSH, configure a domain name, a local user, RSA keys, SSH version 2, and VTY lines that accept SSH. Use description on interfaces to document the connected circuit. On a Layer 3 switch, a switch virtual interface can provide management addressing; configure ip default-gateway when the switch is operating as a Layer 2 device.

configure terminal
ip domain-name example.local
username admin secret AdminSecret
crypto key generate rsa
ip ssh version 2
interface vlan 10
 ip address 192.168.10.2 255.255.255.0
 no shutdown
exit
ip default-gateway 192.168.10.1
end
show ip interface brief
show running-config | section line vty

From configuration mode, use do show ... to execute a privileged EXEC command without leaving configuration mode. IOS pipe operators filter output: show running-config | include username, show running-config | section interface, and show ip route | begin Gateway.

10. Cisco memory, files, and maintenance

Save changes with copy running-config startup-config. Restore a saved configuration deliberately and verify the result. Configuration files and IOS images may be backed up to a network server with appropriate copy commands, such as TFTP or a more secure supported transfer method. The configuration register influences boot behavior, including whether a saved configuration is loaded and how recovery occurs.

show version
show running-config
show startup-config
show processes
copy running-config startup-config

11. IOS services and diagnostics

Router DHCP

configure terminal
ip dhcp excluded-address 192.168.10.1 192.168.10.20
ip dhcp pool USERS
 network 192.168.10.0 255.255.255.0
 default-router 192.168.10.1
 dns-server 192.168.10.53
end
show ip dhcp binding

Exclude gateway, server, and infrastructure addresses before creating the pool. A DHCP relay or helper is needed when the server is on another routed network because the initial client request is a broadcast.

Configure NTP with ntp server 192.168.10.123. CDP discovers Cisco neighbors on directly connected links; verify with show cdp neighbors detail. Local mappings such as ip host server1 192.168.10.10 provide simple name resolution, while ip name-server 192.168.10.53 configures DNS lookup. Unwanted DNS lookup can delay mistyped IOS commands, so understand the operational effect before changing lookup behavior.

Use extended ping to select a source address, size, count, or data pattern. Use traceroute to identify Layer 3 hops. Telnet can test TCP reachability to a service, but it should not be used for insecure administration. Debug commands are real-time and can consume CPU or overwhelm a console; use them briefly, preferably during controlled maintenance, and stop them with undebug all.

12. IP routing fundamentals

A router examines the destination IP address, searches its routing table, chooses the most specific matching route, and forwards the packet to a next hop or exit interface. Longest-prefix match means that a route with more matching network bits wins over a less-specific route.

Routing table entries can come from directly connected interfaces, static configuration, or dynamic routing protocols. A static route names a destination prefix and either a next-hop address or exit interface. A default route, 0.0.0.0/0, matches destinations for which no more-specific route exists. The next hop must be reachable, and the remote network needs a return route.

ip route 192.168.20.0 255.255.255.0 10.0.12.2
ip route 0.0.0.0 0.0.0.0 10.0.12.2
show ip route
show ip route static
ping 10.0.12.2
traceroute 192.168.20.10

Administrative distance ranks the trustworthiness of route sources when multiple sources advertise the same prefix. A metric ranks paths within a routing protocol. Distance-vector protocols learn routes from neighbors and generally advertise reachability information. Link-state protocols build a topology database and calculate paths from that database.

13. RIP

RIP is a simple distance-vector protocol that uses hop count. A route becomes unusable after exceeding 15 hops, so RIP is unsuitable for larger or complex networks. RIPv2 supports classless prefixes and should be used when learning modern RIP behavior.

router rip
 version 2
 network 192.168.10.0
 network 10.0.12.0
 no auto-summary
show ip route rip

Routing loops can occur when routers have inconsistent information. Split horizon prevents advertising a route back through the interface from which it was learned. Route poisoning advertises an invalid route with an infinite metric. A hold-down timer temporarily suppresses unstable replacement information so a network can converge.

