67. CCNA COMPLETE CHEATSHEET
A comprehensive summary of all CCNA topics in cheatsheet format for quick reference and exam preparation.
TABLE OF CONTENTS
- OSI Model & TCP/IP
- Network Devices & Cables
- CLI Fundamentals
- Ethernet & Switching
- IPv4 Addressing
- Subnetting
- Routing Fundamentals
- VLANs & Trunking
- Spanning Tree Protocol
- EtherChannel
- Dynamic Routing
- OSPF
- IPv6
- ACLs
- NAT
- TCP & UDP
- Network Services
- Security
- First Hop Redundancy
- Network Management
- QoS
- Wireless
OSI MODEL & TCP/IP
OSI 7 Layers (Top to Bottom)
| Layer | Name | PDU | Devices | Protocols |
|---|---|---|---|---|
| 7 | Application | Data | - | HTTP, HTTPS, FTP, DNS |
| 6 | Presentation | Data | - | SSL, TLS |
| 5 | Session | Data | - | NetBIOS |
| 4 | Transport | Segment | - | TCP, UDP |
| 3 | Network | Packet | Router | IP, ICMP, OSPF |
| 2 | Data Link | Frame | Switch | Ethernet, 802.1Q |
| 1 | Physical | Bits | Hub, Cables | - |
Mnemonic: Please Do Not Throw Sausage Pizza Away (Bottom to Top)
TCP/IP Model (4 Layers)
| TCP/IP Layer | OSI Equivalent |
|---|---|
| Application | 7, 6, 5 |
| Transport | 4 |
| Internet | 3 |
| Network Access | 2, 1 |
Encapsulation Process
Code
Data → Segment (L4 Header) → Packet (L3 Header) → Frame (L2 Header + Trailer) → Bits
NETWORK DEVICES & CABLES
Device Functions
| Device | Layer | Function |
|---|---|---|
| Switch | L2 | Connects devices within same LAN |
| Router | L3 | Connects different networks/LANs |
| Firewall | L3/4/7 | Network security, traffic filtering |
| Hub | L1 | Simple signal repeater (obsolete) |
Ethernet Standards (Copper)
| Speed | Name | Standard | Max Distance |
|---|---|---|---|
| 10 Mbps | Ethernet | 10BASE-T | 100m |
| 100 Mbps | Fast Ethernet | 100BASE-T | 100m |
| 1 Gbps | Gigabit Ethernet | 1000BASE-T | 100m |
| 10 Gbps | 10 Gig Ethernet | 10GBASE-T | 100m |
Cable Types
| Type | Use Case |
|---|---|
| Straight-Through | Different device types (PC↔Switch) |
| Crossover | Same device types (Switch↔Switch) |
| Rollover | Console connection |
Note: Modern devices use Auto MDI-X to auto-detect cable type
Fiber Optic
| Standard | Speed | Mode | Max Distance |
|---|---|---|---|
| 1000BASE-LX | 1 Gbps | Multi/Single | 550m / 5km |
| 10GBASE-SR | 10 Gbps | Multimode | 400m |
| 10GBASE-LR | 10 Gbps | Single | 10km |
| 10GBASE-ER | 10 Gbps | Single | 30km |
CLI FUNDAMENTALS
CLI Modes
CLI
Router> # User EXEC Mode
Router> enable
Router# # Privileged EXEC Mode
Router# configure terminal
Router(config)# # Global Configuration Mode
Router(config)# interface g0/0
Router(config-if)# # Interface Configuration Mode
Essential Commands
CLI
# View commands
show running-config # Current active config
show startup-config # Saved config
show ip interface brief # Interface summary
show interfaces # Detailed interface info
show vlan brief # VLAN information
show mac address-table # MAC table
# Save configuration
write # Save running to startup
copy running-config startup-config
# Password configuration
enable secret <password> # Encrypted privileged password
service password-encryption # Encrypt all passwords
# Interface configuration
interface g0/0
ip address 10.0.0.1 255.255.255.0
no shutdown
description ## Link to SW1 ##
ETHERNET & SWITCHING
