CCNA cheat sheet

OSI layers top to bottom: Application (7), Presentation (6), Session (5), Transport (4), Network (3), Data Link (2), Physical (1).

TCP is connection-oriented and uses a three-way handshake (SYN, SYN-ACK, ACK) with retransmission; UDP is connectionless with no retransmission.

Private IPv4 ranges: 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16. An address in 169.254.0.0/16 means DHCP failed.

Usable hosts per subnet = 2^h - 2, where h is the number of host bits; a /24 has 8 host bits, so 254 usable addresses.

Mask values by prefix: /25 = 255.255.255.128, /26 = .192, /27 = .224, /28 = .240, /29 = .248, /30 = .252.

First octet ranges: A 1-126, B 128-191, C 192-223, D 224-239 multicast, E 240-255 experimental; 127.0.0.0/8 is loopback.

Ethernet UTP runs 100 m for 100BASE-TX and 1000BASE-T; 1000BASE-LX over multimode fiber reaches about 550 m.

Straight-through cable connects unlike devices (switch to router, switch to PC); crossover connects like devices; auto-MDIX removes the requirement.

Ethernet default MTU is 1500 bytes; TCP uses a sliding window plus MSS to limit how much unacknowledged data is in flight.

VLANs divide a switch into separate broadcast domains; all ports default to VLAN 1, and inter-VLAN traffic needs a Layer 3 device.

An access port carries one VLAN untagged; a trunk carries many VLANs and tags every frame except the native VLAN with 802.1Q.

Trunk configuration commands: switchport mode trunk, switchport trunk allowed vlan , switchport trunk native vlan .

DTP modes are access, trunk, dynamic auto (passive), dynamic desirable (active), and nonegotiate; mismatched modes prevent a trunk forming.

STP elects one root bridge by lowest bridge ID (priority first, then MAC); default priority is 32768 and port costs accumulate toward the root.

802.1D port states: blocking, listening (15 s), learning (15 s), forwarding, disabled; RSTP collapses these to discarding, learning, forwarding.

PortFast skips listening and learning on access ports; BPDU Guard err-disables a PortFast port that receives a BPDU; Root Guard rejects superior BPDUs.

EtherChannel members must match speed, duplex, and VLANs; LACP (802.3ad) is standards-based, PAgP is Cisco proprietary, and static on-mode uses no negotiation.

CAPWAP tunnels use UDP 5246 for control and UDP 5247 for data; AP modes include local, FlexConnect, monitor, sniffer, and rogue detector.

Route selection order: longest prefix match first, then lowest administrative distance, then lowest metric.

Default administrative distances: connected 0, static 1, EIGRP 90, OSPF 110, RIP 120.

Static route syntax: ip route [distance]; a static with a distance above the dynamic route is a floating static.

OSPF cost = reference bandwidth (default 100 Mbps) divided by interface bandwidth, so a 10 Mbps link costs 10 and a 100 Mbps link costs 1.

OSPF neighbor states in order: Down, Init, 2-Way, ExStart, Exchange, Loading, Full; mismatched area, subnet, or timers prevents reaching Full.

OSPF DR and BDR are elected by highest interface priority (default 1), then highest router ID; priority 0 excludes an interface from the election.

EIGRP uses a composite metric of bandwidth and delay by default; a feasible successor is a loop-free backup route held in the topology table.

FHRP options: HSRP (Cisco, virtual MAC 0000.0c07.acXX), VRRP (standards-based, MAC 0000.5e00.01XX), GLBP (Cisco, load balancing).

Router-on-a-stick: the physical interface has no IP, and subinterfaces use encapsulation dot1q plus an IP that serves as that VLAN's gateway.

DHCP uses DORA (Discover, Offer, Request, Acknowledge); server UDP 67, client UDP 68; ip helper-address forwards requests across subnets.

NAT terms: inside local (private host address), inside global (public translated address), outside local, outside global; PAT shares one address using ports.

NTP uses UDP 123; stratum 1 syncs to a reference clock, each hop adds one, valid range is 0-15, and 16 means unsynchronized.

Syslog severity: 0 emergency, 1 alert, 2 critical, 3 error, 4 warning, 5 notice, 6 informational, 7 debug; lower numbers are more severe.

SNMP manager polls agents on UDP 161 and traps go to UDP 162; SNMPv3 adds authentication (MD5/SHA) and encryption (DES/AES).

HSRP is Cisco proprietary with default priority 100 and preemption disabled; VRRP is standards-based with priority 100 and preemption enabled.

QoS marking: DSCP uses the top 6 bits of the ToS byte (0-63); EF 46 is for voice, AF41 for video, and CS0 is default best effort.

Telnet uses TCP 23 in clear text while SSH uses TCP 22 encrypted; DNS queries use UDP 53 and zone transfers use TCP 53.

CDP is Cisco proprietary and enabled by default; LLDP is IEEE 802.1AB and disabled by default; both operate at Layer 2.

AAA components: authentication (who you are), authorization (what you may do), accounting (what you did); TACACS+ uses TCP 49, RADIUS uses UDP 1812/1813.

Standard ACLs (1-99, 1300-1999) match source only and are placed near the destination; extended ACLs (100-199, 2000-2699) match protocol, source, destination, and port and go near the source.

Every ACL ends with an implicit deny any; in a wildcard, 0 means match the bit and 255 means ignore it (the inverse of the subnet mask).

Port security learns MAC addresses and violation modes are protect (drop), restrict (drop plus log and counter), and shutdown (err-disable).

DHCP snooping marks uplinks trusted, rate-limits DHCP on untrusted ports, and builds a MAC/IP/VLAN/port binding table used by Dynamic ARP Inspection.

802.1X roles: supplicant (client), authenticator (switch), authentication server (RADIUS); EAP frames travel in EAPoL between client and switch.

service password-encryption uses reversible type 7; enable secret uses type 5 MD5 or stronger type 8/9 hashes.

IPsec: AH (protocol 51) authenticates but does not encrypt; ESP (protocol 50) provides confidentiality; IKE negotiates SAs over UDP 500.

Router SSH requires a hostname and domain name, crypto key generate rsa with a 2048-bit modulus, and transport input ssh on the vty lines.

SDN separates the control plane (centralized controller) from the data plane (devices forwarding traffic); the controller programs forwarding tables.

Northbound APIs face applications (typically REST with JSON); southbound APIs face devices (OpenFlow, NETCONF, RESTCONF, CLI).

Cisco SDN platforms: DNA Center for campus, ACI for data center, SD-WAN (vManage) for WAN; each is an intent-based controller.

REST verbs: GET reads, POST creates, PUT replaces, PATCH partially updates, DELETE removes; 2xx is success, 4xx is client error, 5xx is server error.

Data formats: JSON (key-value pairs in braces, native to REST), XML (tags, used by NETCONF), YAML (indentation, used by Ansible).

Ansible is agentless over SSH using YAML playbooks; Puppet and Chef use agents; Terraform is declarative and uses HCL.

NETCONF runs XML over SSH on TCP 830; RESTCONF runs over HTTP/HTTPS with JSON or XML; both use YANG data models.

Imperative tooling lists each step to run; declarative tooling states the desired end state, and idempotent tools converge to the same result when rerun.

Model-driven telemetry streams data to a collector instead of polling with SNMP, giving near-real-time monitoring.