🌐 CCNA Study Notes

OSI & TCP/IP Models

OSI & TCP/IP Models

OSI Model — 7 Layers

TCP/IP Model (4 Layers)

TCP vs UDP

Well-Known Port Numbers

Data Encapsulation

As data moves down the OSI stack, headers (and trailers at L2) are added at each layer — this is called encapsulation. Going up the stack, headers are removed — called de-encapsulation.

Application Data
→ + TCP/UDP Header = Segment
→ + IP Header      = Packet
→ + L2 Header+Trailer = Frame
→ + Physical encoding = Bits

Network Topologies & Media

Network Topologies & Media

Network Topologies

Ethernet Cable Types

Fiber Optic

Cable Pinouts

• Straight-through: Connects different device types (PC → switch, router → switch). Both ends T568A/A or T568B/B.
• Crossover: Connects same device types (switch → switch, PC → PC). One end T568A, other T568B.
• Rollover (Console): PC COM port to router/switch console port. Completely reversed pinout.

Wireless Standards (IEEE 802.11)

Network Devices

Network Devices

Layer 1 — Physical Devices

• Hub: Repeats signal to all ports (broadcasts). Creates one collision domain. Legacy; no longer used.
• Repeater: Regenerates signal to extend cable length.
• Modem: Modulates/demodulates signal for transmission over telephone/cable lines.

Layer 2 — Data Link Devices

• Switch: Learns MAC addresses, forwards frames to correct port. Each port = separate collision domain. Creates one broadcast domain per VLAN.
• Bridge: Connects two LAN segments at Layer 2. Software-based MAC learning. Predecessor to switch.
• Wireless Access Point (AP): Connects wireless clients to wired network at Layer 2.

Layer 3 — Network Devices

• Router: Routes packets between networks using IP addressing. Separates broadcast domains. Uses routing tables.
• Layer 3 Switch: Performs both switching and routing. Faster than routers for inter-VLAN routing in LAN.
• Multilayer Switch: Switch with routing capabilities. Common in enterprise distribution/core layers.

Other Network Devices

Collision Domains vs Broadcast Domains

CDP & LLDP

CDP & LLDP

CDP — Cisco Discovery Protocol

Cisco-proprietary Layer 2 protocol. Discovers directly connected Cisco devices. Sends multicast every 60 seconds.

R1# show cdp neighbors             ! Brief neighbor summary
R1# show cdp neighbors detail      ! Full info (IOS version, IP, etc.)
R1# show cdp interface             ! CDP status per interface

R1(config)# no cdp run             ! Disable globally (security)
R1(config-if)# no cdp enable       ! Disable on interface

LLDP — Link Layer Discovery Protocol

IEEE 802.1AB standard. Vendor-neutral replacement for CDP. Sends every 30 seconds.

R1(config)# lldp run               ! Enable LLDP globally
R1(config-if)# lldp transmit       ! Enable TX on interface
R1(config-if)# lldp receive        ! Enable RX on interface
R1(config-if)# no lldp transmit    ! Disable TX

R1# show lldp neighbors
R1# show lldp neighbors detail

Troubleshooting

Network Troubleshooting

Troubleshooting Methodology

1. Define the problem — gather symptoms, affected users/systems
2. Gather information — logs, show commands, topology
3. Analyze information — compare baseline vs. current state
4. Eliminate possible causes — rule out options systematically
5. Propose hypothesis — most likely cause
6. Test hypothesis — implement solution in test/change window
7. Solve the problem — implement fix
8. Document solution — update records

Troubleshooting Approaches

• Top-down: Start at Application layer, work down. Good for application-specific issues.
• Bottom-up: Start at Physical layer, work up. Good for connectivity issues.
• Divide and conquer: Start at middle (Network layer), work up or down based on results.
• Follow the path: Trace packet route from source to destination.
• Spot the differences: Compare working vs. non-working configurations.

Key Troubleshooting Commands

! Connectivity
ping 8.8.8.8                    ! Basic ping
ping 8.8.8.8 repeat 100 size 1472  ! Extended ping
traceroute 8.8.8.8               ! Path discovery
traceroute 8.8.8.8 source gi0/0  ! Source-based traceroute

! Routing
show ip route
show ip route 192.168.1.0
show ip protocols
show ip ospf neighbor
show ip eigrp neighbors
show ip bgp summary

! Interfaces
show interfaces
show interfaces gi0/0
show interfaces status           ! Switch
show ip interface brief
show ip interface gi0/0

! Layer 2
show mac address-table
show spanning-tree
show vlan brief
show interfaces trunk
show cdp neighbors detail

! System
show version
show running-config
show startup-config
show processes cpu
show memory

Common Issues & Solutions

IOS Debugging

debug ip packet                  ! Layer 3 packets (high overhead!)
debug ip routing                 ! Routing table changes
debug ip ospf events             ! OSPF events
debug ip dhcp server events      ! DHCP events
undebug all                      ! Stop all debugging
terminal monitor                 ! See debug output in SSH session

Wireless Architecture

Wireless LAN Architecture

Wireless Deployment Models

WLC — Wireless LAN Controller

• Centrally manages lightweight APs
• RF management (power, channel selection)
• Roaming management (client seamlessly moves between APs)
• Security policy enforcement
• FlexConnect: AP can locally switch traffic when WLC is unreachable

CAPWAP

Control And Provisioning of Wireless Access Points. Replaces LWAPP.

• Control channel: UDP 5246 (DTLS encrypted)
• Data channel: UDP 5247
• Local mode: All traffic tunneled to WLC
• FlexConnect: Local switching when tunnel is down

Wireless Channels

Wireless Roaming

• Layer 2 Roaming: Client moves between APs in same subnet/WLC. IP address stays same.
• Layer 3 Roaming: Client moves between different subnets. May get new IP or use mobility anchor to keep old IP.
• Fast Roaming (802.11r): Pre-authenticates to target AP before disconnecting from current. Sub-50ms roaming for VoIP.

