CCNA 200-301: Network Access (20%) — CHEAT SHEET

QUICK CUES → ANSWERS

What is my port doing?

Access port → untagged traffic only, single VLAN Trunk port → tagged traffic (802.1Q), all VLANs (or allowed list) Native VLAN → untagged on trunk; must match both sides or VLAN hopping risk

How do I make two switches talk?

DTP negotiation → auto/desirable (trunking), access/nonegotiate (not trunking) Manual trunk: switchport mode trunk + switchport trunk allowed vlan [list] Manual access: switchport mode access + switchport access vlan [N]

Spanning Tree won't converge or root is wrong?

Check BID = bridge priority (default 32768) + VLAN MAC

Lowest BID = root bridge

Port roles: Root > Designated > Blocked

Port states: Disabled → Listening (15s) → Learning (15s) → Forwarding (or Blocking)

Enable PortFast on access ports (skip Listening/Learning)

BPDU Guard disables port if BPDU received (prevent rogue bridge)

EtherChannel won't form?

All member ports must match:

Speed (Mbps)

Duplex (full/half)

Allowed VLAN list (trunks)

VLAN (access ports)

Protocol mode (LACP/PAgP)

Load balancing = per flow (src/dst MAC, IP, port — not per packet)

Inter-VLAN traffic stuck?

Router-on-a-stick: subinterfaces (e.g., Gi0/0.10, .20) with encapsulation dot1q Layer 3 SVI: interface vlan 10 + ip address; requires routing enabled Check: both sides of trunk have matching native VLAN

Discovery protocol talking too much or leaking info?

|---|---|---|

---

VLAN CONFIGURATION

``! Access port → single VLAN, no tags interface Gi0/1 switchport mode access switchport access vlan 10

! Trunk port → tagged, multi-VLAN interface Gi0/1 switchport mode trunk switchport trunk native vlan 1 switchport trunk allowed vlan 1,10,20,30

! Create VLAN & assign SVI IP vlan 10 name Sales exit interface vlan 10 ip address 192.168.10.1 255.255.255.0 no shutdown`

DTP modes:

switchport mode access → never trunk

switchport mode trunk → always trunk

switchport mode dynamic desirable → actively seeks trunk (avoid for prod)

switchport mode dynamic auto → trunks if other side initiates

switchport mode nonegotiate → stops DTP negotiation

---

`SPANNING TREE PROTOCOL (STP)`

BID Election:

BID = Priority (32k chunks: 0–61440) + MAC

Lowest BID wins; tie-break by MAC

Default priority = 32768 → spanning-tree vlan 10 priority 4096

Port States & Timeline:


|-------|----------|---|---|

Port Roles:

Root Port = best path to root (lowest cost); forwards on all BPDUs

Designated = sends BPDUs on segment; designated per port per link

Blocked = non-designated; only receives BPDUs

Fast Convergence:`! PortFast: skip Listening/Learning on access ports interface Gi0/1 spanning-tree portfast

! BPDU Guard: err-disable if BPDU seen (prevent loop from rogue bridge) spanning-tree portfast bpduguard default

! Root Guard: block port if superior BPDU received interface Gi0/1 spanning-tree guard root`

Cost defaults: 10Gbps=2, 1Gbps=4, 100Mbps=19, 10Mbps=100

---

`ETHERCHANNEL`

Protocol choice:


|---|---|---|

CDP	LLDP
Scope	Cisco-only	Vendor-neutral
Frequency	60s default	30s default
Port info leaked?	Yes (devices see each other)	Yes (same)
Fix	`no cdp run` or `no cdp enable [intf]`	`no lldp run` or `no lldp transmit/receive`
State	Duration	Frame Forward?	MAC Learn?
Disabled	∞	✗	✗
Listening	15s	✗	✗
Learning	15s	✗	✓
Forwarding	∞	✓	✓
Blocking	∞	✗	✗
LACP (802.3ad)	PAgP (Cisco)
Mode	active/passive	desirable/auto
Active + Passive	✓ forms	✗ no
Desirable + Auto	—	✓ forms

Configuration (LACP):


interface range Gi0/1-4
  channel-protocol lacp
  channel-group 1 mode active

interface Port-channel 1 switchport mode trunk switchport trunk allowed vlan 1,10,20`

Verification:`show etherchannel summary show etherchannel load-balance``

Load

Network Access (20%)