Downloads

CCENT ICND1 100-101 Certification Guide: Networking Fundamentals and Cisco IOS

Study the historical CCENT ICND1 100-101 objectives with practical lessons on networking, IPv4, IPv6, switching, VLANs, routing, Cisco IOS, services, security, and troubleshooting.

This guide covers the concepts and hands-on skills historically associated with the Cisco CCENT and ICND1 100-101 exam. It is useful for beginning network technicians, help desk professionals, and students building a foundation in Cisco networking.

The 100-101 exam belonged to a former Cisco certification path. Its objectives should not be confused with the objectives of currently active Cisco certification tracks. Use this guide for historical exam study and foundational knowledge, then compare your plan with the current Cisco certification requirements before registering for an exam.

Certification scope and study approach

CCENT, or Cisco Certified Entry Networking Technician, was an entry-level certification focused on basic network installation, operation, and troubleshooting. ICND1 100-101 was the exam associated with the first stage of the former two-exam CCNA path.

The principal study domains were network fundamentals, LAN switching, IPv4 and IPv6 routing, infrastructure services, infrastructure maintenance, and security fundamentals. A good study plan combines four activities:

• Conceptual study: learn what each protocol or device does and why it is needed.
• Subnetting practice: calculate prefixes, ranges, broadcasts, and usable hosts without relying on guesswork.
• Command-line labs: configure interfaces, VLANs, routes, management access, and services in a simulator or lab.
• Troubleshooting exercises: deliberately introduce errors and locate them with show commands and testing tools.

Before starting, be comfortable with basic computer operation, command-line use, binary and hexadecimal notation, network adapters, servers and clients, and simple network diagrams. A network simulator or entry-level Cisco equipment is strongly recommended.

Network fundamentals

What a network provides

A computer network connects devices so they can exchange data and share resources such as applications, files, printers, internet access, and centralized services. Common components include end hosts, network interface cards, switches, routers, wireless access points, firewalls, servers, cables, and wireless links.

• LAN: a local area network covering a home, office, building, or campus.
• WAN: a wide area network connecting locations over a provider or long-distance link.
• WLAN: a LAN using wireless radio communication.
• Internet: the worldwide interconnection of independently operated networks.
• Intranet: a private network and its internal services.
• Extranet: selected private resources made available to authorized external users.

In a client-server model, clients request services from dedicated servers. In a peer-to-peer model, devices can provide and consume services directly. Client-server designs are generally easier to manage centrally, while peer-to-peer designs can be simple for small groups.

Performance terms

• Bandwidth is the theoretical capacity of a link, usually measured in bits per second.
• Throughput is the useful data rate actually achieved.
• Latency is the time required for data to travel from source to destination.
• Jitter is variation in packet delay and can harm voice or video.
• Packet loss occurs when transmitted packets never reach the destination.
• Duplex describes whether communication is one-way at a time or simultaneous in both directions. Full-duplex Ethernet sends and receives simultaneously.

OSI and TCP/IP models

A layered model divides networking responsibilities into manageable functions. Each layer provides services to the layer above and uses the layer below.

Encapsulation occurs as application data moves down the stack. Transport adds a header to form a segment, the network layer adds an IP header to form a packet, and the data-link layer adds an Ethernet header and trailer to form a frame. Physical media transmit bits. At the destination, de-encapsulation removes these headers and trailers in reverse order.

Media, addressing, and traffic types

Ethernet uses copper twisted-pair cable, fiber-optic cable, or, in some environments, wireless links. Copper is inexpensive and easy to install but is affected by distance and electromagnetic interference. Fiber supports longer distances, high bandwidth, and resistance to electromagnetic interference. Common copper Ethernet cabling uses RJ-45 connectors. Fiber connectors vary by equipment and installation.

Ethernet standards specify capabilities such as 10 Mb/s, 100 Mb/s, 1 Gb/s, and 10 Gb/s. The interface, cable category, transceiver, and configuration must all support the intended speed. Auto-negotiation allows compatible devices to agree on speed and duplex, but mismatched settings can produce errors and poor performance.

A MAC address identifies a local network interface at Layer 2. An IP address identifies a logical interface at Layer 3 and supports communication across routed networks.