IOS CLI Basics

Cisco IOS CLI Basics

IOS CLI Modes

Router>                  User EXEC mode (view only)
Router# enable           Privileged EXEC mode (show commands)
Router(config)#          Global Configuration mode
Router(config-if)#       Interface Configuration
Router(config-router)#   Router Configuration
Router(config-line)#     Line Configuration
Router(config-vlan)#     VLAN Configuration

! Navigate
Router# configure terminal     (or conf t)
Router(config)# end             (back to privileged)
Router(config-if)# exit         (back one level)
Router# disable                 (back to user EXEC)

Essential CLI Shortcuts

Configuration Management

! View configs
show running-config          ! Current config (RAM)
show startup-config          ! Saved config (NVRAM)
show running-config | include ospf  ! Filter output

! Save config
copy running-config startup-config   (or write memory / wr)

! Erase config
erase startup-config
reload

! Backup to TFTP
copy running-config tftp:
copy running-config tftp://10.0.0.1/backup.cfg

! Restore from TFTP
copy tftp: running-config

Password Recovery (Router)

1. Power cycle router
2. Break sequence (Ctrl+Break) during boot = ROMMON
3. rommon> confreg 0x2142   (skip startup-config on boot)
4. rommon> reset
5. Router boots with no config
6. Router> enable
7. copy startup-config running-config
8. config terminal → change passwords
9. config-register 0x2102   (restore normal boot)
10. copy running-config startup-config → reload

IOS Licensing (Older IOS)

show license feature          ! Available features
show version                  ! Current image/license
license boot module c1900 technology-package securityk9
copy running-config startup-config
reload

Common Verification Commands

show version
show ip interface brief
show interfaces
show ip route
show running-config
show startup-config
show flash:
show inventory
show processes cpu sorted
show memory statistics

IPv4 Addressing

IPv4 Addressing

IPv4 Address Structure

IPv4 address = 32 bits, written in dotted-decimal notation (4 octets × 8 bits).

192    .  168   .   1   .   100
11000000.10101000.00000001.01100100

Address Classes

Private IP Ranges (RFC 1918)

Special Addresses

• 127.0.0.1: Loopback (localhost) — tests IP stack
• 0.0.0.0: Default route / "this host on this network"
• 255.255.255.255: Limited broadcast (all hosts on local subnet)
• 169.254.x.x: APIPA (Automatic Private IP Addressing) — no DHCP found

Subnetting — CIDR Notation

CIDR (Classless Inter-Domain Routing) uses prefix length to indicate network bits.

Subnetting Formula

Number of subnets  = 2^(subnet bits)
Hosts per subnet   = 2^(host bits) - 2
Block size         = 256 - last non-255 octet of mask
Usable hosts       = total hosts - 2 (network + broadcast)

Subnetting Example

Given: 192.168.10.0/26 — find all subnets

/26 → mask = 255.255.255.192
Block size = 256 - 192 = 64

Subnet 1: 192.168.10.0   – Network
          192.168.10.1   – First Host
          192.168.10.62  – Last Host
          192.168.10.63  – Broadcast

Subnet 2: 192.168.10.64  – Network
          ...
          192.168.10.127 – Broadcast

Subnet 3: 192.168.10.128 – Network
          ...
          192.168.10.191 – Broadcast

Subnet 4: 192.168.10.192 – Network
          ...
          192.168.10.255 – Broadcast

IPv6 Addressing

IPv6 Addressing

IPv6 Overview

IPv6 uses 128-bit addresses (vs IPv4's 32-bit), providing 3.4 × 10³⁸ addresses. Written as 8 groups of 4 hex digits separated by colons.

2001:0db8:85a3:0000:0000:8a2e:0370:7334

IPv6 Compression Rules

• Rule 1: Remove leading zeros in each group: 0042 → 42
• Rule 2: Replace one or more consecutive all-zero groups with :: (can only be used once)

2001:0db8:0000:0000:0000:0000:0000:0001
→ 2001:db8::1

IPv6 Address Types

EUI-64 Interface ID

IPv6 can auto-generate the 64-bit interface ID from the MAC address:

MAC: AA:BB:CC:DD:EE:FF
1. Split in half: AA:BB:CC | DD:EE:FF
2. Insert FF:FE: AA:BB:CC:FF:FE:DD:EE:FF
3. Flip 7th bit of first byte (U/L bit): AA → A8
EUI-64 ID: A8BB:CCFF:FEDD:EEFF

IPv6 Address Configuration

NDP — Neighbor Discovery Protocol

IPv6 replacement for ARP. Uses ICMPv6 messages:

• RS (Router Solicitation): Host requests router info
• RA (Router Advertisement): Router sends prefix, gateway, flags
• NS (Neighbor Solicitation): Like ARP Request — find MAC for IP
• NA (Neighbor Advertisement): Like ARP Reply — sends MAC
• Redirect: Router tells host of better path

IPv6 Migration Techniques

• Dual Stack: Run both IPv4 and IPv6 simultaneously on same device
• Tunneling: Encapsulate IPv6 in IPv4 packets (6to4, ISATAP, Teredo)
• NAT64/DNS64: Translates between IPv6 and IPv4

VLSM & NAT

VLSM & NAT

VLSM — Variable Length Subnet Masking

VLSM allows subnets of different sizes within the same address space. Used to efficiently allocate IP addresses.

VLSM Example

Given: 192.168.1.0/24
Requirements:
  - Sales:    60 hosts  → needs /26 (62 hosts)
  - IT:       25 hosts  → needs /27 (30 hosts)
  - HR:       10 hosts  → needs /28 (14 hosts)
  - Mgmt:      5 hosts  → needs /29 (6 hosts)
  - Links:     2 hosts  → needs /30 (2 hosts)

Allocation:
  Sales: 192.168.1.0/26   (0–63)
  IT:    192.168.1.64/27  (64–95)
  HR:    192.168.1.96/28  (96–111)
  Mgmt:  192.168.1.112/29 (112–119)
  Link:  192.168.1.120/30 (120–123)

NAT — Network Address Translation

NAT Terminology

• Inside Local: Private IP of inside host (as seen inside)
• Inside Global: Public IP representing inside host (as seen outside)
• Outside Local: IP of outside host as seen from inside
• Outside Global: Real IP of outside host

NAT Configuration (IOS)

! Static NAT
ip nat inside source static 192.168.1.10 203.0.113.10

! Dynamic NAT with Pool
ip nat pool MYPOOL 203.0.113.1 203.0.113.5 netmask 255.255.255.248
access-list 1 permit 192.168.1.0 0.0.0.255
ip nat inside source list 1 pool MYPOOL

! PAT (Overload)
ip nat inside source list 1 interface GigabitEthernet0/0 overload

! Interface designations
interface GigabitEthernet0/0
 ip nat outside
interface GigabitEthernet0/1
 ip nat inside

