Chapter 2 · CCNA 200-301 Study Guide · Based on the CCNA 200-301 v2.0 exam blueprint (effective February 2027)

Chapter 2: Network Access

In Chapter 1 you learned how devices address each other. Now we go one layer deeper: how switches move frames inside a local network. This chapter covers VLANs, trunking, Spanning Tree, EtherChannel, wireless LANs, and switch port security — the "Network Access" domain of the CCNA 200-301 exam (v2.0 blueprint), and the configuration work you will do on day one as a network engineer.

2.1 VLAN Concepts

A VLAN (Virtual LAN) is a logical grouping of switch ports that behaves like a separate physical switch. Devices in the same VLAN can talk to each other directly; devices in different VLANs cannot — even if they are plugged into the same physical switch — without going through a router (a topic called inter-VLAN routing, covered in Chapter 3).

Why VLANs exist

Without VLANs, every device on a switch shares one broadcast domain — the set of devices receiving each other's broadcasts (ARP, DHCP). Hundreds of devices' broadcasts waste bandwidth and CPU on every host. VLANs split one switch into multiple broadcast domains, add Layer 2 security boundaries, and let you reassign a user with one port config change — no re-cabling.

VLAN ranges and types

Cisco switches support VLAN IDs 1–4094, split into two ranges:

A few VLANs are special and you must know them for the exam:

• VLAN 1 is the default VLAN. Every switch port belongs to VLAN 1 until you change it, and it is the default native VLAN on trunks. You cannot delete or rename VLAN 1.
• VLANs 1002–1005 are reserved for legacy Token Ring and FDDI. You cannot delete them either.
• A voice VLAN carries IP phone traffic. The phone tags its own voice frames while the attached PC's data stays untagged on the access (data) VLAN — one cable and one port serve both devices.

2.2 Access Ports vs Trunk Ports

• Access port: belongs to exactly one VLAN. Connects to end devices (PCs, printers, phones). Frames are treated as belonging to that VLAN; no tag is added.
• Trunk port: carries multiple VLANs, used on switch-to-switch and switch-to-router links. Frames are tagged with their VLAN ID so the far end can sort them.

Basic configuration:

Switch(config)# vlan 10
Switch(config-vlan)# name SALES
Switch(config-vlan)# exit
Switch(config)# interface gigabitEthernet 0/1
Switch(config-if)# switchport mode access
Switch(config-if)# switchport access vlan 10

Switch(config)# interface gigabitEthernet 0/24
Switch(config-if)# switchport mode trunk
Switch(config-if)# switchport trunk allowed vlan 10,20,30

The switchport trunk allowed vlan command controls which VLANs may cross the trunk. By default, a trunk allows all VLANs (1–4094) — pruning this list is a common security and efficiency practice.

2.3 802.1Q Tagging and the Native VLAN

The tagging standard on Cisco trunks is IEEE 802.1Q. A frame for VLAN 20 crossing a trunk gets a 4-byte 802.1Q header with a 12-bit VLAN ID field (hence the 4094 maximum — 2^12 minus reserved values). The receiving switch reads the tag, strips it, and forwards the frame inside VLAN 20.

One VLAN per trunk is the native VLAN: its frames cross untagged. The default is VLAN 1, and both ends must agree — a mismatch leaks traffic between the two native VLANs and triggers CDP warnings.

Switch(config)# interface gigabitEthernet 0/24
Switch(config-if)# switchport mode trunk
Switch(config-if)# switchport trunk native vlan 99

2.4 DTP: Dynamic Trunking Protocol

Manually setting every port is the safe approach, but Cisco switches can negotiate trunking with DTP (Dynamic Trunking Protocol):

• access — never trunks. trunk — always trunks. dynamic auto — trunks only if the other side asks. dynamic desirable — actively tries to trunk. nonegotiate — trunks without sending DTP frames.

The negotiation rules that matter for the exam:

Switch(config)# interface gigabitEthernet 0/24
Switch(config-if)# switchport mode dynamic desirable
Switch(config-if)# switchport nonegotiate

2.5 Spanning Tree Protocol — RSTP Focus

Why STP exists

Switches flood broadcasts out of every port, so a physical loop — two switches joined by two cables — makes broadcasts circle forever, multiplying into a broadcast storm that kills the network in seconds. Yet we want redundant links, so one cable failure doesn't isolate anyone. Spanning Tree resolves this: cable the redundant links, and STP logically blocks the extras, leaving one active loop-free path. If the active path fails, STP unblocks a backup automatically.

Know RSTP (Rapid STP, IEEE 802.1w): classic STP (802.1D) needs 30–50 seconds to converge (15s listening + 15s learning, plus timers); RSTP converges in seconds with a proposal/agreement handshake. Cisco's default is Rapid PVST+ — per-VLAN RSTP, one instance per VLAN.