• Unicast: one sender to one receiver.
• Broadcast: one sender to all devices in the local broadcast domain; IPv4 uses a broadcast address.
• Multicast: one sender to a subscribed group.
• Anycast: one sender to the nearest or best member of a group, commonly used with IPv6 services.

TCP/IP and common protocols

When an IPv4 host sends to another host on the same subnet, it resolves the destination MAC address and sends an Ethernet frame directly. When the destination is on another subnet, the sender sends the frame to the MAC address of its default gateway. The gateway is normally a router interface or Layer 3 switch interface. The router removes the incoming frame, examines the destination IP address, selects a route, and creates a new Layer 2 frame for the next link.

TCP is connection-oriented and provides sequencing, acknowledgments, retransmission, and flow control. It is useful when reliable ordered delivery matters. UDP has less overhead and does not establish a reliable connection; it is useful for DNS queries, streaming, voice, and applications that implement their own recovery.

A port number identifies an application process. Port numbers allow multiplexing: multiple applications can use one host IP address while the transport headers keep their conversations separate.

ARP maps an IPv4 address to a MAC address on the local link. A host broadcasts an ARP request, and the owner of the address replies with its MAC address. Devices cache these mappings in an ARP table. ICMP reports network-layer errors and supports reachability tests such as ping. DNS maps names such as server.example to addresses. DHCP dynamically supplies an address, mask, gateway, DNS server, and other options. The common IPv4 exchange is Discover, Offer, Request, and Acknowledgment.

IPv4 addressing and subnetting

An IPv4 address contains 32 bits, written as four decimal octets, such as 192.168.10.25. A subnet mask or CIDR prefix divides the address into a network portion and a host portion. The prefix /24 means that 24 bits identify the network and 8 bits remain for hosts.

To convert binary to decimal, add the place values represented by 1 bits. An octet has place values 128, 64, 32, 16, 8, 4, 2, and 1. For example, 11000000 equals 128 + 64 = 192.

For every subnet, identify the network address, the first address in the block; the broadcast address, the last address in an IPv4 subnet; and the usable host range between them. A typical subnet with h host bits has 2^h total addresses and, when network and broadcast addresses are reserved, 2^h - 2 usable hosts.

To divide 192.168.10.0/24 into four equal subnets, borrow two host bits, producing /26. The networks are 192.168.10.0/26, 192.168.10.64/26, 192.168.10.128/26, and 192.168.10.192/26. The first subnet has usable hosts .1 through .62 and broadcast .63.

VLSM, or variable-length subnet masking, assigns different prefix lengths according to need. Allocate the largest LAN first, then progressively smaller networks. A /27 supports 30 usable hosts, while a /30 supports two usable hosts and is suitable for many point-to-point links. Always reserve space for gateways and future growth.

Route summarization combines contiguous networks into a shorter prefix. The summarized networks must share the same leading bits, be aligned on a valid boundary, and be reachable through the same next hop. Summarization reduces routing table size but can create a less-specific route, so design it carefully.

Class A, B, and C address classes are historical concepts. Modern networks use classless addressing and CIDR prefixes. The former classful defaults were /8, /16, and /24, but the first octet does not determine the actual current subnet size.

IPv6 addressing and basic operation

IPv6 uses 128-bit addresses, providing a much larger address space and removing the need for IPv4 broadcast. An address is written as eight hexadecimal groups separated by colons. Leading zeros in a group may be removed, and one consecutive run of all-zero groups may be replaced by :: once.

For example, 2001:0db8:0000:0000:0000:0000:0000:0010/64 becomes 2001:db8::10/64. A prefix length identifies the network portion.

IPv6 interfaces may receive addresses through static configuration, SLAAC, or DHCPv6. SLAAC uses router advertisements to provide a prefix and configuration information. DHCPv6 can provide additional settings or addresses. IPv6 uses Neighbor Discovery Protocol, based on ICMPv6, for functions similar to ARP, including neighbor resolution and router discovery. A router advertisement can identify the default gateway; hosts also maintain link-local addresses.