! Verify
show ip nat translations
show ip nat statistics

Ethernet & Switching

Ethernet & Switching

Ethernet Frame Structure

MAC Address

48-bit (6-byte) address burned into NIC. Written as hex: AA:BB:CC:DD:EE:FF

• First 24 bits = OUI (Organizationally Unique Identifier) — identifies manufacturer
• Last 24 bits = Device-specific serial number
• Bit 1 of first byte: 0=unicast, 1=multicast
• Bit 2 of first byte: 0=globally unique (burned-in), 1=locally administered

Switch Operation

Switches use the MAC address table (CAM table) to make forwarding decisions:

1. Learning: When a frame arrives, the switch records the source MAC → port mapping
2. Forwarding: If destination MAC is known, forward to that port only (unicast)
3. Flooding: If destination unknown, send out all ports except source (unknown unicast flood)
4. Filtering: Don't send frame back out the same port it came from

Switch Frame Processing Modes

Switch IOS — Basic Configuration

! Initial setup
Switch> enable
Switch# configure terminal
Switch(config)# hostname SW1
SW1(config)# enable secret cisco123
SW1(config)# service password-encryption
SW1(config)# banner motd # Authorized Access Only #

! Management VLAN interface
SW1(config)# interface vlan 1
SW1(config-if)# ip address 192.168.1.2 255.255.255.0
SW1(config-if)# no shutdown

! Default gateway
SW1(config)# ip default-gateway 192.168.1.1

! Console & VTY lines
SW1(config)# line console 0
SW1(config-line)# password cisco
SW1(config-line)# login
SW1(config)# line vty 0 15
SW1(config-line)# password cisco
SW1(config-line)# login
SW1(config-line)# transport input ssh

! Save
SW1# copy running-config startup-config

Useful Show Commands

show mac address-table        ! MAC table
show mac address-table dynamic ! Dynamic entries only
show interfaces status         ! Port status
show interfaces gi0/1          ! Detailed interface info
show running-config
show version

VLANs & Trunking

VLANs & Trunking

VLAN Concepts

VLANs (Virtual LANs) segment a physical network into multiple logical broadcast domains at Layer 2.

• Each VLAN is a separate broadcast domain
• Traffic between VLANs requires Layer 3 routing
• VLANs 1–4094 are valid (1 is default, 1002–1005 reserved for legacy)
• Normal range: 1–1005 | Extended range: 1006–4094

VLAN Configuration

! Create VLANs
SW1(config)# vlan 10
SW1(config-vlan)# name SALES
SW1(config)# vlan 20
SW1(config-vlan)# name IT
SW1(config)# vlan 30
SW1(config-vlan)# name MGMT

! Access port (end device)
SW1(config)# interface gi0/1
SW1(config-if)# switchport mode access
SW1(config-if)# switchport access vlan 10

! Voice VLAN on access port
SW1(config-if)# switchport voice vlan 99

! Verify
SW1# show vlan brief
SW1# show interfaces gi0/1 switchport

Trunk Ports & 802.1Q

Trunk links carry traffic for multiple VLANs between switches (or switch to router). IEEE 802.1Q adds a 4-byte tag to Ethernet frames:

802.1Q Tag (4 bytes):
  - TPID: 0x8100 (2 bytes) — identifies as 802.1Q
  - PCP:  3 bits  — priority (CoS)
  - DEI:  1 bit   — drop eligible
  - VID:  12 bits — VLAN ID (0–4095)

! Trunk port configuration
SW1(config)# interface gi0/24
SW1(config-if)# switchport mode trunk
SW1(config-if)# switchport trunk encapsulation dot1q  ! Required on some switches
SW1(config-if)# switchport trunk allowed vlan 10,20,30
SW1(config-if)# switchport trunk native vlan 99      ! Native VLAN (untagged)

! Verify
SW1# show interfaces trunk
SW1# show interfaces gi0/24 switchport

DTP — Dynamic Trunking Protocol

SW1(config-if)# switchport nonegotiate  ! Disable DTP (security best practice)

VTP — VLAN Trunking Protocol

Cisco proprietary. Propagates VLAN database changes across trunk links.

SW1# show vtp status
SW1(config)# vtp mode transparent
SW1(config)# vtp domain COMPANY
SW1(config)# vtp password cisco123

Inter-VLAN Routing

Method 1: Router-on-a-Stick

! Router subinterfaces
R1(config)# interface gi0/0.10
R1(config-subif)# encapsulation dot1q 10
R1(config-subif)# ip address 192.168.10.1 255.255.255.0
R1(config)# interface gi0/0.20
R1(config-subif)# encapsulation dot1q 20
R1(config-subif)# ip address 192.168.20.1 255.255.255.0
R1(config)# interface gi0/0
R1(config-if)# no shutdown

Method 2: Layer 3 Switch (SVIs)

! Switch Virtual Interfaces
SW1(config)# ip routing              ! Enable L3 routing
SW1(config)# interface vlan 10
SW1(config-if)# ip address 192.168.10.1 255.255.255.0
SW1(config-if)# no shutdown
SW1(config)# interface vlan 20
SW1(config-if)# ip address 192.168.20.1 255.255.255.0
SW1(config-if)# no shutdown

Spanning Tree Protocol

Spanning Tree Protocol (STP)

Why STP?

Without STP, redundant switch links cause broadcast storms (frames loop forever), MAC table instability, and duplicate frame delivery. STP prevents loops by blocking redundant paths.

STP Election Process

1. Elect Root Bridge: Switch with lowest Bridge ID = Root Bridge. BID = Priority (16-bit, default 32768) + MAC address. All ports on root bridge are Designated Ports (forwarding).
2. Elect Root Ports: Each non-root switch selects one Root Port — the port with lowest cost path to root bridge.
3. Elect Designated Ports: Each segment has one Designated Port — the port closest to root on that segment.
4. Block remaining: All other ports become Alternate/Backup (blocking).

STP Port Costs

STP Port States

Total convergence time for classic 802.1D STP: up to 50 seconds.

STP Variants

STP Configuration

! Set switch as root bridge
SW1(config)# spanning-tree vlan 10 priority 4096  ! Lower = preferred root
SW1(config)# spanning-tree vlan 10 root primary   ! Shortcut — sets to 24576

! Enable Rapid PVST+
SW1(config)# spanning-tree mode rapid-pvst

! PortFast — skip listening/learning for access ports
SW1(config-if)# spanning-tree portfast

! BPDU Guard — disable port if BPDU received (protect PortFast ports)
SW1(config-if)# spanning-tree bpduguard enable
SW1(config)# spanning-tree portfast bpduguard default  ! Enable globally

! Root Guard — prevent port from becoming root port
SW1(config-if)# spanning-tree guard root

! Verify
SW1# show spanning-tree
SW1# show spanning-tree vlan 10
SW1# show spanning-tree summary

STP Protection Features

EtherChannel

EtherChannel

EtherChannel Overview

EtherChannel bundles multiple physical links into one logical link, providing increased bandwidth and redundancy without STP blocking.

