I85PREP
⌘ K
Cisco ENNA 300-445 study materials
Cisco ENNA 300-445 study resources

Cisco ENNA 300-445: Network Access

Cisco ENNA 300-445 · Work through your exam, one topic at a time.

All guide sections

Network Access

Network Access

This domain covers how endpoints join the enterprise LAN and WLAN: VLAN segmentation, 802.1Q trunks, EtherChannel, Spanning Tree Protocol, and wireless deployment with controllers and AP modes. Questions often present a topology symptom and ask which access-layer setting is wrong.

Core rules

  • VLAN IDs are 1-4094; 1 is default, 1002-1005 reserved legacy. Normal range 1-1005, extended 1006-4094. An access port carries one VLAN untagged; a trunk carries multiple VLANs with 802.1Q tags.
  • 802.1Q inserts a 4-byte tag. The native VLAN is sent untagged; both ends must agree or CDP logs a mismatch and traffic may leak between VLANs.
  • DTP negotiates trunking; best practice is to disable it with switchport nonegotiate and configure trunks statically.
  • EtherChannel bundles links: LACP (802.3ad) uses active/passive, PAgP uses desirable/auto, and static mode on uses no negotiation. Member ports must match speed, duplex, allowed VLANs, and STP settings.
  • STP elects one root bridge per VLAN by lowest bridge ID (priority then MAC). Default priority 32768, adjusted in multiples of 4096. RSTP (802.1w) adds alternate and backup port roles; MSTP (802.1s) maps VLANs to instances.
  • Wireless: a CAPWAP AP forms a control tunnel to the WLC on UDP 5246 and data on 5247. Local mode tunnels client data to the WLC; FlexConnect can switch locally. AP modes include local, flexconnect, monitor, sniffer, rogue detector, and bridge.

Worked example

VLAN 10 works across a trunk but VLAN 20 fails. Check show interfaces trunk: if VLAN 20 is not in the allowed list, add it with switchport trunk allowed vlan add 20. If allowed, compare native VLANs on both ends and check that VLAN 20 exists in the VLAN database. On a WLC, also verify the dynamic interface is mapped to the correct VLAN and the WLAN is enabled.

Traps

  • Assuming a trunk passes all VLANs after creation; the allowed list can filter it.
  • Forgetting that native VLAN mismatch does not always block VLAN 1, so testing only VLAN 1 hides the fault.
  • Treating EtherChannel as active/active at Layer 2 without STP or a bundle; a misconfigured member is suspended.
  • Confusing AP mode with WLAN security policy.