CCNA 200-301 Official Cert Guide, Volume 2

Wendell Odom, CCIE Enterprise No. 1624, was the first Cisco Press author for Cisco certification guides. He wrote all prior editions of this book, along with books on topics ranging from introductory networking to CCENT, CCNA R&S, CCNA DC, CCNP ROUTE, CCNP QoS, and CCIE R&S. In his four decades as a networker, he has worked as a network engineer, consultant, systems engineer, instructor, and course developer. He now spends his time focused on updating the CCNA books, his blog (www.certskills.com), building his new CCNA YouTube channel (www.youtube.com/@NetworkUpskill), and teaching online (www.certskills.com/courses). You can find him at www.LinkedIn.com/in/WendellOdom, Twitter (@WendellOdom), and at his blog, which provides a variety of free CCNA learning resources.Jason Gooley, CCIEx2 (RS, SP) No. 38759, is a very enthusiastic and engaging speaker who focuses on teaching others. Jason has more than 30 years of experience in the industry and currently works as the technical evangelist for the Worldwide Enterprise Networking and Software Sales team at Cisco. Jason is very passionate about helping others in the industry succeed. In addition to being a public speaker, Jason has authored numerous Cisco Press books, is a CiscoLive Distinguished Speaker, and is a developer of CCIE exams, training, and blogs for Learning@Cisco. Jason is also a co-founder and member of the Program Committee Board for the Chicago Network Operators Group (CHI-NOG). Jason is the founder and host of @MetalDevOps, which is a YouTube video show about the intersection of metal music and technology. Jason has earned the nickname of “The Godfather of Programmability” from his students and peers and continues to help drive the industry forward around topics such as network programmability and automation.David Hucaby, CCIE No. 4594, CWNE No. 292, is a technical education content engineer for Cisco Meraki. Previously, he worked as a wireless escalation engineer in a large healthcare environment for more than 20 years. David holds bachelor’s and master’s degrees in electrical engineering. He has been authoring Cisco Press titles for 25 years. David lives in Kentucky.

• Introduction xxxiPart I Wireless LANs 3Chapter 1 Fundamentals of Wireless Networks 4“Do I Know This Already?” Quiz 4Foundation Topics 6Comparing Wired and Wireless Networks 6Wireless LAN Topologies 7Basic Service Set 8Distribution System 10Extended Service Set 12Independent Basic Service Set 13Other Wireless Topologies 14Repeater 14Workgroup Bridge 15Outdoor Bridge 16Mesh Network 17Wireless Bands and Channels 17Chapter Review 20Chapter 2 Analyzing Cisco Wireless Architectures 22“Do I Know This Already?” Quiz 22Foundation Topics 24Autonomous AP Architecture 24Cloud-based AP Architecture 26Split-MAC Architectures 28Comparing Cisco Wireless LAN Controller Deployments 32Cisco AP Modes 35FlexConnect Mode 36Chapter Review 37Chapter 3 Securing Wireless Networks 40“Do I Know This Already?” Quiz 40Foundation Topics 42Anatomy of a Secure Connection 42Authentication 43Message Privacy 44Message Integrity 45Wireless Client Authentication Methods 46Open Authentication 46WEP 47802.1x/EAP 47LEAP 48EAP-FAST 49PEAP 49EAP-TLS 50Wireless Privacy and Integrity Methods 50TKIP 50CCMP 51GCMP 51WPA, WPA2, and WPA3 51Chapter Review 53Chapter 4 Building a Wireless LAN 56“Do I Know This Already?” Quiz 56Foundation Topics 58Connecting a Cisco AP 58Accessing a Cisco WLC 59Connecting a Cisco WLC 63WLC Physical Ports 63Configuring a WLAN 65Configuring a WLAN on an IOS-XE WLC 67Step 1: Configure a WLAN Profile 69Step 2: Configure a Policy Profile 74Step 3: Map the WLAN and Policy Profiles to a Policy Tag 77Step 4: Apply the Policy Tag to Some APs 78Configuring a WLAN on an AireOS WLC 79Step 1: Create a Dynamic Interface 79Step 2: Create a New WLAN 80Step 3: Configure the WLAN 81Configuring WLAN Security 83Configuring WLAN QoS 85Configuring Advanced WLAN Settings 