IPv6 routers require ipv6 unicast-routing before forwarding IPv6 packets. Dual stack runs IPv4 and IPv6 simultaneously. Transition technologies such as tunneling and translation exist, but dual stack is the foundational concept for introductory study.

Ethernet switching and LAN operation

An Ethernet frame includes destination and source MAC addresses, an EtherType or length field, payload, and a frame check sequence. A switch learns the source MAC address and incoming port, stores that association in its MAC address table, and uses the destination MAC to forward later frames.

• Learning: record the source MAC and ingress port.
• Forwarding: send a known unicast out the matching port.
• Filtering: do not send a frame back out the port where it arrived.
• Flooding: send an unknown unicast, broadcast, or relevant multicast out other ports in the same VLAN.

A collision domain is the set of interfaces that could contend for the same medium. A switch port normally creates a separate collision domain. A broadcast domain is the set of devices that receive a Layer 2 broadcast; VLANs and routers divide broadcast domains.

Full-duplex switched Ethernet avoids collisions. Half-duplex operation uses collision detection and can produce late collisions, errors, and low throughput if incorrectly negotiated.

Switching loops can duplicate frames, destabilize MAC learning, and create broadcast storms. The Spanning Tree Protocol prevents these loops by selecting a logical loop-free topology and blocking redundant paths. If the active path fails, STP can converge and allow a previously blocked path. Root selection, port roles, and timers influence convergence.

VLANs and trunking

A VLAN is a logical Layer 2 network. VLANs separate broadcast domains without requiring a different physical switch for every group. An access port belongs to one VLAN and normally sends untagged frames to an end host. A trunk carries multiple VLANs between network devices.

• Default VLAN: the initial VLAN on many switches; do not treat it as a security boundary.
• Native VLAN: the VLAN whose frames are sent untagged on an 802.1Q trunk.
• Management VLAN: carries switch management traffic, often through an SVI.
• Voice VLAN: allows an IP phone and an attached computer to use logically separate VLANs on one access interface.

IEEE 802.1Q inserts a VLAN tag into trunk frames. Allowed VLAN lists limit which VLANs cross a trunk. Inter-VLAN communication requires a Layer 3 device. With router-on-a-stick, one physical router interface uses subinterfaces, each tagged for a VLAN. A multilayer switch can instead use an SVI, a virtual interface such as interface vlan 10, for management or routing.

enable
configure terminal
vlan 10
 name USERS
interface gigabitEthernet 0/1
 switchport mode access
 switchport access vlan 10
interface gigabitEthernet 0/24
 switchport mode trunk
 switchport trunk allowed vlan 10,20,99
show vlan brief
show interfaces trunk

interface gigabitEthernet 0/0.10
 encapsulation dot1q 10
 ip address 192.168.10.1 255.255.255.0
interface gigabitEthernet 0/0.20
 encapsulation dot1q 20
 ip address 192.168.20.1 255.255.255.0

Routing fundamentals

A router separates networks and forwards packets based on the destination IP address. Its routing table records a route source, destination prefix, prefix length, metric, next hop, and sometimes an exit interface.

• Connected route: created when an interface has an address and is operational.
• Local route: identifies the router's own interface address.
• Static route: manually configured by an administrator.
• Default route: matches destinations for which no more-specific route exists.
• Dynamic route: learned through a routing protocol.

Routers use longest-prefix match: among matching routes, the route with the most specific prefix wins. If routes to the same prefix come from different sources, administrative distance helps select the preferred source. A metric compares paths within a routing protocol. A floating static route has a deliberately higher administrative distance and acts as a backup.

ip route 192.168.20.0 255.255.255.0 10.0.0.2
ip route 0.0.0.0 0.0.0.0 10.0.0.2
ipv6 route 2001:db8:20::/64 2001:db8:12::2
ipv6 route ::/0 2001:db8:12::2
show ip route
show ipv6 route

RIP is a distance-vector protocol that uses hop count. OSPF is a link-state protocol that builds a topology database and calculates paths. At this level, focus on why dynamic routing is used, how routes appear in a table, and how to verify learned paths. End-to-end connectivity also requires a return route.