• Up to 8 active links (16 in 802.3ad — 8 active, 8 standby)
• STP sees it as one link — no blocking!
• Load balancing across member links
• If one link fails, traffic continues on remaining links

EtherChannel Protocols

EtherChannel Requirements

• Same speed and duplex on all member ports
• Same access VLAN or trunk configuration
• Same native VLAN and allowed VLANs (trunk)
• Same STP configuration

EtherChannel Configuration

! LACP EtherChannel
SW1(config)# interface range gi0/1-4
SW1(config-if-range)# channel-group 1 mode active
SW1(config)# interface port-channel 1
SW1(config-if)# switchport mode trunk    ! Configure the port-channel

! PAgP EtherChannel
SW1(config)# interface range gi0/1-4
SW1(config-if-range)# channel-group 1 mode desirable

! Static EtherChannel
SW1(config)# interface range gi0/1-4
SW1(config-if-range)# channel-group 1 mode on

! Verify
SW1# show etherchannel summary
SW1# show etherchannel port-channel
SW1# show interfaces port-channel 1

Load Balancing Methods

SW1(config)# port-channel load-balance ?
  dst-ip      Dst IP Addr
  dst-mac     Dst Mac Addr
  src-dst-ip  Src XOR Dst IP Addr
  src-dst-mac Src XOR Dst Mac Addr
  src-ip      Src IP Addr
  src-mac     Src Mac Addr

SW1# show etherchannel load-balance

Routing Fundamentals

Routing Fundamentals

Routing Process

A router examines the destination IP address of an incoming packet, consults its routing table, and forwards the packet out the appropriate interface.

Routing Table

R1# show ip route
Codes: C - connected, S - static, R - RIP, O - OSPF, D - EIGRP, 
       B - BGP, i - IS-IS, * - candidate default

Gateway of last resort is 10.0.0.1 to network 0.0.0.0

C    192.168.1.0/24 is directly connected, GigabitEthernet0/0
L    192.168.1.1/32 is directly connected, GigabitEthernet0/0
O    10.0.0.0/8 [110/2] via 192.168.1.2, 00:01:23, GigabitEthernet0/0
S    0.0.0.0/0 [1/0] via 10.0.0.1

Format: [Administrative Distance/Metric]

Administrative Distance (AD)

Router IOS — Basic Configuration

R1(config)# interface gi0/0
R1(config-if)# ip address 192.168.1.1 255.255.255.0
R1(config-if)# description Link to SW1
R1(config-if)# no shutdown

! Serial interface
R1(config)# interface serial0/0/0
R1(config-if)# ip address 10.0.0.1 255.255.255.252
R1(config-if)# clock rate 64000    ! DCE end only
R1(config-if)# no shutdown

! Loopback interface
R1(config)# interface loopback 0
R1(config-if)# ip address 1.1.1.1 255.255.255.255

Static Routing

! Standard static route
R1(config)# ip route 192.168.2.0 255.255.255.0 10.0.0.2
R1(config)# ip route 192.168.2.0 255.255.255.0 gi0/1  ! Exit interface

! Default route
R1(config)# ip route 0.0.0.0 0.0.0.0 10.0.0.1        ! Next-hop
R1(config)# ip route 0.0.0.0 0.0.0.0 gi0/0 10.0.0.1  ! Fully specified (best)

! Floating static (backup route — higher AD than dynamic)
R1(config)# ip route 192.168.2.0 255.255.255.0 10.0.1.2 200

! Summary static route
R1(config)# ip route 172.16.0.0 255.255.0.0 10.0.0.2

! IPv6 static
R1(config)# ipv6 route 2001:db8:2::/64 2001:db8:1::2

OSPF

OSPF — Open Shortest Path First

OSPF Key Concepts

• Link-State: Builds a complete topology map of the network using LSAs
• Algorithm: Dijkstra's Shortest Path First (SPF)
• Metric: Cost = 100 Mbps ÷ interface bandwidth
• AD: 110
• Multicast: 224.0.0.5 (all OSPF routers), 224.0.0.6 (DR/BDR)
• Protocol: IP Protocol 89
• Standard: OSPFv2 (IPv4), OSPFv3 (IPv6)

OSPF Neighbor States

OSPF forms adjacencies through a state machine:

Down → Init → 2-Way → ExStart → Exchange → Loading → Full

• 2-Way: Bidirectional communication. DR/BDR election happens here.
• Full: Complete adjacency. LSDBs are synchronized.

DR/BDR Election (Multi-Access Networks)

On broadcast networks (Ethernet), OSPF elects a Designated Router (DR) and Backup DR (BDR) to reduce OSPF traffic.

• Highest OSPF priority wins (default: 1). Priority 0 = never elected.
• Tie: Highest Router ID wins
• Router ID = Highest loopback IP, then highest active interface IP, or manually configured
• DR/BDR election is non-preemptive once formed

OSPF Areas

• Backbone Area (Area 0): All other areas must connect to Area 0
• ABR (Area Border Router): Connects non-backbone area to Area 0
• ASBR (Autonomous System Boundary Router): Connects OSPF to external routing domain
• Stub Area: No external LSAs. Default route used instead.
• Totally Stubby: No external or inter-area LSAs. Only default route. (Cisco)
• NSSA: Not-So-Stubby. Allows limited external routes (Type 7 LSA).

