LCPE cheat sheet

OSI layers top-down: Application, Presentation, Session, Transport, Network, Data Link, Physical; TCP/IP model collapses the top three into Application.

PDU names per layer: data (Application), segment (Transport), packet (Network), frame (Data Link), bits (Physical).

TCP is connection-oriented with a 3-way handshake (SYN, SYN-ACK, ACK), sequencing, and retransmission; UDP is connectionless with no delivery guarantee.

Well-known ports: FTP 20/21, SSH 22, Telnet 23, SMTP 25, DNS 53, DHCP 67/68, HTTP 80, HTTPS 443.

Private IPv4 ranges: 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16; 169.254.0.0/16 is link-local (APIPA).

IPv6 address types: global unicast 2000::/3, link-local fe80::/10, unique local fc00::/7, multicast ff00::/8; no broadcast exists.

Ethernet cabling: Cat5e/Cat6 UTP max 100 m; fiber (single-mode long haul, multimode short haul) is immune to EMI.

Cisco three-tier design: access (endpoint attachment), distribution (policy/routing), core (high-speed transit); collapsed core merges distribution and core.

VLAN ID range is 1-4094; 1 and 1002-1005 are default/reserved; VLAN 1 is the default native VLAN on 802.1Q trunks.

Access port carries one VLAN and is untagged; trunk port carries multiple VLANs with 802.1Q tags and a native VLAN sent untagged.

DTP modes: dynamic auto, dynamic desirable, trunk, access, nonegotiate; both sides auto results in access, not trunk.

STP port states: blocking, listening (15 s), learning (15 s), forwarding; 802.1w RSTP uses discarding, learning, forwarding.

STP election: lowest bridge ID wins (priority then MAC); default priority 32768; per-VLAN root can be tuned with priority values in 4096 increments.

EtherChannel rules: matching speed, duplex, allowed VLANs, and trunk/access mode; LACP is standards-based (mode active/passive), PAgP is Cisco (desirable/auto).

Port security: max MAC addresses, violation actions protect (drop, no log), restrict (drop and log), shutdown (err-disable).

Wireless: 2.4 GHz has 3 non-overlapping channels (1, 6, 11); 5 GHz has many more; WPA2 uses AES-CCMP, WPA3 uses SAE.

Longest prefix match wins routing lookup; if no match, packet is dropped (or default route 0.0.0.0/0 used if present).

Administrative distances: connected 0, static 1, eBGP 20, EIGRP 90, OSPF 110, RIP 120; lower AD wins between protocols.

Static route syntax: ip route <next-hop|exit-interface> [distance]; floating static uses AD above the dynamic protocol.

OSPF: link-state, AD 110, default hello 10 s on broadcast, dead 40 s; neighbors must match area, hello/dead timers, MTU, authentication.

OSPF DR/BDR election: highest interface priority wins, then highest router ID; priority 0 means never DR; DR/BDR used on multiaccess segments.

EIGRP: advanced distance-vector, AD 90, uses composite metric (bandwidth, delay by default); feasible successor provides backup via feasibility condition.

Router-on-a-stick uses subinterfaces with encapsulation dot1q ; Layer 3 switch uses switched virtual interfaces (SVI) for inter-VLAN routing.

First-hop redundancy: HSRP (Cisco, virtual MAC 0000.0c07.acXX), VRRP (standards-based, virtual MAC 0000.5e00.01XX), GLBP (Cisco, load balancing).

DHCP DORA: Discover, Offer, Request, Acknowledge; client uses UDP 68, server UDP 67; relay agent (ip helper-address) forwards across subnets.

DHCP lease states include bound, renewing (T1 = 50% of lease), rebinding (T2 = 87.5%), and expired.

NAT terms: inside local (private source), inside global (translated public), outside global (external address); PAT multiplexes using source ports.

Static NAT is one-to-one; dynamic NAT uses a pool; PAT (overload) maps many inside hosts to one public address.

NTP uses UDP 123; stratum 0 is reference clock, stratum 1 directly attached; lower stratum is preferred, and NTP is unauthenticated unless configured.

Syslog severity 0 (emergency) to 7 (debugging); default logging level is informational (6); lower number = higher severity.

QoS markings: CoS is 3-bit Layer 2; DSCP is 6-bit Layer 3; IP precedence is 3-bit legacy; EF (46) is used for voice.

SNMP: manager polls agent on UDP 161; traps sent to manager on UDP 162; SNMPv3 adds authentication and encryption.

AAA components: authentication (identity), authorization (permissions), accounting (logging); RADIUS and TACACS+ are common servers, TACACS+ uses TCP 49 and encrypts the full payload.

Standard ACL matches source only and should be placed near the destination; extended ACL matches source, destination, protocol, and ports and is placed near the source.

ACL wildcard mask is the inverse of the subnet mask; implicit deny any at the end of every ACL; apply with ip access-group in|out.

Port security violation modes: protect, restrict, shutdown; err-disabled port recovery uses shutdown then no shutdown.

DHCP snooping blocks rogue DHCP servers; trusted ports face the legitimate server; combine with dynamic ARP inspection and IP source guard.

Layer 2 attacks: MAC flooding (CAM table overflow), VLAN hopping (switch spoofing, double tagging), STP manipulation; mitigations include port security, native VLAN change, BPDU Guard.

VPN types: site-to-site IPsec, remote-access IPsec/SSL; IPsec protocols AH (integrity only) and ESP (encryption and integrity).

Device hardening: SSH instead of Telnet, enable secret (hashed) over enable password, exec-timeout, banner, disable unused ports, and service password-encryption.

Northbound APIs face the management/orchestration layer (REST, NETCONF); southbound APIs face the device (CLI, SNMP, NETCONF, RESTCONF).

REST constraints: stateless, client-server, cacheable, uniform interface; CRUD maps to POST (create), GET (read), PUT/PATCH (update), DELETE (delete).

HTTP status codes: 200 OK, 201 Created, 400 Bad Request, 401 Unauthorized, 404 Not Found, 500 Server Error.

Data formats: JSON uses key-value pairs and braces; XML uses tags; YAML uses indentation; JSON is the common REST payload.

Configuration management tools: Ansible (agentless, YAML playbooks, SSH), Puppet (agent-based, manifests), Chef (agent-based, recipes/cookbooks).

SDN architecture separates control plane (decision) from data plane (forwarding); the controller programs devices via southbound protocols such as OpenFlow.

NETCONF uses SSH transport and XML data; RESTCONF uses HTTPS and supports JSON or XML; YANG models the data structure.

Infrastructure as Code benefits include repeatability, version control, and reduced configuration drift; idempotency means reapplying yields the same state.