Network Access
Network Access
Network Access tests Layer 2 delivery: how VLANs segment a switch, how trunks carry them, how Spanning Tree keeps loops out, how EtherChannel adds bandwidth, and how wireless clients associate through an AP and WLC.
Core rules
- Access ports belong to one VLAN and send untagged frames. Trunk ports carry many VLANs with 802.1Q tags - except the native VLAN, which stays untagged.
- 802.1Q inserts a 4-byte tag. Both ends must agree on native VLAN and allowed list, or you get CDP/LLDP mismatch logs and VLAN leakage.
- STP elects one root bridge per VLAN by lowest bridge ID: priority in 4096 steps, then MAC. Non-root switches choose one root port; each segment gets one designated port; the rest block.
- EtherChannel bundles up to 8 links. Members must match speed, duplex, and VLAN/trunk configuration, and use one protocol (LACP active/passive, PAgP, or on).
- A WLC manages lightweight APs over CAPWAP (UDP 5246 control, 5247 data). AP modes include local, flexconnect, monitor, and sniffer.
Worked example
SW1: priority 32768, MAC 0000.0c00.1111. SW2: priority 32768, MAC 0000.0c00.2222. SW3: priority 4096, MAC 0000.0c00.3333. Priority is compared first, so SW3 is root despite the highest MAC. On SW1 and SW2 the port toward SW3 becomes the root port; the SW1–SW2 link has one designated end and one blocking end.
Traps
Counting STP priority in steps of 1 instead of 4096; forgetting a native VLAN mismatch is untagged, silently merging two VLANs; enabling port security on a trunk; and assuming a WLC always forwards client traffic locally - with flexconnect it can switch at the AP.