Switch(config)# spanning-tree mode rapid-pvst

Root bridge election

Every STP decision is measured from the root bridge, elected as follows:

1. Each switch claims root, sending BPDUs with its bridge ID = priority (default 32768) + MAC.
2. Lowest bridge ID wins — lowest priority first, lowest MAC breaks ties.

Set priority in multiples of 4096 (0, 4096, … 61440):

Switch(config)# spanning-tree vlan 10 priority 4096
Switch(config)# spanning-tree vlan 10 root primary      ! 24576, or lower if needed
Switch(config)# spanning-tree vlan 10 root secondary    ! 28672

RSTP port roles and states

After the root is elected, each non-root switch picks one root port (lowest-cost path to the root). Per segment, one designated port forwards traffic. The rest — ports that would close a loop — become blocked alternate ports (backup paths toward the root) or backup ports (backup for a designated port on the same segment).

RSTP has three port states (classic STP had five):

PortFast and BPDU Guard

An access port to a PC doesn't need STP's waiting states — one host can't create a loop. PortFast sends the port straight to forwarding. But if someone plugs a switch into a PortFast port, a loop forms instantly — so pair PortFast with BPDU Guard, which error-disables the port the moment a BPDU arrives.

Switch(config)# interface gigabitEthernet 0/1
Switch(config-if)# spanning-tree portfast
Switch(config-if)# spanning-tree bpduguard enable

Or enable both globally for all PortFast ports at once:

Switch(config)# spanning-tree portfast default
Switch(config)# spanning-tree portfast bpduguard default

2.6 EtherChannel

EtherChannel bundles multiple physical links into one logical link: more bandwidth and redundancy. If a member fails, traffic continues on the rest with no STP reconvergence — STP sees the bundle as a single link, which also avoids blocking one of the parallel links.

Two negotiation protocols:

Member ports must match to form and stay healthy: same speed and duplex, same VLAN config (same access VLAN, or same trunk allowed-VLAN and native VLAN lists), same STP settings. A channel can be Layer 2 (switched) or Layer 3 (routed, with no switchport and IP addresses).

Configuration:

Switch(config)# interface range gigabitEthernet 0/1 - 2
Switch(config-if-range)# channel-group 1 mode active
Switch(config-if-range)# exit
Switch(config)# interface port-channel 1
Switch(config-if)# switchport mode trunk
Switch(config-if)# switchport trunk allowed vlan 10,20,30

2.7 Wireless LAN Concepts

AP modes: autonomous vs lightweight

The CCNA focuses on the enterprise model: lightweight APs + WLC.

A Wireless LAN Controller (WLC) is the brain of an enterprise wireless network: AP registration and configuration, client authentication, centralized security policy, QoS, RF management (auto-adjusting channel and transmit power), and seamless roaming between APs.

Lightweight APs talk to the WLC with CAPWAP: a control tunnel (UDP 5246) for management and a data tunnel (UDP 5247) for client traffic. Time-critical RF work stays on the AP; management and policy live on the WLC — this split is split-MAC architecture.

SSIDs and wireless security

Each Wi-Fi network name you see is an SSID (Service Set Identifier). One physical AP can broadcast several SSIDs (CORP, GUEST), each mapped to a different VLAN on the wired side.

Security, oldest to newest:

• WPA2 (802.11i): AES-CCMP encryption. WPA2-Personal uses a pre-shared key (PSK) with a 4-way handshake — strong, but weak passwords fall to offline dictionary attacks.
• WPA3: current standard. WPA3-Personal replaces the PSK handshake with SAE (Simultaneous Authentication of Equals) — resistant to offline dictionary attacks, with forward secrecy (captured traffic stays unreadable even if the password later leaks). WPA3-Enterprise adds an optional 192-bit mode.

2.8 Switch Port Security

Port security limits which devices may use a switch port by restricting allowed source MAC addresses — your defense against someone unplugging a PC and connecting a rogue device to the jack.

Switch(config)# interface gigabitEthernet 0/1
Switch(config-if)# switchport mode access
Switch(config-if)# switchport port-security
Switch(config-if)# switchport port-security maximum 2
Switch(config-if)# switchport port-security violation restrict
Switch(config-if)# switchport port-security mac-address sticky

Key options:

• maximum — allowed MAC count (default 1).
• mac-address sticky — learns the connected MAC dynamically and writes it to the running config, so you never type MACs by hand. Save with copy running-config startup-config to survive reboots.
• aging — learned MACs can expire after a set time (absolute or inactivity-based).

When the MAC limit is exceeded or an unknown MAC appears, one of three violation modes triggers:

End-of-Chapter Test