OSPF Configuration (Single Area)

! OSPFv2
R1(config)# router ospf 1
R1(config-router)# router-id 1.1.1.1
R1(config-router)# network 192.168.1.0 0.0.0.255 area 0
R1(config-router)# network 10.0.0.0 0.0.0.3 area 0
R1(config-router)# passive-interface gi0/1  ! No OSPF hellos on this interface
R1(config-router)# default-information originate  ! Advertise default route

! Interface cost
R1(config-if)# ip ospf cost 10

! Priority for DR election
R1(config-if)# ip ospf priority 100  ! 0 = won't be elected

! Hello/Dead timers
R1(config-if)# ip ospf hello-interval 10
R1(config-if)# ip ospf dead-interval 40

OSPF Verification

show ip ospf neighbor            ! Adjacency table
show ip ospf neighbor detail     ! Detailed neighbor info
show ip ospf database            ! LSDB
show ip ospf interface           ! OSPF interface info
show ip route ospf               ! OSPF routes in routing table
debug ip ospf events
debug ip ospf adj

OSPFv3 (IPv6)

R1(config)# ipv6 router ospf 1
R1(config-rtr)# router-id 1.1.1.1
R1(config)# interface gi0/0
R1(config-if)# ipv6 ospf 1 area 0

OSPF Cost Calculation

Cost = Reference Bandwidth / Interface Bandwidth
Default reference = 100 Mbps

FastEthernet (100M): 100/100 = 1
GigabitEthernet (1G): 100/1000 = 0.1 → rounds to 1 (same as FE!)

! Fix: increase reference bandwidth
R1(config-router)# auto-cost reference-bandwidth 1000  ! = 1 Gbps
R1(config-router)# auto-cost reference-bandwidth 10000 ! = 10 Gbps

EIGRP

EIGRP — Enhanced Interior Gateway Routing Protocol

EIGRP Characteristics

• Type: Advanced Distance Vector / Hybrid (uses Diffusing Update Algorithm — DUAL)
• Cisco proprietary (now has RFC 7868 open standard)
• AD: Internal 90, External 170, Summary 5
• Metric: Composite — Bandwidth + Delay (+ Reliability + Load + MTU optionally)
• Multicast: 224.0.0.10
• Protocol: IP Protocol 88
• 100% loop-free due to DUAL algorithm

EIGRP DUAL Terminology

• Feasible Distance (FD): Best metric to reach destination (from this router)
• Reported Distance (RD) / Advertised Distance: Neighbor's metric to destination
• Successor: Best path to destination. Installed in routing table.
• Feasible Successor (FS): Backup path. RD < Successor's FD. Immediately usable if successor fails.
• Feasibility Condition: RD of neighbor must be less than FD of current successor

EIGRP Configuration

! Classic mode
R1(config)# router eigrp 100         ! AS number must match
R1(config-router)# eigrp router-id 1.1.1.1
R1(config-router)# network 192.168.1.0
R1(config-router)# network 10.0.0.0 0.0.0.3  ! With wildcard mask
R1(config-router)# passive-interface gi0/1
R1(config-router)# no auto-summary   ! Disable automatic summarization

! Named mode (preferred — supports IPv4 and IPv6)
R1(config)# router eigrp CORP
R1(config-router)# address-family ipv4 unicast autonomous-system 100
R1(config-router-af)# eigrp router-id 1.1.1.1
R1(config-router-af)# network 192.168.1.0
R1(config-router-af)# af-interface gi0/0
R1(config-router-af-interface)# passive-interface

EIGRP Verification

show ip eigrp neighbors          ! Neighbor table
show ip eigrp topology           ! Topology table (successors + FS)
show ip eigrp topology all-links ! All paths
show ip route eigrp              ! EIGRP routes
show ip eigrp interfaces         ! Interfaces running EIGRP
show ip eigrp traffic            ! Packet statistics

EIGRP Metric Calculation

Metric = 256 × [(K1 × BW) + (K3 × Delay)]
  Default K values: K1=1, K2=0, K3=1, K4=0, K5=0

BW    = 10^7 / slowest link bandwidth (in kbps)
Delay = sum of delays along path (in 10 microsecond units)

Example: 100 Mbps link, delay 1000 μs:
  BW    = 10^7 / 100000 = 100
  Delay = 1000/10 = 100
  Metric = 256 × (100 + 100) = 51200

RIP

RIP — Routing Information Protocol

RIP Characteristics

• Type: Distance Vector
• Metric: Hop count (max 15; 16 = infinite = unreachable)
• AD: 120
• Updates: Full routing table broadcast/multicast every 30 seconds
• RIPv1: Classful, broadcast (255.255.255.255), no VLSM
• RIPv2: Classless, multicast (224.0.0.9), supports VLSM, authentication
• RIPng: RIPv2 for IPv6

RIP Loop Prevention

• Maximum hop count (15): Limits network size
• Split horizon: Don't advertise routes back to source interface
• Route poisoning: Advertise dead route with metric 16
• Poison reverse: Send poisoned route back to source
• Holddown timers: Ignore updates about dead route for 180 sec

RIP Configuration

R1(config)# router rip
R1(config-router)# version 2
R1(config-router)# no auto-summary    ! Required for VLSM support
R1(config-router)# network 192.168.1.0
R1(config-router)# network 10.0.0.0
R1(config-router)# passive-interface gi0/1
R1(config-router)# default-information originate

! Verify
R1# show ip rip database
R1# show ip protocols
R1# debug ip rip

BGP Basics

BGP — Border Gateway Protocol

BGP Overview

BGP is the routing protocol of the internet — an Exterior Gateway Protocol (EGP) used between Autonomous Systems (AS).

• Type: Path Vector (uses AS-PATH attribute for loop prevention)
• Transport: TCP port 179
• AD: eBGP = 20, iBGP = 200
• iBGP: BGP between routers in same AS
• eBGP: BGP between routers in different AS

BGP Attributes (Path Selection)

1. Weight (Cisco-specific, local to router) — higher preferred
2. Local Preference (local to AS) — higher preferred
3. Originate (locally originated) — prefer
4. AS-PATH length — shorter preferred
5. Origin (IGP > EGP > Incomplete)
6. MED (Multi-Exit Discriminator) — lower preferred
7. Paths (eBGP over iBGP)
8. IGP metric — lower preferred

Basic BGP Configuration

! eBGP
R1(config)# router bgp 65001
R1(config-router)# bgp router-id 1.1.1.1
R1(config-router)# neighbor 203.0.113.2 remote-as 65002  ! eBGP neighbor
R1(config-router)# network 192.168.1.0 mask 255.255.255.0

! iBGP
R1(config-router)# neighbor 10.0.0.2 remote-as 65001
R1(config-router)# neighbor 10.0.0.2 update-source Loopback0
R1(config-router)# neighbor 10.0.0.2 next-hop-self

! Verify
R1# show bgp summary
R1# show ip bgp
R1# show bgp neighbors

HSRP & FHRP

HSRP & First Hop Redundancy Protocols

FHRP Overview

First Hop Redundancy Protocols provide a virtual gateway IP/MAC so hosts can continue communicating if the primary router fails.