Ethernet Frame Structure
Code
| Preamble | SFD | Dest MAC | Src MAC | Type | Data | FCS |
| 7 bytes | 1B | 6 bytes | 6 bytes | 2B | 46-1500B | 4B |
- Minimum Frame Size: 64 bytes
- Maximum Frame Size: 1518 bytes (without 802.1Q tag)
MAC Address
- 48 bits (6 bytes) = 12 hex characters
- OUI: First 3 bytes (manufacturer)
- Device ID: Last 3 bytes (unique)
- Broadcast MAC: FFFF.FFFF.FFFF
Switch Operations
| Action | Description |
|---|---|
| Learn | Add source MAC to table |
| Flood | Forward unknown unicast to all ports |
| Forward | Send to known destination port |
| Filter | Don't forward to source port |
ARP (Address Resolution Protocol)
- Purpose: Resolve IP → MAC address
- ARP Request: Broadcast (FFFF.FFFF.FFFF)
- ARP Reply: Unicast
IPv4 ADDRESSING
IPv4 Address Classes
| Class | First Octet | Default Mask | Range |
|---|---|---|---|
| A | 1-126 | /8 (255.0.0.0) | 1.0.0.0 - 126.255.255.255 |
| B | 128-191 | /16 (255.255.0.0) | 128.0.0.0 - 191.255.255.255 |
| C | 192-223 | /24 (255.255.255.0) | 192.0.0.0 - 223.255.255.255 |
| D | 224-239 | - | Multicast |
| E | 240-255 | - | Experimental |
127.x.x.x = Loopback addresses
Private IP Ranges (RFC 1918)
Code
10.0.0.0/8 (10.0.0.0 - 10.255.255.255) Class A
172.16.0.0/12 (172.16.0.0 - 172.31.255.255) Class B
192.168.0.0/16 (192.168.0.0 - 192.168.255.255) Class C
Special Addresses
- Network Address: Host bits all 0s (first address)
- Broadcast Address: Host bits all 1s (last address)
- Usable Hosts: 2^n - 2 (n = host bits)
Binary Conversion Chart
| 128 | 64 | 32 | 16 | 8 | 4 | 2 | 1 |
|---|
SUBNETTING
Subnetting Cheatsheet
| CIDR | Subnet Mask | Block Size | Usable Hosts |
|---|---|---|---|
| /24 | 255.255.255.0 | 256 | 254 |
| /25 | 255.255.255.128 | 128 | 126 |
| /26 | 255.255.255.192 | 64 | 62 |
| /27 | 255.255.255.224 | 32 | 30 |
| /28 | 255.255.255.240 | 16 | 14 |
| /29 | 255.255.255.248 | 8 | 6 |
| /30 | 255.255.255.252 | 4 | 2 |
| /31 | 255.255.255.254 | 2 | 2* |
| /32 | 255.255.255.255 | 1 | 1 |
/30 = Point-to-point links (2 usable IPs)
Subnetting Steps
- Find the "magic octet" where prefix lands
- Calculate block size: 256 - subnet mask value
- Find network address (multiple of block size ≤ IP)
- Broadcast = Network + Block Size - 1
- Usable range = Network+1 to Broadcast-1
Wildcard Mask
- Inverse of subnet mask
- 0 = must match, 1 = don't care
- Example: 255.255.255.0 → Wildcard: 0.0.0.255
ROUTING FUNDAMENTALS
Routing Methods
| Type | Description |
|---|---|
| Static | Manually configured routes |
| Dynamic | Automatically learned via protocols |
| Connected | Directly attached networks |
| Local | Router's own IP addresses (/32) |
Static Route Configuration
CLI
ip route <network> <mask> <next-hop>
ip route <network> <mask> <exit-interface>
ip route 0.0.0.0 0.0.0.0 <next-hop> # Default route
Administrative Distance (AD)
| Route Source | AD |
|---|---|
| Connected | 0 |
| Static | 1 |
| EIGRP Summary | 5 |
| eBGP | 20 |
| EIGRP (Internal) | 90 |
| OSPF | 110 |
| IS-IS | 115 |
| RIP | 120 |
| EIGRP (External) | 170 |
| iBGP | 200 |
| Unknown | 255 |
Lower AD = More trusted
VLANs & TRUNKING
VLAN Basics
- VLAN = Virtual LAN (separate broadcast domain)
- Default VLAN: 1 (cannot be deleted)
- Reserved VLANs: 1002-1005
- Extended Range: 1006-4094