85Finalizing WLAN Configuration 86Chapter Review 87Part I Review 88Part II IP Access Control Lists 91Chapter 5 Introduction to TCP/IP Transport and Applications 92“Do I Know This Already?” Quiz 92Foundation Topics 94TCP/IP Layer 4 Protocols: TCP and UDP 94Transmission Control Protocol 95Multiplexing Using TCP Port Numbers 95Popular TCP/IP Applications 98Connection Establishment and Termination 100Error Recovery and Reliability 101Flow Control Using Windowing 102User Datagram Protocol 103TCP/IP Applications 104Uniform Resource Identifiers 104Finding the Web Server Using DNS 105Transferring Files with HTTP 108How the Receiving Host Identifies the Correct Receiving Application 109HTTP Versions 110HTTP 1.0 and 1.1 110HTTP/2 and TLS 110HTTP 3.0 111Chapter Review 112Chapter 6 Basic IPv4 Access Control Lists 114“Do I Know This Already?” Quiz 114Foundation Topics 116IPv4 Access Control List Basics 116ACL Location and Direction 116Matching Packets 117Taking Action When a Match Occurs 118Types of IP ACLs 118Standard Numbered IPv4 ACLs 119List Logic with IP ACLs 119Matching Logic and Command Syntax 121Matching the Exact IP Address 121Matching a Subset of the Address with Wildcard Masks 122Binary Wildcard Masks 123Finding the Right Wildcard Mask to Match a Subnet 124Matching Any/All Addresses 124Implementing Standard IP ACLs 125Standard Numbered ACL Scenario 1 125Standard Numbered ACL Scenario 2 127Troubleshooting and Verification Tips 129Practice Applying Standard IP ACLs 130Practice Building access-list Commands 130Reverse Engineering from ACL to Address Range 131Chapter Review 133Chapter 7 Named and Extended IP ACLs 136“Do I Know This Already?” Quiz 136Foundation Topics 138Named ACLs and ACL Editing 138Named IP Access Lists 138Editing ACLs 140Editing Named ACLs 140Editing Numbered ACLs 143Extended IP Access Control Lists 144Matching the Protocol, Source IP, and Destination IP 145Matching TCP and UDP Port Numbers 147Extended IP ACL Configuration 150Extended IP ACL Example 1: Packets to Web Servers 151Extended IP ACL Example 2: Packets from Web Servers 153Adjusting ACLs for HTTP/3 154Practice Building access-list Commands 155ACL Implementation Considerations 156Chapter Review 157Chapter 8 Applied IP ACLs 160“Do I Know This Already?” Quiz 160Foundation Topics 162ACLs and Network Infrastructure Protocols 162Filtering DNS 163Filtering ICMP 164Filtering OSPF 165Filtering DHCP 167Filtering SSH and Telnet 169Filtering for End User SSH/Telnet 169Filtering for Router VTY Access 171Comparing ACLs in IOS and IOS XE 173Configuration Syntax and Show Commands 173Resequencing ACL Sequence Numbers 174Using a Second (Common) Interface ACL 175Matching Multiple Nonconsecutive Ports with eq 177Chapter Review 177Part II Review 180Part III Security Services 183Chapter 9 Security Architectures 184“Do I Know This Already?” Quiz 184Foundation Topics 186Security Terminology 186Common Security Threats 188Attacks That Spoof Addresses 188Denial-of-Service Attacks 189Reflection and Amplification Attacks 191Man-in-the-Middle Attacks 191Address Spoofing Attack Summary 193Reconnaissance Attacks 193Buffer Overflow Attacks 194Malware 194Human Vulnerabilities 195Password Vulnerabilities 196Password Alternatives 196Controlling and Monitoring User Access 198Developing a Security Program to Educate Users 200Chapter Review 201Chapter 10 Securing Network Devices 202“Do I Know This Already?” Quiz 202Foundation Topics 204Securing IOS Passwords 204Encrypting Older IOS Passwords with service password-encryption 205Encoding the Enable Passwords with Hashes 206Interactions Between Enable Password and Enable Secret 206Making the Enable Secret Truly Secret with a Hash 207Improved Hashes for Cisco’s Enable Secret 209Encoding the Passwords for Local Usernames 210Firewalls and Intrusion Prevention Systems 211Traditional Firewalls 211Security Zones 213Intrusion Prevention Systems (IPS) 215Cisco Next-Generation Firewalls 216Cisco Next-Generation IPS 218Chapter