Network Access

2.0 Network Access Overview

Weight: 20% (CCNA 200-301 exam mein) Focus: Layer 2 operations - Switching, VLANs, Wireless

2.1 VLANs (Virtual LANs) - Complete Detail

VLAN Kya Hai?

Simple Definition: Ek physical switch ko multiple logical networks mein divide karna

Real World Example: Ek office building mein:

• 1st Floor: Sales team

• 2nd Floor: HR team

• 3rd Floor: IT team

Physically sab same switch se connected hain, lekin logically alag networks hain.

VLAN Benefits

1. Security: Sales team HR ke data access nahi kar sakta

2. Broadcast Control: Sales ki broadcast HR tak nahi jaegi

3. Flexibility: Physically kahan bhi ho, logically same team mein ho

4. Cost Effective: Har department ke liye alag switch nahi chahiye

VLAN Types Detail

Access VLAN

Kya hai: Normal end devices ke liye (PC, laptop, printer) Characteristic: Sirf 1 VLAN ka member hota
hai

Example Configuration:

cisco

Switch(config)# vlan 10

Switch(config-vlan)# name Sales_Department

Switch(config-vlan)# exit

Switch(config)# interface fastethernet 0/1

Switch(config-if)# switchport mode access

Switch(config-if)# switchport access vlan 10

Voice VLAN
Kya hai: IP phones ke liye special VLAN Kyu chahiye: Voice traffic ko priority dena Benefit: Call quality
better hoti hai

Example:

cisco

Switch(config)# interface fa0/1

Switch(config-if)# switchport mode access

Switch(config-if)# switchport access vlan 10 # PC ke liye

Switch(config-if)# switchport voice vlan 20 # Phone ke liye

Default VLAN

Kya hai: VLAN 1 - by default sab ports ismein hote hain Problem: Security issue hai (sab devices ek hi
VLAN mein) Solution: Default VLAN change karna

Management VLAN

Kya hai: Switch ko remotely manage karne ke liye Example: VLAN 99 management ke liye use karna

Configuration:

cisco

Switch(config)# vlan 99

Switch(config-vlan)# name Management

Switch(config-vlan)# exit

Switch(config)# interface vlan 99

Switch(config-if)# ip address [Link] [Link]

Switch(config-if)# no shutdown

Inter-VLAN Routing

Problem: Do alag VLANs ek dusre se communicate nahi kar sakte Solution: Router ya Layer 3 switch
chahiye

Router-on-a-Stick Method

Concept: Ek router interface pe multiple sub-interfaces banana

Example:

cisco

Router(config)# interface fastethernet 0/1.10

Router(config-subif)# encapsulation dot1q 10

Router(config-subif)# ip address [Link] [Link]

Router(config)# interface fastethernet 0/1.20

Router(config-subif)# encapsulation dot1q 20

Router(config-subif)# ip address [Link] [Link]

Layer 3 Switch Method

Concept: Switch mein routing capability hoti hai

Example:

cisco

Switch(config)# ip routing

Switch(config)# interface vlan 10

Switch(config-if)# ip address [Link] [Link]

Switch(config-if)# no shutdown

Switch(config)# interface vlan 20

Switch(config-if)# ip address [Link] [Link]

Switch(config-if)# no shutdown

2.2 Interswitch Connectivity - Trunking

Trunk Port Kya Hai?

Definition: Ek port jo multiple VLANs ka traffic carry kar sakta hai Use Case: Do switches ko connect
karne ke liye

802.1Q VLAN Tagging

Concept: Har frame mein VLAN tag add karna Process:

1. Frame switch mein aata hai

2. Switch VLAN tag add karta hai

3. Frame trunk port se jaata hai

4. Destination switch tag dekh kar VLAN decide karta hai

Frame Structure:

[Destination MAC][Source MAC][VLAN Tag][Type][Data][FCS]

Native VLAN

Kya hai: Wo VLAN jiska traffic bina tag ke jaata hai Default: VLAN 1 Security Issue: Attackers exploit
kar sakte hain Best Practice: Native VLAN change karna
Configuration:

cisco

Switch(config)# interface fastethernet 0/24

Switch(config-if)# switchport mode trunk

Switch(config-if)# switchport trunk native vlan 99

Switch(config-if)# switchport trunk allowed vlan 10,20,30

DTP (Dynamic Trunking Protocol)

Kya hai: Automatically trunk negotiate karna Modes:

