CCNA Automation cheat sheet

OSI layers: 7 Application, 6 Presentation, 5 Session, 4 Transport, 3 Network, 2 Data Link, 1 Physical; TCP/IP model maps Application (7-5), Transport (4), Internet (3), Network Access (2-1).

TCP is connection-oriented with 3-way handshake (SYN, SYN-ACK, ACK) and reliable delivery; UDP is connectionless and best-effort with lower overhead.

IPv4 private ranges (RFC 1918): 10.0.0.0/8, 172.16.0.0/12 (172.16.0.0-172.31.255.255), 192.168.0.0/16; APIPA 169.254.0.0/16 indicates DHCP failure.

Subnetting formula: usable hosts = 2^h - 2, where h = 32 - prefix length; number of subnets = 2^s when borrowing s bits.

MAC address is 48 bits written as 12 hex digits; OUI is the first 24 bits identifying the vendor; broadcast MAC is FF:FF:FF:FF:FF:FF.

Ethernet frame fields: preamble, destination MAC, source MAC, EtherType/Length, payload (46-1500 bytes), FCS; minimum frame 64 bytes, MTU default 1500 bytes.

IPv6 address is 128 bits; loopback ::1; link-local FE80::/10; global unicast 2000::/3; multicast FF00::/8; no broadcast in IPv6.

Cabling decision: straight-through for unlike devices (PC-switch, switch-router), crossover for like devices (switch-switch, PC-PC, router-router); Auto-MDIX removes the distinction on modern ports.

DNS resolves names to IPs (A/AAAA records); DHCP uses UDP 67 (server) and 68 (client) with DORA (Discover, Offer, Request, Acknowledge).

VLANs segment a Layer 2 broadcast domain; inter-VLAN routing requires a Layer 3 device (router subinterfaces or multilayer switch SVIs).

802.1Q trunk tag inserts a 4-byte tag (TPID 0x8100 + 12-bit VLAN ID + priority/DEI); native VLAN frames are untagged, so native VLANs must match on both ends.

Access port carries one VLAN and is typical for end devices; trunk port carries multiple VLANs and is typical for switch-to-switch or switch-to-router links.

STP (802.1D) prevents Layer 2 loops by electing a root bridge (lowest bridge ID = priority + MAC) and selecting root/designated/blocking ports; RSTP (802.1w) converges faster with alternate/backup port roles.

PortFast bypasses listening/learning on edge ports; BPDU Guard err-disables a PortFast port that receives a BPDU; Root Guard prevents a port from becoming root.

EtherChannel bundles links for bandwidth and redundancy; LACP (802.3ad) is standards-based, PAgP is Cisco-proprietary; member ports must match speed, duplex, and VLAN configuration.

CDP is Cisco-proprietary and enabled by default; LLDP (802.1AB) is vendor-neutral and must be enabled; both discover directly connected neighbors.

Wireless: 802.11 standards differ mainly by band and throughput; 2.4 GHz has longer range and only 3 non-overlapping channels (1, 6, 11), 5 GHz has more channels and shorter range.

WLC CAPWAP uses UDP 5246 (control) and 5247 (data); lightweight APs discover the WLC via DHCP option 43, DNS, or broadcast.

Router decision order: longest prefix match first, then lowest administrative distance, then lowest metric; directly connected routes default to AD 0.

Default administrative distances: connected 0, static 1, eBGP 20, EIGRP 90, OSPF 110, RIP 120, iBGP 200.

Static route syntax: ip route <next-hop|exit-interface> [distance]; a floating static uses a higher AD than the primary route.

OSPFv2 (IPv4) uses link-state LSAs, cost = reference bandwidth / interface bandwidth (default reference 100 Mbps); hello timers 10 s on broadcast, 30 s on NBMA; neighbors must match area, hello/dead timers, and authentication.

OSPF neighbor states: Down, Init, 2-Way, ExStart, Exchange, Loading, Full; DROTHER routers form Full only with DR/BDR.

EIGRP is an advanced distance-vector protocol using composite metric (bandwidth, delay by default) and DUAL for loop-free paths; feasible successor is a backup route meeting the feasibility condition.

