Networking interviews, practised out loud

A hub repeats every bit it receives out of every other port, so all its ports share one collision domain. A switch learns which MAC address is behind which port and forwards a frame only there, so each port is its own collision domain, but a switch still floods broadcasts, so all ports share one broadcast domain (per VLAN). A router forwards by IP address, joins different networks, and does not forward broadcasts, so each of its interfaces is its own broadcast domain.

I know thisFundamentals

The PC asks DNS for the server's IP address. It compares that address with its own subnet using its mask. If the server is on another network, the PC sends the packet to its default gateway, and first uses ARP to find the gateway's MAC address. Each router then looks up the destination in its routing table and forwards the packet to the next hop, rewriting the Layer 2 header at every hop while the IP addresses stay the same (unless NAT changes them). A TCP three-way handshake opens the connection, then HTTP or HTTPS runs on top of it.

The point interviewers listen for: MAC addresses change at every router, IP addresses do not.

I know thisFundamentals

The client sends SYN with its initial sequence number. The server replies SYN-ACK: it acknowledges the client's number and sends its own. The client sends ACK for the server's number, and the connection is established. Closing uses FIN and ACK from each side (a four-step exchange), and RST aborts a connection at once.

I know thisFundamentals

When speed and low delay matter more than guaranteed delivery, or when the application handles loss itself: voice and video, DNS queries, DHCP, SNMP, TFTP and most online games. UDP has no handshake, no retransmission and no ordering, so there is less overhead. TCP is for traffic that must arrive complete and in order, such as web pages, email and file transfers.

I know thisFundamentals

A /26 mask is 255.255.255.192, so the block size in the last octet is 256 - 192 = 64, and the networks start at 0, 64, 128 and 192. 77 falls in the block that starts at 64.

Network 192.168.10.64, broadcast 192.168.10.127, usable hosts 192.168.10.65 to .126, which is 62 hosts (2 to the power 6, minus 2).

I know thisAddressing

A collision domain is the set of devices whose frames can collide on a shared medium. Hubs extend it; switch ports and router interfaces each end one, and full-duplex links have no collisions at all. A broadcast domain is the set of devices that receive each other's Layer 2 broadcasts. Switches extend it (within a VLAN); routers and VLANs divide it.

I know thisFundamentals

It floods the frame out of every port in the same VLAN except the one it arrived on (unknown unicast flooding). The real owner replies, and the switch learns its MAC address and port from the source address of that reply. Broadcasts and multicasts are flooded the same way. Learned entries age out (300 seconds by default on Cisco switches) if they are not refreshed.

I know thisSwitching

A VLAN is a separate broadcast domain inside a switch, so devices in different VLANs cannot talk at Layer 2 and need a router (or a Layer 3 switch) between them. An access port belongs to one VLAN and sends frames untagged. A trunk port carries many VLANs over one link, tagging each frame with an 802.1Q header, except the native VLAN, which is sent untagged. Faults to know: a VLAN missing from the trunk's allowed list, a port in the wrong access VLAN, and a native VLAN mismatch.

I know thisSwitching Practise it in a lab →

The native VLAN is the one VLAN whose frames cross an 802.1Q trunk without a tag (VLAN 1 by default). If the two ends disagree, untagged frames from one side land in a different VLAN on the other side: traffic leaks between VLANs, and Cisco switches log CDP and spanning-tree native VLAN mismatch warnings. It also underlies the double-tagging attack, which is why the native VLAN should be an unused VLAN and not VLAN 1.

I know thisSwitching

The default gateway is the router address a host sends packets to when the destination is outside its own subnet. With a wrong or missing gateway a host can still talk to devices in its own subnet, but nothing beyond it: pings to local neighbours work, pings to other networks time out. That pattern is itself the diagnosis.

I know thisRouting

Static routes are simple, predictable and use no bandwidth, which suits small networks, stub sites and default routes, but they do not adapt to failures unless you add tracking. Dynamic protocols (OSPF, EIGRP, BGP) adapt to changes and scale. Administrative distance ranks how trustworthy a route source is when several offer the same prefix; lower wins: connected 0, static 1, eBGP 20, EIGRP 90, OSPF 110, RIP 120, external EIGRP 170, iBGP 200.

I know thisRouting Practise it in a lab →

DHCP has four steps, DORA: the client broadcasts Discover, a server answers Offer, the client broadcasts Request for that offer, and the server sends Acknowledge. Because the first message is a broadcast, it does not cross a router. If the DHCP server is in another subnet, the router interface facing the clients is given ip helper-address, and it relays the broadcast to the server as a unicast.

Symptom of a missing relay: clients in that VLAN self-assign 169.254.x.x addresses.