VLAN Configuration
CLI
# Create VLAN
vlan 10
name SALES
# Assign port to VLAN
interface f0/1
switchport mode access
switchport access vlan 10
# View VLANs
show vlan brief
Trunk Configuration
Code
interface g0/1
switchport trunk encapsulation dot1q
switchport mode trunk
switchport trunk allowed vlan 10,20,30
switchport trunk native vlan 99
802.1Q Tag
- 4 bytes inserted in Ethernet frame
- TPID: 0x8100 (2 bytes)
- PCP: Priority (3 bits)
- DEI: Drop eligible (1 bit)
- VID: VLAN ID (12 bits) = 4096 VLANs
Router on a Stick (ROAS)
Code
interface g0/0.10
encapsulation dot1q 10
ip address 192.168.10.1 255.255.255.0
SPANNING TREE PROTOCOL
STP Versions
| Protocol | Standard | Description |
|---|---|---|
| STP | 802.1D | Original, one tree for all VLANs |
| PVST+ | Cisco | Per-VLAN STP |
| RSTP | 802.1w | Rapid convergence |
| Rapid PVST+ | Cisco | Rapid + Per-VLAN |
| MSTP | 802.1s | Multiple instances |
STP Port States
| State | Send/Receive | Learn MAC | Forward |
|---|---|---|---|
| Blocking | No | No | No |
| Listening | Yes | No | No |
| Learning | Yes | Yes | No |
| Forwarding | Yes | Yes | Yes |
| Disabled | No | No | No |
RSTP Port States
- Discarding = Blocking + Disabled
- Learning = Learning
- Forwarding = Forwarding
STP Port Roles
| Role | Description |
|---|---|
| Root Port | Best path to root bridge |
| Designated Port | Best port on segment |
| Non-Designated | Blocking port |
| Alternate (RSTP) | Backup to root port |
| Backup (RSTP) | Backup to designated |
Root Bridge Election
- Lowest Bridge ID (Priority + MAC)
- Default Priority: 32768
- Priority increments: 4096
STP Cost
| Speed | STP Cost | RSTP Cost |
|---|---|---|
| 10 Mbps | 100 | 2,000,000 |
| 100 Mbps | 19 | 200,000 |
| 1 Gbps | 4 | 20,000 |
| 10 Gbps | 2 | 2,000 |
STP Timers
- Hello: 2 seconds
- Forward Delay: 15 seconds
- Max Age: 20 seconds
STP Configuration
CLI
spanning-tree vlan 1 root primary # Set as root
spanning-tree vlan 1 priority 4096 # Set priority
spanning-tree portfast # Skip listening/learning
spanning-tree bpduguard enable # Protect portfast ports
ETHERCHANNEL
EtherChannel Protocols
| Protocol | Type | Modes |
|---|---|---|
| LACP | IEEE 802.3ad | Active, Passive |
| PAgP | Cisco | Desirable, Auto |
| Static | Manual | On |
Mode Compatibility
| Mode | Forms with |
|---|---|
| Active | Active, Passive |
| Passive | Active |
| Desirable | Desirable, Auto |
| Auto | Desirable |
| On | On only |
Configuration
CLI
# LACP
interface range g0/0-3
channel-group 1 mode active
# Configure port-channel
interface port-channel 1
switchport mode trunk
# Verify
show etherchannel summary
show etherchannel port-channel
Load Balancing Methods
Code
port-channel load-balance src-dst-ip
show etherchannel load-balance
DYNAMIC ROUTING
Protocol Types
| Type | Algorithm | Protocols |
|---|---|---|
| IGP | Distance Vector | RIP, EIGRP |
| IGP | Link State | OSPF, IS-IS |
| EGP | Path Vector | BGP |
Metrics by Protocol
| Protocol | Metric |
|---|---|
| RIP | Hop count (max 15) |
| EIGRP | Bandwidth + Delay |
| OSPF | Cost (bandwidth) |
| IS-IS | Cost |
RIP Configuration
Code
router rip
version 2
network 10.0.0.0
no auto-summary
passive-interface g0/0
default-information originate
EIGRP Configuration
Code
router eigrp 100