Cisco IOS operation and device management

Cisco IOS is the operating system used by many Cisco network devices. Routers connect networks, switches provide Layer 2 connectivity, firewalls enforce security policy, wireless devices provide WLAN access, and end hosts consume network services.

Use question-mark help, Tab completion, command history, and keyboard editing to work efficiently. The running configuration is active in RAM. The startup configuration is used at boot and is stored in nonvolatile memory. Save changes explicitly.

enable
configure terminal
hostname R1
enable secret <secret>
copy running-config startup-config
show running-config
show startup-config

Console access is local, auxiliary access is commonly used for out-of-band modem access, Telnet provides insecure remote CLI access, and SSH provides encrypted remote management. Use local user accounts, enable secret, login controls, and a warning banner. Device clocks should be configured or synchronized with NTP. IOS file systems contain configuration files, images, and other files; TFTP was commonly used for basic configuration backup. Configuration-register settings influence boot behavior and are relevant to password recovery and image loading.

username admin secret <secret>
ip domain-name example.local
crypto key generate rsa
ip ssh version 2
line console 0
 login local
line vty 0 4
 transport input ssh
 login local

Interface configuration and verification

Router interfaces need an address, mask or prefix, and an operational state. An interface placed in an administratively down state must be enabled with no shutdown. Switch access ports need an appropriate VLAN and basic Layer 2 settings.

interface gigabitEthernet 0/0
 ip address 192.168.10.1 255.255.255.0
 no shutdown
ipv6 unicast-routing
interface gigabitEthernet 0/0
 ipv6 address 2001:db8:10::1/64
 ipv6 address fe80::1 link-local
 no shutdown
show ip interface brief
show ipv6 interface brief

Infrastructure services

A DHCP server assigns addresses dynamically. A router interface can relay DHCP broadcasts to a server on another subnet. Static addressing is predictable and useful for infrastructure; dynamic addressing reduces manual work for clients.

NAT translates addresses between inside and outside networks. Inside local means an internal address as seen inside; inside global means the public translation representing that internal host. Outside local and outside global describe the outside host from the inside and outside perspectives. PAT, or NAT overload, maps many private addresses to one public address by distinguishing sessions with port numbers.

ip dhcp pool LAN10
 network 192.168.10.0 255.255.255.0
 default-router 192.168.10.1
ip nat inside
ip nat outside
access-list 1 permit 192.168.10.0 0.0.0.255
ip nat inside source list 1 interface gigabitEthernet 0/1 overload
show ip dhcp binding
show ip nat translations

NTP keeps device clocks consistent, which improves log correlation and certificate validation. Syslog sends event messages to local or remote log collectors; severity levels range from emergencies through debugging. SNMP allows a monitoring system to query device data and receive notifications called traps or informs. Back up configurations with TFTP or another approved file-transfer method, and protect backups because they can contain credentials and network details.

Wireless networking fundamentals

A WLAN includes wireless clients, access points, and sometimes a wireless LAN controller that centralizes configuration and policy. The SSID is the name presented to users. 802.11 defines wireless LAN operation, including radio channels, association, and authentication.

The 2.4 GHz band generally travels farther and penetrates obstacles better but has fewer non-overlapping channels and more interference. The 5 GHz band usually offers more channels and less interference, but its range is commonly shorter. Channel overlap, neighboring access points, walls, microwaves, client distance, and transmit power can all affect performance.

Authentication verifies identity; encryption protects wireless data. WPA2 and WPA3 can use a pre-shared key for personal networks or enterprise authentication through a central authentication service. For troubleshooting, verify power, SSID visibility, client association, signal strength, channel utilization, authentication settings, DHCP operation, VLAN mapping, and upstream reachability.

Network security fundamentals

Threats include malware, phishing, spoofing, denial of service, man-in-the-middle attacks, password attacks, rogue DHCP servers, and ARP spoofing. Apply least privilege: give users and services only the access they need. Use defense in depth: combine physical, host, network, identity, monitoring, and policy controls.

Prefer SSH over Telnet because Telnet sends management traffic, including credentials, without encryption. Protect privileged access with enable secret, local accounts, strong passwords, login controls, encrypted stored secrets, and an appropriate banner. Port security can limit an access port to known MAC addresses. Violation actions commonly include protect, restrict, and shutdown; shutdown places the interface into an error-disabled state and requires corrective action.