• Dynamic Auto: Passive mode

• Dynamic Desirable: Active mode

• Trunk: Force trunk mode

• Access: Force access mode

Best Practice: Manual trunk configuration karna

2.3 Layer 2 Discovery Protocols

CDP (Cisco Discovery Protocol)

Kya hai: Cisco devices ki information share karna Information Shared:

• Device name

• IP address

• Platform type

• Software version

• Port information

Commands:

cisco

Switch# show cdp neighbors

Switch# show cdp neighbors detail

Switch# show cdp interface

Switch(config)# cdp run # Enable CDP

Switch(config)# no cdp run # Disable CDP

Switch(config-if)# cdp enable # Enable on interface

Switch(config-if)# no cdp enable # Disable on interface

LLDP (Link Layer Discovery Protocol)

Kya hai: Industry standard discovery protocol Advantage: Vendor independent (Cisco, HP, Juniper sab
use kar sakte hain)

Commands:

cisco

Switch(config)# lldp run # Enable LLDP globally

Switch(config-if)# lldp transmit # Send LLDP frames

Switch(config-if)# lldp receive # Receive LLDP frames

Switch# show lldp neighbors

Switch# show lldp neighbors detail

Security Note: Production mein discovery protocols disable karna better hai

2.4 EtherChannel - Link Aggregation

Concept

Kya hai: Multiple physical links ko 1 logical link banana Benefits:

• Bandwidth: 2 links = 2x speed

• Redundancy: Ek link fail ho toh doosra kaam karta hai

• Load Distribution: Traffic dono links mein distribute hota hai

EtherChannel Protocols

PAgP (Port Aggregation Protocol)

Type: Cisco proprietary Modes:

• Auto: Passive (wait for negotiation)

• Desirable: Active (start negotiation)

• On: Force channel without negotiation

LACP (Link Aggregation Control Protocol)

Type: IEEE 802.3ad standard Modes:

• Passive: Wait for negotiation

• Active: Start negotiation

• On: Force channel without negotiation

Configuration Examples

LACP Configuration:
cisco

Switch1(config)# interface range fastethernet 0/1 - 2

Switch1(config-if-range)# channel-group 1 mode active

Switch1(config-if-range)# exit

Switch1(config)# interface port-channel 1

Switch1(config-if)# switchport mode trunk

Switch1(config-if)# switchport trunk allowed vlan 10,20,30

PAgP Configuration:

cisco

Switch1(config)# interface range fastethernet 0/3 - 4

Switch1(config-if-range)# channel-group 2 mode desirable

Switch1(config-if-range)# exit

Switch1(config)# interface port-channel 2

Switch1(config-if)# switchport mode access

Switch1(config-if)# switchport access vlan 10

Verification Commands:

cisco

Switch# show etherchannel summary

Switch# show etherchannel detail

Switch# show etherchannel load-balance

Switch# show interface port-channel 1

Load Balancing Methods

Available Options:

• src-ip: Source IP based

• dst-ip: Destination IP based

• src-dst-ip: Source + Destination IP

• src-mac: Source MAC based

• dst-mac: Destination MAC based

Configuration:
cisco

Switch(config)# port-channel load-balance src-dst-ip

2.5 Spanning Tree Protocol (STP)

Problem - Layer 2 Loops

Scenario: Redundant links between switches Problem: Broadcast storms, MAC table instability
Solution: STP loops ko detect aur prevent karta hai

STP Working Process

1. Root Bridge Election: Lowest Bridge ID becomes root

2. Root Port Selection: Best path to root bridge

3. Designated Port Selection: Best port on each segment

4. Blocking Redundant Paths: Loop prevention

STP Timers

Hello Timer: 2 seconds (BPDU send karna) Forward Delay: 15 seconds (Learning/Listening state) Max
Age: 20 seconds (BPDU timeout)

Port States

Blocking: Data forward nahi karta, BPDUs sunata hai Listening: BPDUs process karta hai Learning:
MAC addresses learn karta hai Forwarding: Normal data forwarding Disabled: Administratively down

STP Variants

PVST+ (Per-VLAN Spanning Tree Plus)

Kya hai: Har VLAN ke liye alag STP instance Benefit: Per-VLAN load balancing

RSTP (Rapid Spanning Tree Protocol)

Kya hai: Fast convergence (3-5 seconds) Improvement: Faster recovery from failures

RPVST+ (Rapid Per-VLAN Spanning Tree Plus)