14. EIGRP

EIGRP uses neighbor relationships, a neighbor table, a topology table, and a routing table. Its composite metric primarily considers bandwidth and delay. The reported distance is a neighbor's advertised distance to a destination. The local router's total best distance is the feasible distance. A successor is the selected best route; a feasible successor is a loop-free backup satisfying the feasibility condition.

EIGRP uses Reliable Transport Protocol for dependable delivery of selected routing messages. DUAL, the Diffusing Update Algorithm, supports rapid, loop-free convergence. Neighbors must agree on key parameters such as the autonomous system, addressability, and active interface state.

router eigrp 100
 network 10.0.12.0 0.0.0.3
 network 192.168.10.0 0.0.0.255
 no auto-summary
show ip eigrp neighbors
show ip eigrp topology
show ip route eigrp

An EIGRP wildcard mask identifies which address bits must match. A zero bit must match; a one bit may vary. Automatic summarization can create inaccurate classful boundaries, so understand and control it. Manual summarization is configured on the appropriate interface and reduces routing-table size and query scope.

15. OSPF

OSPF is a link-state protocol. Routers discover neighbors with hello packets, exchange link-state information, form an adjacency when parameters agree, and calculate shortest paths using cost. Neighbor states include Down, Init, 2-Way, ExStart, Exchange, Loading, and Full. Broadcast multiaccess networks elect a designated router (DR) and backup designated router (BDR) to reduce adjacency overhead.

An OSPF area is a logical boundary for link-state information. Area 0 is the backbone and must connect other areas in a properly designed multiarea topology. Link-state advertisements, or LSAs, describe routers, networks, summaries, and external routes; the exact LSA set depends on the topology and route source.

router ospf 1
 router-id 1.1.1.1
 network 10.0.12.0 0.0.0.3 area 0
 network 192.168.10.0 0.0.0.255 area 0
show ip ospf neighbor
show ip ospf interface
show ip route ospf

OSPF authentication can protect routing exchanges. Depending on platform and IOS support, clear-text or MD5-based authentication may be configured; MD5 is preferable to clear text but is not a replacement for modern cryptographic design. Route summarization belongs at area boundaries or external redistribution boundaries, not arbitrarily on every interface.

16. Layer 2 switching

A switch learns the source MAC address of incoming frames and records the associated port in its MAC address table. For a known unicast, it forwards only to the matching port. For an unknown unicast or broadcast, it floods within the VLAN except through the receiving port. Entries age out so the table adapts to topology changes.

Static MAC entries can pin a destination to a port, but they require maintenance and should be used only when their operational purpose is clear. Port security limits which MAC addresses may use an access port. Violation actions commonly include protect, restrict, and shutdown; choose behavior according to the operational response required.

vlan 10
 name USERS
interface gigabitEthernet 0/1
 switchport mode access
 switchport access vlan 10
 switchport port-security
 switchport port-security maximum 1
 switchport port-security mac-address sticky
show vlan brief
show mac address-table
show port-security interface

17. VLANs and trunking

A VLAN logically segments a switch into separate broadcast domains. An access port carries traffic for one VLAN and typically connects to an endpoint. A trunk carries multiple VLANs between network devices. Trunk frames use tags so the receiving switch can identify the VLAN.

IEEE 802.1Q is the standard tagging method. The native VLAN is sent untagged by default on an 802.1Q trunk, so both ends must agree on the native VLAN. ISL is a legacy Cisco trunk encapsulation concept and is not the modern interoperable standard. Restrict trunk allowed VLANs to only those required.

vlan 10
 name USERS
vlan 20
 name SERVERS
interface gigabitEthernet 0/1
 switchport mode access
 switchport access vlan 10
interface gigabitEthernet 0/24
 switchport mode trunk
 switchport trunk allowed vlan 10,20
show vlan brief
show interfaces trunk

18. Inter-VLAN routing and VTP

Because each VLAN is a separate broadcast domain, hosts in different VLANs need a Layer 3 gateway to communicate. Router-on-a-stick uses one physical router interface with multiple 802.1Q subinterfaces.

interface gigabitEthernet 0/0
 no shutdown
interface gigabitEthernet 0/0.10
 encapsulation dot1q 10
 ip address 192.168.10.1 255.255.255.0
interface gigabitEthernet 0/0.20
 encapsulation dot1q 20
 ip address 192.168.20.1 255.255.255.0

Each VLAN's hosts use the matching subinterface address as their default gateway. Verify the switch trunk, subinterface tags, host masks, and gateway settings.