A standard IPv4 ACL matches source addresses. A wildcard mask uses 0 to require a bit match and 1 to ignore a bit. ACL statements are processed top to bottom, and an implicit deny exists at the end. Apply an ACL in a location that filters unwanted traffic without unintentionally blocking required traffic. VTY access restrictions use an ACL with access-class.

access-list 10 permit 192.168.10.0 0.0.0.255
line vty 0 4
 access-class 10 in
show access-lists

Troubleshooting methodology and maintenance

Use a repeatable process: define the problem, gather evidence, form a hypothesis, test it, resolve the fault, verify the result, and document the change. Useful approaches include top-down testing from applications toward the physical layer, bottom-up testing from cables upward, divide-and-conquer, following the packet path, and substitution with a known-good component.

Use the OSI or TCP/IP model to avoid random changes. Check physical connectivity and interface state first, then Layer 2 VLAN and trunk behavior, Layer 3 addressing and routing, services such as DHCP and DNS, and finally security policies such as ACLs and NAT.

On end hosts, use ipconfig or ifconfig to inspect addressing, arp for local mappings, netstat for connections, and nslookup for DNS testing. An extended ping can specify a source interface or address, helping distinguish a local path problem from a return-path problem.

Worked troubleshooting examples

• Administratively down interface: inspect show ip interface brief, enter the interface, confirm its address, apply no shutdown, and then check the cable, neighbor, and speed or duplex if it remains down.
• Hosts in one VLAN fail: verify both ports are operational, confirm access VLAN membership, compare host addresses and masks, and check for a security violation or error-disabled port.
• Hosts in different VLANs fail: verify VLAN creation, access assignments, trunk operation, allowed VLANs, subinterface tags, gateway addresses, and host default gateways.
• DHCP fails: check physical connectivity and VLAN placement, the pool network, exclusions, default router, bindings, and a relay when the server is remote.
• DNS fails while IP ping works: inspect the client DNS setting, use nslookup, and test reachability and service availability of the DNS server.
• NAT fails: verify inside and outside designations, the matching ACL, overload configuration, the outside route, and translation entries.
• SSH fails: verify a reachable management address, hostname, domain name, RSA keys, local user, VTY login method, SSH transport, and any VTY ACL.
• Trunk omits a VLAN: inspect operational trunk status, allowed lists at both ends, VLAN existence, native VLAN expectations, and whether the remote port is accidentally an access port.

Back up a known-good configuration before changes. Record the reason, commands, time, expected result, and rollback procedure for each change. After the change, verify both the immediate function and related paths, then update the documentation.

Practical lab sequence

1. Build two IPv4 LANs connected by a router. Assign interface and host addresses, configure a static route and default route, and verify with ping and traceroute.
2. Plan a private address block with different subnet sizes for departments and point-to-point links. Record network, broadcast, gateway, and usable ranges.
3. Configure a switch hostname, management SVI, default gateway, console credentials, enable secret, local user, and SSH.
4. Create user and management VLANs, assign access ports, configure an 802.1Q trunk, and verify with show vlan brief and show interfaces trunk.
5. Configure router-on-a-stick subinterfaces and test communication between VLANs.
6. Assign IPv6 global unicast and link-local addresses, enable forwarding, and test IPv6 ping.
7. Configure DHCP for an inside LAN and PAT toward an outside interface. Verify bindings and translations.
8. Apply a standard ACL to restrict VTY access and test both permitted and denied sources.
9. Configure port security on an access port and observe protect, restrict, and shutdown behavior in a controlled lab.
10. Introduce faults involving cables, VLANs, trunks, gateways, routes, DNS, DHCP, NAT, and ACLs. Follow the layered troubleshooting process and document each fix.

Related study areas

After mastering this foundation, continue with broader Cisco CCNA preparation, advanced OSPF and dynamic routing, switching redundancy, wireless administration, firewalls, VPNs, monitoring, automation, cloud networking, and cybersecurity fundamentals. For adjacent command-line and monitoring practice, see the Nmap introduction and Splunk introduction.