Kya hai: RSTP + Per-VLAN = Best of both

STP Configuration

cisco

Switch(config)# spanning-tree mode rapid-pvst

Switch(config)# spanning-tree vlan 10 root primary

Switch(config)# spanning-tree vlan 20 root secondary

Switch(config)# interface fastethernet 0/1

Switch(config-if)# spanning-tree portfast # Skip listening/learning

Switch(config-if)# spanning-tree bpduguard enable # Shutdown if BPDU received

STP Enhancements

PortFast

Kya hai: Access ports ko immediately forwarding state mein lana Use: End devices (PC, server) ke liye
Benefit: Boot time kam hoti hai

BPDU Guard

Kya hai: Agar PortFast port pe BPDU aaye toh port shutdown Use: Security - unauthorized switch
connection prevent karna

Root Guard

Kya hai: Prevent other switches from becoming root bridge Use: Network topology control

Loop Guard

Kya hai: Unidirectional link failure detect karna Use: Point-to-point links mein

Configuration:

cisco

Switch(config)# spanning-tree portfast default

Switch(config)# spanning-tree portfast bpduguard default

Switch(config-if)# spanning-tree guard root

Switch(config-if)# spanning-tree guard loop

2.6 Cisco Wireless Architecture

Traditional (Autonomous) vs Centralized

Autonomous APs

Kya hai: Har AP independent configuration Problem: Management complex, consistency issues Use:
Small deployments

Centralized (Controller-Based)

Kya hai: WLC (Wireless LAN Controller) sab APs ko control karta hai Benefit: Centralized
management, consistent policy Use: Enterprise deployments

CAPWAP (Control and Provisioning of Wireless Access Points)

Kya hai: AP aur WLC ke beech communication protocol Tunnels:

• Control Tunnel: Management traffic

• Data Tunnel: User traffic

AP Modes Detail

Local Mode

Kya hai: Normal AP operation Function: Data forwarding + management Use: 99% APs is mode mein
hote hain

FlexConnect Mode

Kya hai: Branch office APs with local switching Benefit: WLC connection fail ho toh bhi local traffic
chalti hai Use: Remote sites with limited WAN bandwidth

Sniffer Mode

Kya hai: Monitoring mode - capture wireless traffic Use: Troubleshooting, security analysis

Monitor Mode

Kya hai: Rogue AP detection Function: Scan all channels for unauthorized APs Use: Security
monitoring

Rogue Detector

Kya hai: Wired connection se rogue APs detect karna Use: Enhanced security

Bridge Mode

Kya hai: Point-to-point wireless connection Use: Building-to-building connectivity

WLC Deployment Models

Centralized

Kya hai: Ek central location mein WLC Benefit: Easy management Use: Campus networks

Distributed

Kya hai: Multiple WLCs in different locations Benefit: Local breakout, reduced WAN traffic Use:
Branch offices

Cloud-based

Kya hai: WLC functionality in cloud Example: Cisco Meraki, Cisco DNA Center Benefit: No hardware,
automatic updates

2.7 WLAN Physical Infrastructure

Components Detail

Access Point (AP)

Types:

• Indoor APs: Office, home use

• Outdoor APs: Weather resistant

• High-density APs: Stadiums, airports

Power Options:

• PoE (Power over Ethernet): Cable se power

• PoE+ (802.3at): More power for high-performance APs

• Local Power: Separate power adapter

Wireless LAN Controller (WLC)

Functions:

• AP management

• User authentication

• Policy enforcement

• Mobility management

Interfaces:

• Management Interface: WLC management

• AP Manager Interface: AP communication

• Virtual Interface: DHCP relay, guest access

• Service Port: Out-of-band management

Antenna Types

Omnidirectional: 360° coverage Directional: Focused coverage Patch: Wall-mounted, directional

Yagi: Long-range, highly directional

Port Configurations

Access Port for AP

cisco

Switch(config)# interface fastethernet 0/1

Switch(config-if)# switchport mode access

Switch(config-if)# switchport access vlan 10

Switch(config-if)# power inline auto # PoE enable

Switch(config-if)# spanning-tree portfast

Trunk Port for WLC

cisco

Switch(config)# interface fastethernet 0/24

Switch(config-if)# switchport mode trunk

Switch(config-if)# switchport trunk allowed vlan 10,20,30

LAG (Link Aggregation Group) for WLC

Kya hai: Multiple uplinks for WLC Benefit: Bandwidth + redundancy

cisco

Switch(config)# interface range fastethernet 0/1 - 2

Switch(config-if-range)# channel-group 1 mode active

Switch(config)# interface port-channel 1

Switch(config-if)# switchport mode trunk

2.8 Network Device Management Access

Management Methods Comparison

Method Security Use Case Pros Cons

Console High Initial setup Physical access required Only local access

Telnet None Legacy Simple Plain text passwords

SSH Encrypted Remote management Secure Requires configuration

HTTP Basic Web GUI Easy to use Not secure

HTTPS Encrypted Secure web GUI Secure + Easy Certificate management

SSH Configuration

cisco

Switch(config)# ip domain-name [Link]