network 10.0.0.0 0.255.255.255
no auto-summary
passive-interface g0/0
EIGRP Terms
- Feasible Distance (FD): Total metric to destination
- Reported Distance (RD): Neighbor's metric
- Successor: Best route
- Feasible Successor: Backup route (RD < FD)
OSPF
OSPF Basics
- Type: Link State IGP
- Algorithm: Dijkstra's SPF
- AD: 110
- Multicast: 224.0.0.5 (all OSPF), 224.0.0.6 (DR/BDR)
- Protocol: 89
OSPF Areas
- Area 0: Backbone (required)
- ABR: Area Border Router
- ASBR: AS Boundary Router
OSPF Network Types
| Type | DR/BDR | Hello | Dead |
|---|---|---|---|
| Broadcast | Yes | 10s | 40s |
| Point-to-Point | No | 10s | 40s |
| Non-Broadcast | Yes | 30s | 120s |
OSPF Neighbor States
- Down → 2. Init → 3. 2-Way → 4. ExStart → 5. Exchange → 6. Loading → 7. Full
OSPF Cost
Code
Cost = Reference Bandwidth / Interface Bandwidth
Default Reference = 100 Mbps
OSPF Configuration
CLI
router ospf 1
router-id 1.1.1.1
network 10.0.0.0 0.0.0.255 area 0
passive-interface g0/0
auto-cost reference-bandwidth 10000
# Interface method
interface g0/0
ip ospf 1 area 0
ip ospf cost 10
ip ospf priority 100
OSPF Verification
Code
show ip ospf neighbor
show ip ospf interface
show ip ospf database
show ip route ospf
DR/BDR Election
- Highest OSPF Priority (default 1)
- Highest Router ID
- Priority 0 = Cannot be DR/BDR
IPv6
IPv6 Basics
- 128 bits (8 groups of 4 hex digits)
- Notation: 2001:0DB8:0000:0001:0000:0000:0000:0001
- Shortened: 2001:DB8:0:1::1
Shortening Rules
- Remove leading zeros in each group
- Replace consecutive all-zero groups with :: (once only)
IPv6 Address Types
| Type | Prefix | Description |
|---|---|---|
| Global Unicast | 2000::/3 | Public addresses |
| Link-Local | FE80::/10 | Local link only |
| Unique Local | FC00::/7 | Private addresses |
| Multicast | FF00::/8 | One-to-many |
| Loopback | ::1/128 | Localhost |
IPv6 Configuration
Code
ipv6 unicast-routing
interface g0/0
ipv6 address 2001:db8:0:1::1/64
ipv6 address fe80::1 link-local
ACCESS CONTROL LISTS
ACL Types
| Type | Number Range | Matches |
|---|---|---|
| Standard | 1-99, 1300-1999 | Source IP only |
| Extended | 100-199, 2000-2699 | Src/Dst IP, Protocol, Port |
ACL Rules
- Processed top to bottom
- First match wins
- Implicit deny at end
- Standard ACLs: Apply close to destination
- Extended ACLs: Apply close to source
Standard ACL
Code
access-list 1 deny 10.0.0.0 0.0.0.255
access-list 1 permit any
interface g0/0
ip access-group 1 out
Extended ACL
Code
ip access-list extended BLOCK_WEB
deny tcp 10.0.0.0 0.0.0.255 any eq 443
permit ip any any
interface g0/0
ip access-group BLOCK_WEB in
Port Operators
| Operator | Meaning |
|---|---|
| eq | Equal to |
| gt | Greater than |
| lt | Less than |
| neq | Not equal to |
| range | Range of ports |
NAT
NAT Types
| Type | Description |
|---|---|
| Static NAT | 1:1 mapping (permanent) |
| Dynamic NAT | Pool of public IPs |
| PAT/NAT Overload | Many:1 using ports |
NAT Terms
- Inside Local: Private IP (internal)
- Inside Global: Public IP (seen externally)
- Outside Local: External IP (seen internally)
- Outside Global: External public IP
NAT Configuration
CLI
# Static NAT
ip nat inside source static 192.168.1.10 203.0.113.10
# Dynamic NAT
ip nat pool POOL1 203.0.113.1 203.0.113.10 netmask 255.255.255.0