HSRP — Hot Standby Router Protocol

• Cisco-proprietary
• One Active router, one Standby, others in Listen state
• Virtual IP + virtual MAC (0000.0C07.ACxx for HSRPv1)
• Hellos: every 3 seconds. Hold time: 10 seconds.
• Priority: default 100. Highest priority = Active.
• Preemption disabled by default

R1(config)# interface gi0/0
R1(config-if)# standby 1 ip 192.168.1.254       ! Virtual IP
R1(config-if)# standby 1 priority 110           ! Higher = preferred active
R1(config-if)# standby 1 preempt               ! Take over if higher priority
R1(config-if)# standby 1 track gi0/1 decrement 20  ! Reduce priority if WAN fails

R1# show standby
R1# show standby brief

HSRP vs VRRP vs GLBP

Layer 3 Forwarding

Layer 3 Forwarding & ARP

ARP — Address Resolution Protocol

Maps Layer 3 IP addresses to Layer 2 MAC addresses.

Process:
1. Host A wants to send to 192.168.1.2
2. Checks ARP cache — not found
3. Sends ARP Request (broadcast): "Who has 192.168.1.2? Tell 192.168.1.1"
4. Host B receives request, replies (unicast): "192.168.1.2 is at AA:BB:CC:DD:EE:FF"
5. Host A caches mapping, sends frame

show arp                         ! View ARP table
arp -a                           ! Windows
ip neigh show                    ! Linux

Proxy ARP

Router responds to ARP requests on behalf of a host in another subnet. Allows hosts with incorrect subnet masks to still communicate. Usually enabled by default; disable if not needed:

R1(config-if)# no ip proxy-arp

Packet Forwarding Process

1. Receive frame, check destination MAC
2. If MAC matches, strip L2 header → inspect IP packet
3. Check TTL — decrement by 1. If TTL=0, discard + ICMP TTL exceeded
4. Look up destination IP in routing table (longest prefix match)
5. Determine exit interface and next-hop IP
6. ARP for next-hop MAC (if Ethernet)
7. Build new L2 frame with next-hop MAC, forward

ICMP — Internet Control Message Protocol

WAN Technologies

WAN Technologies

WAN Connection Types

WAN Serial Encapsulations

PPP Configuration

! PPP with CHAP authentication
R1(config)# interface serial0/0/0
R1(config-if)# encapsulation ppp
R1(config-if)# ppp authentication chap

R1(config)# username R2 password cisco123  ! Remote router's hostname

! Verify
R1# show interfaces serial0/0/0
R1# debug ppp authentication

VPN Types

SD-WAN

Software-Defined WAN abstracts the WAN transport layer from the application layer. Benefits:

• Centralized management and visibility
• Multiple transport links (MPLS + broadband + LTE) simultaneously
• Application-aware routing
• Zero-touch provisioning
• Vendors: Cisco Viptela, VMware SD-WAN (VeloCloud), Silver Peak

DHCP & DNS

DHCP & DNS

DHCP — Dynamic Host Configuration Protocol

Automatically assigns IP addresses and configuration to network devices.

DHCP DORA Process

1. DISCOVER  — Client broadcasts (255.255.255.255) looking for DHCP server
2. OFFER     — Server unicasts/broadcasts offer with IP, mask, gateway, DNS
3. REQUEST   — Client broadcasts acceptance of offer
4. ACK       — Server confirms assignment
(NACK = rejected)

DHCP Server Configuration (IOS)

R1(config)# ip dhcp excluded-address 192.168.1.1 192.168.1.10
R1(config)# ip dhcp pool LAN_POOL
R1(dhcp-config)# network 192.168.1.0 255.255.255.0
R1(dhcp-config)# default-router 192.168.1.1
R1(dhcp-config)# dns-server 8.8.8.8 8.8.4.4
R1(dhcp-config)# domain-name company.local
R1(dhcp-config)# lease 7              ! Days

! Verify
R1# show ip dhcp binding
R1# show ip dhcp pool
R1# show ip dhcp conflict

DHCP Relay (IP Helper)

! When DHCP server is on different subnet
R1(config)# interface gi0/1             ! Interface facing clients
R1(config-if)# ip helper-address 10.0.0.100  ! DHCP server IP

DHCPv6

! Stateless DHCPv6 (SLAAC + options)
R1(config)# ipv6 dhcp pool IPV6_POOL
R1(config-dhcpv6)# dns-server 2001:4860:4860::8888
R1(config)# interface gi0/0
R1(config-if)# ipv6 dhcp server IPV6_POOL
R1(config-if)# ipv6 nd other-config-flag  ! Set O flag in RA

! Stateful DHCPv6
R1(config-if)# ipv6 nd managed-config-flag  ! Set M flag in RA

DNS — Domain Name System

Resolves hostnames to IP addresses. Hierarchical distributed database.

DNS Resolution Order (Windows)

1. Local cache
2. hosts file (C:\Windows\System32\drivers\etc\hosts)
3. DNS server query (recursive → iterative)

NTP, SNMP & Syslog

NTP, SNMP & Syslog

NTP — Network Time Protocol

Synchronizes clocks across network devices. Uses UDP port 123. Stratum levels indicate accuracy.

• Stratum 0: Atomic clock / GPS (reference clock)
• Stratum 1: Directly synced to Stratum 0 (NTP servers)
• Stratum 2: Synced to Stratum 1 servers
• …up to Stratum 15. Stratum 16 = unsynchronized.

R1(config)# ntp server 216.239.35.0      ! Google NTP
R1(config)# ntp server 10.0.0.1 prefer
R1(config)# ntp master 2                 ! Make this router NTP master (stratum 2)
R1(config)# ntp update-calendar
R1(config)# clock timezone EST -5

R1# show ntp status
R1# show ntp associations

SNMP — Simple Network Management Protocol

Used for network monitoring and management. UDP ports 161 (queries) and 162 (traps).

SNMP Components

• MIB: Management Information Base — database of manageable objects
• OID: Object Identifier — unique address of MIB object
• Manager (NMS): Sends queries (GET, SET), receives traps
• Agent: Runs on managed device, responds to queries, sends traps/informs

! SNMPv2c
R1(config)# snmp-server community PUBLIC ro
R1(config)# snmp-server community PRIVATE rw
R1(config)# snmp-server host 10.0.0.10 version 2c PUBLIC
R1(config)# snmp-server enable traps

! SNMPv3
R1(config)# snmp-server group ADMIN v3 priv
R1(config)# snmp-server user NETADMIN ADMIN v3 auth sha Auth@123 priv aes 128 Priv@123

Syslog

Standard for message logging. UDP port 514. Severity levels (0 = most critical):

R1(config)# logging 10.0.0.20              ! Syslog server IP
R1(config)# logging trap warnings          ! Send level 4 and below
R1(config)# logging on
R1(config)# logging buffered 16384 debugging  ! Local buffer

R1# show logging

QoS

QoS — Quality of Service

Why QoS?