Review 219Chapter 11 Implementing Switch Port Security 222“Do I Know This Already?” Quiz 222Foundation Topics 224Port Security Concepts and Configuration 224Configuring Port Security 225Verifying Port Security 228Port Security MAC Addresses 229Port Security Violation Modes 230Port Security Shutdown Mode 231Port Security Protect and Restrict Modes 233Chapter Review 235Chapter 12 DHCP Snooping and ARP Inspection 238“Do I Know This Already?” Quiz 238Foundation Topics 240DHCP Snooping 240DHCP Snooping Concepts 240A Sample Attack: A Spurious DHCP Server 241DHCP Snooping Logic 242Filtering DISCOVER Messages Based on MAC Address 243Filtering Messages That Release IP Addresses 244DHCP Snooping Configuration 245Configuring DHCP Snooping on a Layer 2 Switch 246Limiting DHCP Message Rates 248DHCP Snooping Configuration Summary 249Dynamic ARP Inspection 250DAI Concepts 250Review of Normal IP ARP 250Gratuitous ARP as an Attack Vector 251Dynamic ARP Inspection Logic 253Dynamic ARP Inspection Configuration 254Configuring ARP Inspection on a Layer 2 Switch 254Limiting DAI Message Rates 257Configuring Optional DAI Message Checks 258IP ARP Inspection Configuration Summary 259Chapter Review 260Part III Review 264Part IV IP Services 267Chapter 13 Device Management Protocols 268“Do I Know This Already?” Quiz 268Foundation Topics 270System Message Logging (Syslog) 270Sending Messages in Real Time to Current Users 270Storing Log Messages for Later Review 271Log Message Format 272Log Message Severity Levels 272Configuring and Verifying System Logging 273The debug Command and Log Messages 276Network Time Protocol (NTP) 277Setting the Time and Time Zone 278Basic NTP Configuration 279NTP Reference Clock and Stratum 281Analyzing Topology Using CDP and LLDP 283Examining Information Learned by CDP 283Configuring and Verifying CDP 286Examining Information Learned by LLDP 287Configuring and Verifying LLDP 290LLDP-MED and TLVs 292Chapter Review 293Chapter 14 Network Address Translation 298“Do I Know This Already?” Quiz 298Foundation Topics 300Network Address Translation Concepts 300IPv4 Address Conservation with NAT 300Inside Source NAT 302Static NAT 303Inside Local and Inside Global Addresses 303Dynamic NAT 304Overloading NAT with Port Address Translation 306NAT Configuration and Troubleshooting 307Static NAT Configuration 308Dynamic NAT Configuration 310Dynamic NAT Verification 312NAT Overload (PAT) Configuration 314NAT Troubleshooting 317Chapter Review 318Chapter 15 Quality of Service (QoS) 322“Do I Know This Already?” Quiz 322Foundation Topics 324Introduction to QoS 324QoS: Managing Bandwidth, Delay, Jitter, and Loss 324Types of Traffic 325Data Applications 325Voice and Video Applications 327QoS as Mentioned in This Book 328QoS on Switches and Routers 329Classification and Marking 329Classification Basics 329Matching (Classification) Basics 330Classification on Routers with ACLs and NBAR 331Marking IP DSCP and Ethernet CoS 332Marking the IP Header 333Marking the Ethernet 802.1Q Header 333Other Marking Fields 334Defining Trust Boundaries 334DiffServ Suggested Marking Values 335Expedited Forwarding (EF) 336Assured Forwarding (AF) 336Class Selector (CS) 336Guidelines for DSCP Marking Values 337Queuing 337Round-Robin Scheduling (Prioritization) 338Low Latency Queuing 339A Prioritization Strategy for Data, Voice, and Video 341Shaping and Policing 341Policing 342Where to Use Policing 342Shaping 344Setting a Good Shaping Time Interval for Voice and Video 345Congestion Avoidance 346TCP Windowing Basics 346Congestion Avoidance Tools 347Chapter Review 348Chapter 16 First Hop Redundancy Protocols 350“Do I Know This Already?” Quiz 350Foundation Topics 352First Hop Redundancy Protocols 352The Need for Redundancy in Networks 353The Need for a First Hop Redundancy Protocol 354The Three Solutions for First-Hop Redundancy 356Hot Standby Router Protocol 356HSRP Virtual IP and MAC Addresses 357HSRP Failover 357HSRP Load Balancing 359HSRP Interface