Network Access
VLANs and trunks
Access ports carry one VLAN; trunk ports carry many using 802.1Q tags. The native VLAN is sent untagged, so both ends must agree - a native VLAN mismatch shows up in CDP/LLDP output and is a classic exam scenario. The allowed VLAN list defaults to all VLANs. Inter-VLAN routing requires a Layer 3 interface: router-on-a-stick subinterfaces or switch SVIs with ip routing enabled.
Spanning Tree
802.1D and 802.1w elect one root bridge using the lowest bridge ID (priority, then MAC; default priority 32768). Root path cost decides which ports forward, then lowest sender bridge ID, then lowest port ID. Legacy states: blocking, listening (15 s), learning (15 s), forwarding. RSTP collapses these to discarding, learning, forwarding. All ports on the root bridge are designated and forwarding. Know PortFast (access ports only) and BPDU guard (err-disables a port that receives a BPDU).
EtherChannel
Bundling makes STP see one logical link. Requirements: matching speed/duplex, allowed and native VLANs, and switchport mode. LACP uses active/passive, PAgP uses desirable/auto, and static on works with neither. Mismatches such as on versus passive fail silently.
Wireless
Separate SSID (network name), BSSID (radio MAC), and BSS (one AP's cell). A WLC manages lightweight APs over CAPWAP (UDP 5246/5247). AP modes include local, FlexConnect, monitor, sniffer, SE-connect, and rogue detector.
Rule of thumb
When a trunk misbehaves, verify both ends first: same native VLAN, same allowed list, same encapsulation. Data VLANs still pass during a native VLAN mismatch - the warning appears in CDP, not as a link failure.