VTP, or VLAN Trunking Protocol, distributes VLAN database information among participating Cisco switches. Server, client, and transparent modes have different behavior. VTP can simplify administration, but an incorrect domain, password, revision, or server can create widespread VLAN changes. Use it only with a deliberate design and verify its status.

19. Access control lists

An ACL is an ordered set of rules used to permit or deny traffic. IOS evaluates entries from top to bottom and stops at the first match. Every ACL has an implicit deny at the end unless traffic is explicitly permitted. A standard ACL matches the source IPv4 address. An extended ACL can match source, destination, protocol, and ports.

access-list 10 permit 192.168.10.0 0.0.0.255
ip access-list extended WEB-FILTER
 permit tcp 192.168.10.0 0.0.0.255 host 192.168.20.10 eq 443
 deny tcp any any eq 23
 permit ip any any
interface gigabitEthernet 0/0
 ip access-group WEB-FILTER in
show access-lists
show ip interface gigabitEthernet 0/0

A wildcard mask uses zero for bits that must match and one for bits that may vary. Place standard ACLs close to the destination and extended ACLs close to the source when that prevents unnecessary traffic, while accounting for the actual policy and topology. Test permitted and denied cases before deployment, and document the direction and interface.

20. Network Address Translation

NAT changes address information as traffic crosses a router. Inside local is the private address assigned to an internal host. Inside global is the public representation of that host. Outside local and outside global describe the external host's address as seen from inside and outside contexts.

• Static NAT: permanently maps one inside address to one translated address.
• Dynamic NAT: assigns translations from a configured public address pool.
• PAT overload: maps many inside hosts to one public address by distinguishing sessions with transport port numbers.

access-list 10 permit 192.168.10.0 0.0.0.255
interface gigabitEthernet 0/0
 ip nat inside
interface gigabitEthernet 0/1
 ip nat outside
ip nat inside source list 10 interface gigabitEthernet 0/1 overload
show ip nat translations
show ip nat statistics

Check that inside and outside roles are correct, the translation ACL matches the actual source network, the WAN interface is operational, and a default route points toward the provider. NAT does not replace firewall policy; it primarily changes addressing and session representation.

21. IPv6 fundamentals and Cisco configuration

IPv6 uses 128-bit addresses and provides a much larger address space than IPv4. An address is written as hexadecimal groups separated by colons. Leading zeros in a group may be omitted, and one consecutive sequence of all-zero groups may be replaced by :: once.

Common IPv6 address types include global unicast, unique local, link-local, multicast, and unspecified addresses. Global unicast addresses are routable across an organization or the public internet. Unique local addresses are intended for private organizational use. Link-local addresses use fe80::/10 and support same-link communication and neighbor discovery; routers do not forward them between links.

An IPv6 address contains a routing prefix and an interface identifier. EUI-64 can derive an interface identifier from a MAC address, although privacy-oriented random identifiers are also common. IPv6 uses Neighbor Discovery rather than ARP.

ipv6 unicast-routing
interface gigabitEthernet 0/0
 ipv6 address 2001:db8:10:1::1/64
 ipv6 address fe80::1 link-local
 no shutdown
show ipv6 interface brief
show ipv6 neighbors
show ipv6 route
ping ipv6 2001:db8:10:1::10

22. Verification and troubleshooting

Use a layered method: confirm physical link and interface state, verify VLAN and MAC behavior, check IP addressing and gateways, inspect routing, then test the application and policy controls. A failure at a lower layer can make higher-layer tests misleading.