Switch(config)# crypto key generate rsa general-keys modulus 1024

Switch(config)# username admin privilege 15 secret cisco123

Switch(config)# line vty 0 4

Switch(config-line)# login local

Switch(config-line)# transport input ssh

Switch(config-line)# exit

Switch(config)# ip ssh version 2

AAA (Authentication, Authorization, Accounting)

Local Authentication

cisco

Switch(config)# username admin privilege 15 secret cisco123

Switch(config)# line vty 0 4

Switch(config-line)# login local

TACACS+ Configuration

cisco

Switch(config)# tacacs-server host [Link]

Switch(config)# tacacs-server key secret123

Switch(config)# aaa new-model

Switch(config)# aaa authentication login default group tacacs+ local

RADIUS Configuration

cisco

Switch(config)# radius-server host [Link]

Switch(config)# radius-server key secret123

Switch(config)# aaa new-model

Switch(config)# aaa authentication login default group radius local

Cloud Management

Cisco Meraki:

• Cloud-based management

• Zero-touch deployment

• Automatic updates

• Centralized monitoring

Benefits:

• No on-premise controller

• Easy scaling

• Automatic security updates

• Rich analytics

2.9 Wireless LAN GUI Configuration

WLC GUI Navigation

URL: [Link] Default Login: admin/admin

Basic WLAN Configuration Steps

Step 1: Create WLAN

WLANs → Create New → Go

- Type: WLAN

- WLAN ID: 1

- Profile Name: Corporate_WiFi

- SSID: Corporate_WiFi

Step 2: Security Configuration

Security → Layer 2

- Security: WPA2 Enterprise

- Authentication: 802.1X

- Encryption: AES

Step 3: RADIUS Server

Security → AAA Servers

- Server IP: [Link]

- Shared Secret: radius123

- Port: 1812

Step 4: Advanced Settings

Advanced → Allow AAA Override: Enable

QoS → Quality of Service: Bronze/Silver/Gold

Guest Access Configuration

Purpose: Temporary internet access for visitors

Steps:

1. Create Guest WLAN

2. Configure Web Authentication

3. Set time restrictions

4. Enable bandwidth limits

QoS Profiles

Platinum: Voice traffic (highest priority) Gold: Video traffic Silver: Important data Bronze: Best effort
(lowest priority)

Practice Tools aur Platforms

1. Cisco Packet Tracer (Free)

Download: [Link] Features:

• Complete network simulation

• Switch, router, wireless devices

• Real Cisco IOS commands

• Lab exercises built-in

Best For:

• CCNA preparation

• Basic to intermediate labs

• Home practice

2. GNS3 (Free)

Download: [Link] Features:

• Real IOS images

• Advanced features

• Integration with VirtualBox/VMware

• Professional-grade simulation

Best For:

• Advanced labs

• Real-world scenarios

• Professional training

3. EVE-NG (Free/Paid)

Website: [Link] Features:

• Web-based interface

• Multiple vendor support

• Collaborative labs

• Professional deployment

Best For:

• Multi-vendor environments

• Team collaboration

• Professional training

4. Cisco CML (Paid)

Website: [Link] Features:

 • Official Cisco simulator

• Latest IOS versions

• Cloud-based

• Professional support

Best For:

• Enterprise training

• Latest features

• Official certification

5. Physical Hardware

Switches: Cisco 2960, 3560, 3650 Routers: Cisco 1841, 2811, 4321 Wireless: Cisco 2702i, 3702i APs +
WLC

Best For:

• Hands-on experience

• Real-world troubleshooting

• Professional development

Practice Lab Scenarios

Lab 1: Basic VLAN Configuration

Scenario:

• 1 switch

• 3 VLANs (Sales, HR, IT)

• Test inter-VLAN communication

Lab 2: Trunk Configuration

Scenario:

• 2 switches

• Multiple VLANs

• Trunk between switches

Lab 3: EtherChannel Implementation

Scenario:

• 2 switches

• 2-link EtherChannel
 • Load balancing test

Lab 4: STP Configuration

Scenario:

• 3 switches in triangle

• Root bridge election

• PortFast configuration

Lab 5: Wireless Basic Setup

Scenario:

• 1 WLC

• 2 APs

• Basic WLAN configuration

Quick Commands Reference

VLAN Commands

cisco

show vlan brief

show vlan id 10

show interfaces switchport

show interfaces trunk

STP Commands

cisco

show spanning-tree

show spanning-tree vlan 10

show spanning-tree interface fa0/1

show spanning-tree root

EtherChannel Commands

cisco

show etherchannel summary

show etherchannel detail

show etherchannel load-balance

Wireless Commands
cisco

show wlan summary

show ap summary

show client summary

show mobility summary

Exam Tips

1. VLANs: Yaad rakho ke inter-VLAN routing chahiye

2. Trunking: Native VLAN security implications

3. STP: Root bridge election process

4. EtherChannel: LACP vs PAgP differences

5. Wireless: AP modes aur use cases

Is comprehensive guide mein Network Access ke sab topics detail mein covered hain. Practice tools ke
saath hands-on experience zaroori hai!
"Network Access" (CCNA ka core topic) Packet Tracer + CLI-based 12 practical labs diye gaye hain. In
labs se switch configuration, VLANs, trunking, port modes, STP, EtherChannel waghera fully practice
kar sakte ho — jaise exam + real network mein hota hai.

Network Access – 12 Labs (CCNA Level, Realistic, Easy to Implement)

Section 1: Switching Basics

Lab 1: Basic Switch Configuration

• Assign hostname, password, banner, IP address

hostname SW1

enable secret cisco123

service password-encryption

banner motd ^Unauthorized Access Prohibited^

interface vlan 1

ip address [Link] [Link]

no shutdown

Ping from PC to switch IP

Lab 2: Configure and Verify MAC Address Table

• Connect multiple PCs to switch

• Run command:

show mac address-table

Observe how switch learns MAC addresses

Section 2: VLANs and Trunking

Lab 3: Create and Assign VLANs

• Create VLANs and assign to interfaces

vlan 10

name Students
vlan 20

name Teachers

interface fa0/1

switchport mode access

switchport access vlan 10

interface fa0/2

switchport mode access

switchport access vlan 20

Lab 4: Inter-VLAN Communication (Router-on-a-Stick)

• Router with subinterfaces

interface fa0/0.10

encapsulation dot1Q 10

ip address [Link] [Link]

Test: Ping between VLAN 10 & VLAN 20 PCs

Lab 5: Configure Trunk Ports Between Switches

interface fa0/24

switchport mode trunk

Test: VLAN 10 on Switch1 and Switch2 should talk via trunk

Section 3: Spanning Tree Protocol (STP)

Lab 6: Observe STP Port Roles

• Connect 3 switches in triangle

• Use:

show spanning-tree

Observe Root Port (RP), Designated Port (DP), Blocked Port

 Lab 7: Set STP Priority (Force Root Bridge)

spanning-tree vlan 1 priority 24576

Lower priority = higher chance of being root

Section 4: EtherChannel / Link Aggregation

Lab 8: Configure Static EtherChannel Between Two Switches

interface range fa0/1 - 2

channel-group 1 mode on

interface port-channel 1

switchport mode trunk

Two links act as one logical trunk link

Section 5: Port Modes, Violation & Misc

Lab 9: Access vs Trunk Mode Demo

• Assign one port as access, other as trunk

• Use:

show interfaces fa0/1 switchport

Compare modes and native VLAN

Lab 10: Native VLAN Mismatch Warning

• Make native VLAN 99 on one switch, default 1 on other

switchport trunk native vlan 99

Packet Tracer shows warning icon on link

Section 6: Port Security

Lab 11: Secure a Port with MAC Binding

interface fa0/1

switchport port-security

switchport port-security mac-address sticky

switchport port-security maximum 1

switchport port-security violation shutdown

Try using another PC on same port — it shuts down

Lab 12: Enable BPDU Guard (Layer 2 Attack Prevention)

interface fa0/5

spanning-tree bpduguard enable

Connect switch to access port → port goes into err-disabled mode

Tools Needed:

Tool Use

Cisco Packet Tracer All switching, VLAN, STP, security

CLI Practice Basic IOS commands

Wireshark (optional) STP BPDU packet analysis (advanced)

Bonus Deliverables:

Agar chaho to main:

• All 12 labs ki .pkt files

• Lab sheets (PDFs for submission)

• CLI command cheat sheet

• Quiz questions from Network Access section

bhi provide kar sakta hoon.