access-list 1 permit 192.168.1.0 0.0.0.255
ip nat inside source list 1 pool POOL1
# PAT (Overload)
ip nat inside source list 1 interface g0/1 overload
# Interface designation
interface g0/0
ip nat inside
interface g0/1
ip nat outside
TCP & UDP
TCP vs UDP
| Feature | TCP | UDP |
|---|---|---|
| Connection | Connection-oriented | Connectionless |
| Reliability | Yes (ACK) | No |
| Sequencing | Yes | No |
| Flow Control | Yes | No |
| Speed | Slower | Faster |
TCP 3-Way Handshake
Code
Client → SYN → Server
Client ← SYN-ACK ← Server
Client → ACK → Server
TCP Connection Termination
Code
FIN → ACK → FIN → ACK
Important Port Numbers
| Port | Protocol | Service |
|---|---|---|
| 20 | TCP | FTP Data |
| 21 | TCP | FTP Control |
| 22 | TCP | SSH |
| 23 | TCP | Telnet |
| 25 | TCP | SMTP |
| 53 | TCP/UDP | DNS |
| 67 | UDP | DHCP Server |
| 68 | UDP | DHCP Client |
| 69 | UDP | TFTP |
| 80 | TCP | HTTP |
| 110 | TCP | POP3 |
| 123 | UDP | NTP |
| 143 | TCP | IMAP |
| 161 | UDP | SNMP Agent |
| 162 | UDP | SNMP Manager |
| 443 | TCP | HTTPS |
| 514 | UDP | Syslog |
NETWORK SERVICES
DHCP
DORA Process:
- Discover (Broadcast)
- Offer (Unicast/Broadcast)
- Request (Broadcast)
- Ack (Unicast/Broadcast)
CLI
# DHCP Server
ip dhcp pool POOL1
network 192.168.1.0 255.255.255.0
default-router 192.168.1.1
dns-server 8.8.8.8
ip dhcp excluded-address 192.168.1.1 192.168.1.10
# DHCP Relay
interface g0/0
ip helper-address 10.0.0.100
DNS
- Purpose: Resolve hostname → IP
- Port: 53 (TCP/UDP)
Code
ip dns server
ip host SERVER1 10.0.0.10
ip name-server 8.8.8.8
ip domain lookup
NTP
- Purpose: Time synchronization
- Port: UDP 123
- Stratum: Distance from reference clock (0-15)
Code
ntp server 216.239.35.0
ntp master 3
ntp update-calendar
show ntp status
show ntp associations
SSH Configuration
Code
hostname R1
ip domain-name example.com
crypto key generate rsa modulus 2048
username admin secret cisco
line vty 0 15
transport input ssh
login local
ip ssh version 2
SECURITY
CIA Triad
- Confidentiality: Only authorized access
- Integrity: Data not tampered
- Availability: System accessible
Common Attacks
| Attack | Description |
|---|---|
| DoS/DDoS | Overwhelm resources |
| Spoofing | Fake source address |
| Man-in-the-Middle | Intercept communications |
| ARP Poisoning | Fake ARP replies |
| DHCP Starvation | Exhaust DHCP pool |
AAA
- Authentication: Verify identity
- Authorization: Grant permissions
- Accounting: Log activities
AAA Protocols
| Protocol | Type | Port |
|---|---|---|
| RADIUS | Open Standard | UDP 1812, 1813 |
| TACACS+ | Cisco | TCP 49 |
Port Security
CLI
interface f0/1
switchport mode access
switchport port-security
switchport port-security maximum 2
switchport port-security mac-address sticky
switchport port-security violation shutdown
# Violation modes: shutdown, restrict, protect
DHCP Snooping
Code
ip dhcp snooping
ip dhcp snooping vlan 10
interface g0/1
ip dhcp snooping trust
Dynamic ARP Inspection
Code
ip arp inspection vlan 10
interface g0/1
ip arp inspection trust
FIRST HOP REDUNDANCY PROTOCOLS
FHRP Comparison
| Feature | HSRP | VRRP | GLBP |
|---|---|---|---|
| Type | Cisco | Open | Cisco |
| Active/Standby | Active/Standby | Master/Backup | AVG/AVF |