Useful verification commands

show ip interface brief
show interfaces
show running-config
show ip route
show vlan brief
show interfaces trunk
show mac address-table
show cdp neighbors detail
ping
traceroute
show ip ospf neighbor
show ip eigrp neighbors
show ip dhcp binding
show access-lists
show ip nat translations
show ipv6 neighbors

Extended ping can test a destination from a selected source interface or address, which helps identify asymmetric routing or incorrect return paths. Use terminal monitor only when remote debug output is required. Stop debugging with undebug all; never leave high-volume debugging enabled without a reason and a monitoring plan.

23. Practical labs

1. Trace a web request: label HTTPS data, TCP source and destination ports, IPv4 addresses, Ethernet MAC addresses, and the changes that occur at each routed hop. Explain decapsulation at the destination.
2. Design three department subnets: divide a private block for sales, engineering, and administration. Calculate network, broadcast, gateway, and usable ranges from host requirements.
3. Perform initial router setup: configure a hostname, legal banner, encrypted privileged credential, console and VTY protection, interface description, IPv4 address, and no shutdown. Save and verify the configuration.
4. Deploy router DHCP: exclude infrastructure addresses, create a pool, set the network, gateway, and DNS server, then verify bindings.
5. Build a routed network: connect two or three routers, configure LANs and point-to-point links, add static and default routes, and verify end-to-end reachability.
6. Compare routing protocols: form RIP, EIGRP, and OSPF neighbors in separate exercises. Advertise LANs, inspect metrics and convergence, and practice summarization.
7. Create segmented switching: build user and server VLANs, assign access ports, configure a tagged trunk, restrict allowed VLANs, and verify membership and trunk state.
8. Enable inter-VLAN routing: configure router-on-a-stick subinterfaces with 802.1Q tags and gateway addresses, then test between VLAN hosts.
9. Apply an extended ACL: allow HTTPS to an internal server, block Telnet, explicitly permit required remaining traffic, and verify counters and behavior.
10. Provide internet access with PAT: mark inside and outside interfaces, match internal addresses with an ACL, overload the public interface, and inspect translations.
11. Enable IPv6: turn on IPv6 forwarding, assign global and link-local addresses, optionally use EUI-64, and verify neighbors and routes.

24. Knowledge checks

• Which device forwards frames using a learned MAC address table?
• What PDU does TCP create, and what PDU does IPv4 create?
• Why does a router normally stop a Layer 2 broadcast?
• For 10.20.30.64/26, what are the network address, broadcast address, and usable host range?
• Why is UDP useful for DHCP even though the client does not initially have an IP address?
• What is the difference between running-config and startup-config?
• How does longest-prefix match affect a routing decision?
• What mechanism helps RIP reduce routing loops?
• What is the purpose of a feasible successor in EIGRP?
• Why does OSPF use areas and elect a DR on some networks?
• How does a trunk differ from an access port?
• Where does an ACL's implicit deny occur?
• Which NAT term describes a private address assigned to an internal host?
• Why can IPv6 link-local connectivity succeed while remote IPv6 connectivity fails?

25. Suggested study sequence

1. Learn Ethernet, devices, collision and broadcast domains.
2. Practice OSI/TCP-IP mapping, PDUs, encapsulation, and addressing.
3. Master IPv4 addressing and subnetting before studying routing protocols.
4. Practice IOS modes, safe configuration, memory locations, and show commands.
5. Build small switched and routed labs with verification after every change.
6. Study routing tables, static routes, RIP, EIGRP, and OSPF comparatively.
7. Add VLANs, trunks, inter-VLAN routing, ACLs, NAT, DHCP, and management services.
8. Finish with IPv6, layered troubleshooting, quizzes, and timed configuration exercises.

Use the course curriculum to organize the lessons and the course activities for hands-on practice. Broader networking study can continue through the course directory.