Networks have limited bandwidth. QoS prioritizes traffic to ensure latency-sensitive applications (voice, video) get preferential treatment over less time-sensitive traffic (file transfers, email).

QoS Characteristics

• Bandwidth: Available capacity in bits per second
• Delay (Latency): Time for packet to travel from source to destination
• Jitter: Variation in delay between packets
• Loss: Percentage of packets dropped

Recommended QoS Values

QoS Models

QoS Marking

QoS Queuing Methods

• FIFO: First-In, First-Out. No prioritization. Default.
• WFQ: Weighted Fair Queuing. Automatic classification.
• CBWFQ: Class-Based WFQ. Traffic classes with bandwidth guarantees.
• LLQ: Low Latency Queuing. CBWFQ + priority queue for voice. Recommended for VoIP.
• PQ: Priority Queuing. 4 queues (high/medium/normal/low). Can starve lower queues.

QoS Configuration (MQC)

! Step 1: Classification
class-map match-any VOICE
 match dscp ef
 match ip dscp 46

class-map match-all VIDEO
 match dscp af41

! Step 2: Policy
policy-map WAN_POLICY
 class VOICE
  priority 256           ! LLQ strict priority
 class VIDEO
  bandwidth 512          ! Guarantee 512 kbps
 class class-default
  fair-queue

! Step 3: Apply to interface
interface serial0/0/0
 service-policy output WAN_POLICY

Access Control Lists

Access Control Lists (ACLs)

ACL Overview

ACLs are ordered lists of permit/deny statements used to filter traffic. Processed top-to-bottom; first match wins. Implicit deny all at end.

ACL Types

Wildcard Masks

Wildcard masks are the inverse of subnet masks. 0 = must match, 1 = don't care.

255.255.255.0 subnet mask → 0.0.0.255 wildcard
255.255.255.252 → 0.0.0.3

Special:
  host  = 0.0.0.0    (matches exact IP)
  any   = 255.255.255.255 (matches all)

Standard ACL Configuration

! Numbered
R1(config)# access-list 10 permit 192.168.1.0 0.0.0.255
R1(config)# access-list 10 deny any

! Named
R1(config)# ip access-list standard ALLOW_LAN
R1(config-std-nacl)# permit 192.168.1.0 0.0.0.255
R1(config-std-nacl)# deny any log

! Apply to interface
R1(config)# interface gi0/0
R1(config-if)# ip access-group 10 in      ! inbound
R1(config-if)# ip access-group ALLOW_LAN out  ! outbound

! Apply to VTY lines
R1(config)# line vty 0 15
R1(config-line)# access-class 10 in

Extended ACL Configuration

R1(config)# ip access-list extended CORP_POLICY
! Permit HTTP/HTTPS from sales to server
R1(config-ext-nacl)# permit tcp 192.168.10.0 0.0.0.255 host 10.0.0.5 eq 80
R1(config-ext-nacl)# permit tcp 192.168.10.0 0.0.0.255 host 10.0.0.5 eq 443
! Permit ICMP for troubleshooting
R1(config-ext-nacl)# permit icmp 192.168.10.0 0.0.0.255 any
! Block Telnet everywhere
R1(config-ext-nacl)# deny tcp any any eq 23
! Permit everything else
R1(config-ext-nacl)# permit ip any any

R1(config)# interface gi0/0
R1(config-if)# ip access-group CORP_POLICY in

ACL Verification

show ip access-lists           ! All ACLs with match counts
show ip access-lists 10        ! Specific ACL
show ip interface gi0/0        ! Check which ACLs applied to interface
show running-config | include access

ACL Best Practices

• Standard ACLs: place near destination
• Extended ACLs: place near source
• Most specific entries first
• Remember implicit deny — add explicit permit if needed
• Use log keyword to log matches
• Use named ACLs for easier editing
• Always verify with show ip access-lists (check counters)

Network Security

Network Security

AAA — Authentication, Authorization, Accounting

• Authentication: Who are you? (username/password, certificates, MFA)
• Authorization: What can you do? (privilege levels, command sets)
• Accounting: What did you do? (logging, billing, audit)

Layer 2 Security Threats & Mitigations

Port Security

SW1(config)# interface gi0/1
SW1(config-if)# switchport mode access
SW1(config-if)# switchport port-security
SW1(config-if)# switchport port-security maximum 2
SW1(config-if)# switchport port-security mac-address sticky    ! Learn dynamically
SW1(config-if)# switchport port-security violation restrict    ! or shutdown/protect

! Violation modes:
!   shutdown  — err-disables port (default)
!   restrict  — drop + log
!   protect   — drop silently

SW1# show port-security interface gi0/1
SW1# show port-security address

! Re-enable err-disabled port:
SW1(config-if)# shutdown
SW1(config-if)# no shutdown

DHCP Snooping

SW1(config)# ip dhcp snooping
SW1(config)# ip dhcp snooping vlan 10,20
SW1(config)# no ip dhcp snooping information option  ! Disable option 82 if issues

! Trusted port = uplink to DHCP server or trusted switch
SW1(config)# interface gi0/24
SW1(config-if)# ip dhcp snooping trust

! Untrusted ports (default) rate-limit DHCP
SW1(config)# interface gi0/1
SW1(config-if)# ip dhcp snooping limit rate 10

SW1# show ip dhcp snooping binding

Dynamic ARP Inspection (DAI)

SW1(config)# ip arp inspection vlan 10,20  ! Requires DHCP snooping binding table
SW1(config)# interface gi0/24
SW1(config-if)# ip arp inspection trust   ! Trusted uplink

SW1# show ip arp inspection vlan 10

Cisco Device Hardening

! Secure management access
R1(config)# service password-encryption
R1(config)# security passwords min-length 10
R1(config)# login block-for 120 attempts 3 within 60  ! Login lockout
R1(config)# ip ssh version 2                           ! Use SSHv2 only
R1(config)# ip domain-name company.com
R1(config)# crypto key generate rsa modulus 2048

! Disable unused services
R1(config)# no service finger
R1(config)# no service udp-small-servers
R1(config)# no service tcp-small-servers
R1(config)# no ip http server                          ! Disable HTTP
R1(config)# ip http secure-server                     ! Enable HTTPS only
R1(config)# no cdp run                                 ! Disable CDP globally

! Disable unused interfaces
R1(config)# interface range gi0/1-4
R1(config-if-range)# shutdown
R1(config-if-range)# description UNUSED

Wireless Security

Wireless Security

Wireless Security Standards

WPA2/WPA3 Modes

• Personal (PSK): Pre-shared key. All users share same password. Home/small business.
• Enterprise (802.1X): Per-user authentication via RADIUS server. EAP variants. Enterprise use.