| Multicast | 224.0.0.2 (v1), 224.0.0.102 (v2) | 224.0.0.18 | 224.0.0.102 |
| Load Balance | No | No | Yes |
HSRP Configuration
Code
interface g0/0
standby version 2
standby 1 ip 192.168.1.1
standby 1 priority 110
standby 1 preempt
Virtual MAC Addresses
- HSRP v1: 0000.0c07.acXX
- HSRP v2: 0000.0c9f.fXXX
- VRRP: 0000.5e00.01XX
- GLBP: 0007.b400.XXYY
NETWORK MANAGEMENT
SNMP
- Purpose: Monitor/manage devices
- Versions: v1, v2c, v3 (secure)
- Ports: UDP 161 (agent), 162 (manager)
| Message | Direction | Purpose |
|---|---|---|
| Get | NMS → Agent | Request info |
| Set | NMS → Agent | Change config |
| Trap | Agent → NMS | Alert (no ACK) |
| Inform | Agent → NMS | Alert (with ACK) |
Syslog
- Purpose: Log messages
- Port: UDP 514
| Level | Keyword | Description |
|---|---|---|
| 0 | Emergency | System unusable |
| 1 | Alert | Immediate action |
| 2 | Critical | Critical conditions |
| 3 | Error | Error conditions |
| 4 | Warning | Warning conditions |
| 5 | Notice | Normal but significant |
| 6 | Informational | Informational |
| 7 | Debug | Debug messages |
Mnemonic: Every Awesome Cisco Engineer Will Need Ice cream Daily
Code
logging host 10.0.0.100
logging trap informational
logging console warnings
logging buffered 8192
QUALITY OF SERVICE
QoS Markings
| Field | Layer | Bits | Values |
|---|---|---|---|
| PCP/CoS | L2 (802.1Q) | 3 | 0-7 |
| DSCP | L3 (IP) | 6 | 0-63 |
| IPP | L3 (IP) | 3 | 0-7 |
DSCP Values
| Name | DSCP | Use |
|---|---|---|
| DF | 0 | Best Effort |
| EF | 46 | Voice |
| AF41 | 34 | Video |
| AF31 | 26 | Streaming |
| CS6 | 48 | Network Control |
QoS Mechanisms
- Classification: Identify traffic types
- Marking: Tag packets with priority
- Queuing: Organize packets for transmission
- Shaping: Buffer excess traffic
- Policing: Drop/remark excess traffic
WIRELESS
Wi-Fi Standards
| Standard | Name | Frequency | Max Speed |
|---|---|---|---|
| 802.11a | - | 5 GHz | 54 Mbps |
| 802.11b | - | 2.4 GHz | 11 Mbps |
| 802.11g | - | 2.4 GHz | 54 Mbps |
| 802.11n | Wi-Fi 4 | 2.4/5 GHz | 600 Mbps |
| 802.11ac | Wi-Fi 5 | 5 GHz | 6.9 Gbps |
| 802.11ax | Wi-Fi 6 | 2.4/5/6 GHz | 9.6 Gbps |
2.4 GHz Channels
- Non-overlapping: 1, 6, 11
- Channel width: 22 MHz
Service Sets
| Type | Description |
|---|---|
| IBSS | Ad-hoc (no AP) |
| BSS | Single AP |
| ESS | Multiple APs |
| MBSS | Mesh network |
Wireless Terms
- SSID: Network name
- BSSID: AP MAC address
- BSA: Coverage area
- CSMA/CA: Collision avoidance
AP Modes
- Autonomous: Standalone
- Lightweight: Requires WLC
- FlexConnect: Local switching
QUICK REFERENCE - SHOW COMMANDS
CLI
# General
show running-config
show startup-config
show version
show ip interface brief
show interfaces status
# Layer 2
show mac address-table
show vlan brief
show interfaces trunk
show spanning-tree
show etherchannel summary
# Layer 3
show ip route
show ip protocols
show ip ospf neighbor
show ip ospf interface
show ip ospf database
# Security
show access-lists
show ip nat translations
show port-security interface
# Services
show ip dhcp binding
show ntp status
show logging
QUICK REFERENCE - FORMULAS
Code
Usable Hosts = 2^n - 2 (n = host bits)
Subnets = 2^n (n = borrowed bits)
Block Size = 256 - Subnet Mask Value
OSPF Cost = Reference BW / Interface BW
Last Updated: CCNA 200-301 Exam Topics