Tracking 359HSRP Recovery and Preemption 360HSRP Versions 361VRRP and GLBP Concepts 362Virtual Router Redundancy Protocol (VRRP) 362GLBP Concepts 363Similarities of GLBP, HSRP, and VRRP 363GLBP Active/Active Load Balancing 364Chapter Review 366Chapter 17 SNMP, FTP, and TFTP 368“Do I Know This Already?” Quiz 368Foundation Topics 370Simple Network Management Protocol 370SNMP Variable Reading and Writing: SNMP Get and Set 371SNMP Notifications: Traps and Informs 372The Management Information Base 372Securing SNMP 374FTP and TFTP 376Managing Cisco IOS Images with FTP/TFTP 376The IOS File System 376Upgrading IOS Images 378Copying a New IOS Image to a Local IOS File System Using TFTP 378Listing the Files in the IOS File System 379Verifying IOS Code Integrity with MD5 or SHA512 381Copying Images with FTP 382The FTP and TFTP Protocols 384FTP Protocol Basics 384FTP Active and Passive Modes 385TFTP Protocol Basics 387Chapter Review 388Part IV Review 392Part V Network Architecture 395Chapter 18 LAN Architecture 396“Do I Know This Already?” Quiz 396Foundation Topics 398Analyzing Campus LAN Topologies 398Two-Tier Campus Design (Collapsed Core) 399Three-Tier Campus Design (Core) 400Topology Design Terminology 402Ethernet Physical Media and Standards 403Ethernet UTP Links at the Access Layer 403Multigig Ethernet on CAT 5E Cabling 405Fiber Uplinks 406Small Office/Home Office 407Power over Ethernet (PoE) 408PoE Basics 409PoE Operation 409PoE and LAN Design 411Chapter Review 412Chapter 19 WAN Architecture 414“Do I Know This Already?” Quiz 414Foundation Topics 416Metro Ethernet 416Metro Ethernet Physical Design and Topology 416Ethernet WAN Services and Topologies 418Ethernet Line Service (Point-to-Point) 418Ethernet LAN Service (Full Mesh) 419Layer 3 Design Using Metro Ethernet 420Layer 3 Design with E-Line Service 420Layer 3 Design with E-LAN Service 421Multiprotocol Label Switching (MPLS) 422MPLS VPN Physical Design and Topology 423Layer 3 with MPLS VPN 424Internet VPNs 425Internet Access 426Digital Subscriber Line 426Cable Internet 427Wireless WAN (4G, 5G) 428Fiber (Ethernet) Internet Access 429Internet VPN Fundamentals 430Site-to-Site VPNs with IPsec 431Remote Access VPNs with IPsec 433Remote Access VPNs with TLS 434Chapter Review 435Chapter 20 Cloud Architecture 438“Do I Know This Already?” Quiz 438Foundation Topics 440Server Virtualization 440Cisco Server Hardware 440Server Virtualization and Virtual Machine Basics 441Networking with Virtual Switches on a Virtualized Host 443Software Containers 444The Physical Data Center Network 446Workflow with a Virtualized Data Center 446Cloud Computing Services 448Private Cloud (On-Premise) 449Public Cloud 450Cloud and the “As a Service” Model 451Infrastructure as a Service 451Software as a Service 452(Development) Platform as a Service 453Virtual Routing and Forwarding (VRF) Instances 454WAN Traffic Paths to Reach Cloud Services 456Enterprise WAN Connections to Public Cloud 456Accessing Public Cloud Services Using the Internet 456Pros and Cons with Connecting to Public Cloud with Internet 457Private WAN and Internet VPN Access to Public Cloud 458Pros and Cons of Connecting to Cloud with Private WANs 459Intercloud Exchanges 459Summarizing the Pros and Cons of Public Cloud WAN Options 460Understanding Cloud Management 460Chapter Review 465Part V Review 466Part VI Network Automation 469Chapter 21 Introduction to Controller-Based Networking 470“Do I Know This Already?” Quiz 471Foundation Topics 472SDN and Controller-Based Networks 472The Data, Control, and Management Planes 472The Data Plane 473The Control Plane 474The Management Plane 475Cisco Switch Data Plane Internals 475Controllers and Software Defined Architecture 477Controllers and Centralized Control 477The Southbound Interface 478The Northbound Interface 479Software Defined Architecture Summary 481Examples of Network Programmability and SDN 481OpenDaylight and OpenFlow 481The OpenDaylight Controller 482The Cisco Open SDN