802.1X Components

• Supplicant: Client device (PC, phone) — sends credentials
• Authenticator: Switch or AP — relays auth between supplicant and server
• Authentication Server: RADIUS server — verifies credentials

Wireless Threats

• Rogue AP: Unauthorized AP on the network. Detected via WIDS/WIPS.
• Evil Twin: AP with same SSID as legitimate AP. MITM attack.
• Deauthentication Attack: Spoofed deauth frames force client disconnect.
• War Driving: Discovering wireless networks from a moving vehicle.
• KRACK: Key Reinstallation Attack targeting WPA2 handshake.

Wireless Best Practices

• Use WPA3 or WPA2-Enterprise where possible
• Change default SSID and admin credentials
• Use separate VLANs for guest and corporate wireless
• Enable WIDS/WIPS to detect rogue APs
• Disable WPS (Wi-Fi Protected Setup)
• Use 802.1X for enterprise authentication
• Implement wireless IPS for monitoring

Network Automation

Network Automation & Programmability

Why Network Automation?

• Eliminate human error in repetitive configuration tasks
• Faster deployment and changes
• Consistent configurations across devices
• Better scalability and visibility

Data Formats

{"hostname": "R1",
 "interfaces": ["gi0/0","gi0/1"],
 "ip": "192.168.1.1"}

<router>
  <name>R1</name>
  <ip>192.168.1.1</ip>
</router>

hostname: R1
interfaces:
  - gi0/0
  - gi0/1
ip: 192.168.1.1

APIs

Configuration Management Tools

Cisco DNA Center & SD-Access

• Cisco DNA Center: Intent-based networking controller. Automates campus networks. REST APIs. GUI-based policy.
• SD-Access: Software-Defined Access. Fabric-based campus. Underlay + Overlay. VXLAN + LISP. Micro-segmentation via SGT.
• Cisco vManage: SD-WAN controller (Viptela). Centralized policy and management.

Version Control — Git Basics

git init               # Initialize repo
git clone <url>        # Clone remote repo
git add .              # Stage all changes
git commit -m "msg"    # Commit changes
git push origin main   # Push to remote
git pull               # Pull latest
git status             # Check status
git log                # View history

Python for Networking

Python for Network Automation

Key Libraries

Netmiko Example

from netmiko import ConnectHandler

device = {
    'device_type': 'cisco_ios',
    'host':        '192.168.1.1',
    'username':    'admin',
    'password':    'cisco123',
    'secret':      'enable_pass'
}

with ConnectHandler(**device) as net_connect:
    net_connect.enable()
    output = net_connect.send_command('show ip route')
    print(output)
    
    # Send config commands
    commands = [
        'interface gi0/0',
        'description WAN Link',
        'no shutdown'
    ]
    net_connect.send_config_set(commands)

REST API Example (Cisco DNA Center)

import requests
import json

BASE_URL = "https://sandboxdnac.cisco.com/dna"
AUTH_URL = f"{BASE_URL}/system/api/v1/auth/token"

# Authenticate
response = requests.post(
    AUTH_URL,
    auth=('devnetuser', 'Cisco123!'),
    verify=False
)
token = response.json()['Token']

# Get devices
headers = {
    'x-auth-token': token,
    'Content-Type': 'application/json'
}
devices = requests.get(
    f"{BASE_URL}/intent/api/v1/network-device",
    headers=headers,
    verify=False
)
for device in devices.json()['response']:
    print(f"{device['hostname']} - {device['managementIpAddress']}")

Ansible Playbook Example

---
- name: Configure Cisco Router Interfaces
  hosts: routers
  gather_facts: no
  
  tasks:
    - name: Configure GigabitEthernet0/0
      cisco.ios.ios_interfaces:
        config:
          - name: GigabitEthernet0/0
            description: "WAN Interface"
            enabled: true
        state: merged
    
    - name: Get interface status
      cisco.ios.ios_command:
        commands:
          - show ip interface brief
      register: output
    
    - name: Print output
      debug:
        var: output.stdout_lines

Cloud & Virtualization

Cloud Computing & Virtualization

Cloud Service Models

Cloud Deployment Models

• Public Cloud: Resources shared among multiple customers. Owned by provider (AWS, Azure, GCP). Pay-per-use.
• Private Cloud: Resources dedicated to one organization. On-premises or hosted. More control, higher cost.
• Hybrid Cloud: Mix of public and private. Data can move between them. Most common enterprise approach.
• Community Cloud: Shared by organizations with common interests (healthcare, government).

Virtualization

• Hypervisor Type 1 (Bare Metal): Runs directly on hardware. VMware ESXi, Hyper-V, KVM. Better performance.
• Hypervisor Type 2 (Hosted): Runs on OS. VMware Workstation, VirtualBox. Easier to deploy.
• Containers: Share OS kernel. Docker, Kubernetes. Lighter than VMs. Fast startup.
• NFV (Network Functions Virtualization): Run network functions (firewall, load balancer) as software on commodity hardware.
• SDN (Software-Defined Networking): Separates control plane from data plane. Centralized controller (e.g., OpenFlow).

SDN Architecture

┌─────────────────────────────┐
│    Applications / Business   │  ← Application Layer
│    (NMS, Security, Analytics)│
└──────────────┬──────────────┘
               │ Northbound API (REST)
┌──────────────▼──────────────┐
│       SDN Controller         │  ← Control Plane (centralized)
│    (OpenDaylight, ONOS)      │
└──────────────┬──────────────┘
               │ Southbound API (OpenFlow, NETCONF, gRPC)
┌──────────────▼──────────────┐
│    Network Infrastructure    │  ← Data Plane (forwarding)
│    (Switches, Routers)       │
└─────────────────────────────┘