First-hop redundancy: HSRP (Cisco, active/standby, virtual MAC 0000.0c07.acXX), VRRP (standards-based, master/backup), GLBP (Cisco, load balancing across up to 4 gateways).

IPv6 routing: enable with ipv6 unicast-routing; link-local next hops are typical; OSPFv3 runs per link and uses FF02::5 (all OSPF routers) and FF02::6 (DR/BDR).

NAT terminology: inside local (private host), inside global (public translated), outside global (remote public), outside local (remote as seen inside); PAT overloads many inside hosts onto one public IP using ports.

Static NAT maps one private to one public; dynamic NAT uses a pool; PAT uses 'ip nat inside source list interface overload'.

DHCP server configuration: pool name, network/mask, default-router, dns-server, lease; excluded addresses via 'ip dhcp excluded-address'; relay with 'ip helper-address' on the client-facing interface.

NTP uses UDP 123; stratum 0 is reference clock, stratum 1 directly attached, higher strata increase as distance from reference grows; 'ntp server ' configures a client.

Syslog severity: 0 Emergency, 1 Alert, 2 Critical, 3 Error, 4 Warning, 5 Notice, 6 Informational, 7 Debugging; lower number = more severe.

SNMPv2c uses community strings (clear text); SNMPv3 adds authentication and encryption; traps are unsolicited, informs are acknowledged.

QoS markings: CoS is Layer 2 (3 bits, 0-7); DSCP is Layer 3 (6 bits, 0-63); EF (46) is for voice; AF classes are AFxy where x=class 1-4, y=drop precedence 1-3.

FTP uses TCP 20 (data) and 21 (control); TFTP uses UDP 69; SSH uses TCP 22; Telnet TCP 23; HTTP TCP 80; HTTPS TCP 443.

AAA components: Authentication (who), Authorization (what), Accounting (what was done); RADIUS uses UDP 1812/1813, TACACS+ uses TCP 49 and encrypts the full payload.

Standard ACL (1-99, 1300-1999) filters on source IP only and should be placed near the destination; extended ACL (100-199, 2000-2699) filters source, destination, protocol, and ports and should be placed near the source.

ACL processing is top-down; first match wins; implicit deny any at the end; apply with 'ip access-group in|out' on an interface.

Port security limits MAC addresses per switch port; violation modes: protect (drop, no log), restrict (drop, log, increment counter), shutdown (err-disable port).

DHCP snooping blocks rogue DHCP servers by trusting only specified uplink ports; Dynamic ARP Inspection (DAI) validates ARP packets against the DHCP snooping binding table.

802.1X port-based access control uses supplicant, authenticator (switch), and authentication server (RADIUS); EAPoL runs between supplicant and switch.

Site-to-site VPN uses IPsec (AH for integrity, ESP for encryption/integrity); IKE Phase 1 builds the ISAKMP SA, Phase 2 builds the IPsec SA.

Password hardening: 'service password-encryption' uses weak type 7; 'enable secret' uses MD5/SHA; local users can be stored with 'username secret '.

Northbound APIs (REST, NETCONF) face the network controller/application layer; southbound APIs (NETCONF, RESTCONF, CLI, SNMP) face the devices.

REST uses HTTP methods: GET (read), POST (create), PUT/PATCH (update), DELETE (remove); status codes 2xx success, 4xx client error, 5xx server error; data formats include JSON and XML.

JSON types: object ({}), array ([]), string, number, boolean, null; JSON requires double quotes for keys and strings and does not allow comments.

YANG is a data modeling language for NETCONF; NETCONF uses SSH (TCP 830) and XML-encoded RPCs; RESTCONF maps YANG models to HTTP methods and supports JSON or XML.

Configuration management tools: Ansible (agentless, YAML playbooks, SSH), Puppet (agent-based, manifests), Chef (agent-based, recipes/cookbooks); idempotency means repeated runs yield the same state.

SDN architecture separates control plane (routing decisions) from data plane (forwarding); the control plane is centralized in a controller, which programs devices via southbound APIs.

Cisco SD-Access uses fabric with VXLAN data plane and LISP control plane; Cisco DNA Center is the management/controller platform; Catalyst Center is the current branding for DNA Center.

Infrastructure as Code (IaC) benefits: repeatability, version control, reduced human error, and consistent configuration across many devices; templates use variables to generate device configs.