Controller (OSC) 483Cisco Application Centric Infrastructure (ACI) 484ACI Physical Design: Spine and Leaf 484ACI Operating Model with Intent-Based Networking 486Summary of the SDN Examples 488Comparing Traditional Versus Controller-Based Networks 488How Automation Impacts Network Management 489Comparing Traditional Networks with Controller-Based Networks 491Chapter Review 492Chapter 22 Cisco Software-Defined Access (Cisco SD-Access) 494“Do I Know This Already?” Quiz 495Foundation Topics 496Cisco SD-Access Fabric, Underlay, and Overlay 496The Cisco SD-Access Underlay 499Using Existing Gear for the Cisco SD-Access Underlay 499Using New Gear for the Cisco SD-Access Underlay 501The Cisco SD-Access Overlay 503VXLAN Tunnels in the Overlay (Data Plane) 504LISP for Overlay Discovery and Location (Control Plane) 505Cisco Catalyst Center and Cisco SD-Access Operation 509Cisco Catalyst Center 509Cisco Catalyst Center and Scalable Groups 510Issues with Traditional IP-Based Security 511Cisco SD-Access Security Is Based on User Groups 512Cisco Catalyst Center as a Network Management Platform 514Cisco Catalyst Center Similarities to Traditional Management 515Cisco Catalyst Center and Differences with Traditional Management 516Artificial Intelligence (AI), Machine Learning (ML), and Operational Management 517Chapter Review 524Chapter 23 Understanding REST and JSON 526“Do I Know This Already?” Quiz 526Foundation Topics 528REST-Based APIs 528REST-Based (RESTful) APIs 528Client/Server Architecture 529Stateless Operation 530Cacheable (or Not) 530Background: Data and Variables 530Simple Variables 530List and Dictionary Variables 531REST APIs and HTTP 533Software CRUD Actions and HTTP Verbs 533Using URIs with HTTP to Specify the Resource 534Example of REST API Call to Cisco Catalyst Center 536Data Serialization and JSON 541The Need for a Data Model with APIs 542Data Serialization Languages 544JSON 544XML 544YAML 545Summary of Data Serialization 546Recognizing the Components of JSON 546Interpreting JSON Key:Value Pairs 547Interpreting JSON Objects and Arrays 547Minified and Beautified JSON 550Chapter Review 550Chapter 24 Understanding Ansible and Terraform 552“Do I Know This Already?” Quiz 552Foundation Topics 554Device Configuration Challenges and Solutions 554Configuration Drift 554Centralized Configuration Files and Version Control 555Configuration Monitoring and Enforcement 557Configuration Provisioning 558Configuration Templates and Variables 559Files That Control Configuration Automation 561Ansible and Terraform Basics 562Ansible 562Terraform 563Summary of Configuration Management Tools 565Chapter Review 566Part VI Review 568Part VII Exam Updates and Final Review 571Chapter 25 CCNA 200-301 Official Cert Guide, Volume 2, Second Edition, Exam Updates 572The Purpose of This Chapter 572Additional Technical Content 573Official Blueprint Changes 573Impact on You and Your Study Plan 575News About the Next CCNA Exam Release 576Updated Technical Content 576Chapter 26 Final Review 578Advice About the Exam Event 578Learn About Question Types 578Think About Your Time Budget 581An Example Time-Check Method 581One Week Before Your Exam 58224 Hours Before Your Exam 58230 Minutes Before Your Exam 583The Hour After Your Exam 583Exam Review 584Using Practice Questions 585Hold Practice Exam Events 586Exam Scoring on the Real Exam 587Self-Assessment Suggestions 587Gap Analysis Using Q&A 589Advice on How to Answer Exam Questions 590Additional Exams with the Premium Edition 592Practicing CLI Skills 593Adjustments for Your Second Attempt 595Other Study Tasks 596Final Thoughts 596Part VIII Print Appendixes 599Appendix A Numeric Reference Tables 601Appendix B Exam Topics Cross-Reference 607Appendix C Answers to the “Do I Know This Already?” Quizzes 619Glossary 641 Online AppendixesAppendix D Topics from Previous EditionsAppendix E Practice for Chapter 6: Basic IPv4 Access Control ListsAppendix F Study PlannerGlossary 9780138214951 TOC 5/29/2024