NETWORK INFRASTRUCTURE ESSENTIALS
Q U I C K - S TA R T G U I D E : S W I TC H I N G , R O U T I N G & F I R E WA L L M A N AG E M E N T
This document serves as an essential start-up reference for engineers setting up localized or enterprise network
topologies. It covers Layer 2 switching fundamentals, Layer 3 IP routing architectures, and Layer 4-7 stateful
firewall setup guidelines.
1. LAYER 2 SWITCHING ESSENTIALS
Switches operate at the Data Link Layer (Layer 2) and use MAC address tables to forward frames within a single
Local Area Network (LAN). Clean switching design limits broadcast domains and ensures loop-free paths.
Core L2 Concepts Initial Switch Setup (Cisco iOS)
▪ VLANs (Virtual LANs): Logically segments a Configuration Script
physical switch into distinct broadcast domains
to isolate departmental traffic. ! Configure VLAN & IP Interface
vlan 10
▪ Trunking (802.1Q): Allows multiple VLANs to
name Users
traverse a single physical link between switches
exit
by adding a 4-byte tag to ethernet frames. interface vlan 10
▪ Spanning Tree Protocol (STP/RSTP): Prevents ip address [Link] [Link]
!
Layer 2 loops and broadcast storms by
! Set Up Access & Trunk Ports
dynamically blocking redundant links. interface GigabitEthernet0/1
switchport mode access
switchport access vlan 10
spanning-tree portfast
!
interface GigabitEthernet0/2
switchport mode trunk
switchport trunk allowed vlan 10,20
Network Infrastructure Essentials Quick-Start Guide Page 1 of 2
2. LAYER 3 ROUTING ESSENTIALS
Routers operate at the Network Layer (Layer 3). They read IP headers and refer to routing tables to forward
packets across separate subnetworks and logical boundaries, establishing WAN and internet connectivity.
Core L3 Mechanisms Basic Router & Inter-VLAN Configuration
▪ Inter-VLAN Routing: Employs a Router-on-a- Configuration Script
Stick (sub-interfaces) or a Layer 3 Switch (SVI) to
route traffic between segmented VLAN subnets. ! Router-on-a-Stick (Sub-interfaces)
interface GigabitEthernet0/0
▪ Static Routing: Manually defined path
no shutdown
destinations. Best for simple networks or single
!
gateway routes (Default Route: [Link]/0). interface GigabitEthernet0/0.10
▪ Dynamic Routing (OSPF/BGP): Routers encapsulation dot1Q 10
ip address [Link] [Link]
dynamically share topology maps. OSPF is used
!
for interior gateway networks; BGP is used for interface GigabitEthernet0/0.20
exterior/internet routing. encapsulation dot1Q 20
ip address [Link] [Link]
!
! Configure Default Static Route
ip route [Link] [Link] [Link]
3. FIREWALL HANDLING & MANAGEMENT
Firewalls police inbound, outbound, and inter-zone traffic. Modern firewalls (Next-Gen Firewalls / NGFW) perform
stateful packet inspection up to Layer 7 (Application Layer) to block advanced security threats.
Security Architecture & Zones Strategic Setup Workflow
▪ Security Zones: Segment networks into trust ▪ Step 1: Interface Mapping & IP: Assign IPs to
levels: Inside (highly trusted user LAN), Outside Outside, Inside, and DMZ interfaces.
(untrusted WAN/Internet), and DMZ (isolated ▪ Step 2: Define Default Deny: Block all traffic by
zone for public-facing servers). default and selectively permit needed services.
▪ Stateful Inspection: Monitors the state of active ▪ Step 3: Configure NAT/PAT: Map internal private
connections, automatically allowing return traffic subnets to external interface IP pools.
for established outbound sessions.
▪ Step 4: Access Control Lists (ACLs): Authorize
▪ NAT (Network Address Translation): Translates specific ports (e.g., HTTP/S, DNS) flowing from
private RFC 1918 IPs to public IPs to route LAN Inside to Outside, or outside to DMZ.
traffic to the internet.
Fundamental Best Practices
▪ Principle of Least Privilege: Permit only explicit traffic ▪ Enable Logging & Alerts: Log all drop events to catch
channels. malicious scans.
▪ Regular Rule Audits: Clean out stale or redundant ▪ Encrypt Admin Channels: Use SSH/HTTPS; disable
rules regularly. Telnet/HTTP.
Network Infrastructure Essentials Quick-Start Guide Page 2 of 2