I know thisServices

NAT rewrites addresses as packets cross a boundary. Static NAT maps one private address to one public address; dynamic NAT takes addresses from a pool; PAT (overload) maps many private hosts to a single public address and tells them apart by port number. Inside local is the private address as the inside network sees it; inside global is the same host's address as the outside sees it. An empty translation table usually means the ACL did not match or the inside and outside interfaces are marked the wrong way round.

I know thisServices

Every switch has a bridge ID made of a priority (32768 by default, plus the VLAN number) and its MAC address. The lowest bridge ID becomes the root. Every other switch picks one root port, the port with the lowest path cost to the root. On each segment one designated port forwards, and any remaining port blocks (alternate), so there is no loop. Set the root yourself with a lower priority (spanning-tree vlan 10 root primary), because the default election can choose an old, slow switch.

I know thisSwitching

EtherChannel bundles several physical links into one logical link, so you get more bandwidth and redundancy, and spanning tree sees one link. LACP (the open standard, 802.3ad) uses active and passive: a channel forms if at least one end is active, and two passive ends never form one. PAgP (Cisco only) uses desirable and auto, and two auto ends never form. The member ports must match in speed, duplex, VLANs and trunk settings. Traffic is shared by a hash of addresses or ports, not packet by packet.

I know thisSwitching

IPv6 replaces broadcast with multicast, so only interested devices are disturbed, and it replaces ARP with Neighbor Discovery (Neighbor Solicitation and Advertisement over multicast). A host builds a link-local address (FE80::/10) on every interface. For a global address it can use SLAAC: the router sends a Router Advertisement with the prefix and the host makes up the interface ID, or it can use DHCPv6. A Cisco router needs ipv6 unicast-routing before it forwards IPv6 or sends advertisements.

I know thisAddressing Practise it in a lab →

"Administratively down" means somebody (or the default state of a new interface) shut the interface with the shutdown command; the fix is no shutdown. "Down / down" means the interface is enabled but there is no physical connection: a bad cable, an unplugged far end, or the other side shut down. "Up / down" means Layer 1 is fine but Layer 2 is not: a mismatched encapsulation, no keepalives, or a clock problem on a serial link.

I know thisOperations

The running configuration is in RAM and is what the device is using right now; every command you type changes it at once. The startup configuration is stored in NVRAM and is loaded when the device boots. If you do not copy running-config startup-config (or write memory), your changes are lost on a reload. The reverse is also useful: if a change breaks something, reloading without saving returns you to the last saved state.

I know thisOperations

Down, Init, 2-Way, ExStart, Exchange, Loading, Full. Stuck in Init: hellos are heard but ours are not seen by the other side, often an ACL or a one-way link. 2-Way is normal between two non-DR routers on a broadcast network. Stuck in ExStart or Exchange: almost always an MTU mismatch. Stuck in Loading: lost or corrupt LSAs. No neighbour at all: mismatched hello and dead timers, area ID, subnet or mask, authentication, stub flag, or a duplicate router ID.

I know thisOSPF Practise it in a lab →

On a broadcast or non-broadcast multi-access segment, the router with the highest interface priority becomes DR, and the highest router ID breaks a tie; the next best becomes BDR. A priority of 0 means never. The election is not pre-emptive: a router with a higher priority that joins later does not take over, and changing a priority later changes nothing until the adjacency is reset. That is why the DR is "whoever was there first" unless you plan it. The DR exists so routers form full adjacencies with two routers instead of with every neighbour.

I know thisOSPF Practise it in a lab →

Type 1 (Router): every router, inside its own area. Type 2 (Network): the DR lists the routers on a multi-access segment, inside the area. Type 3 (Summary): an ABR advertises inter-area prefixes (shown as O IA). Type 4 (ASBR Summary): an ABR tells other areas where the ASBR is. Type 5 (External): the ASBR advertises routes from outside OSPF to the whole domain except stub areas (O E1 or O E2). Type 7: the same job inside an NSSA, converted to type 5 by the ABR.

I know thisOSPF Practise it in a lab →

A stub area blocks type 5 external LSAs and the ABR injects a default route. A totally stubby area (Cisco: no-summary on the ABR) also blocks type 3 summaries, so the area learns only a default route. An NSSA blocks type 5 but allows an ASBR inside the area to inject external routes as type 7, which the ABR translates to type 5. All routers in the area must agree on the flag, because it is carried in the hello. The backbone, area 0, can never be a stub.

I know thisOSPF Practise it in a lab →

The successor is the best loop-free path to a destination, the one with the lowest feasible distance (FD), and it goes in the routing table. A feasible successor is a backup path whose reported distance (the neighbour's own distance) is lower than the successor's FD; that is the feasibility condition, and it guarantees the backup is loop-free. When the successor fails, DUAL switches to a feasible successor at once. With none, it queries its neighbours and the route goes active, which is slower.

I know thisEIGRP

By default the metric uses bandwidth (the slowest link on the path) and delay (the sum along the path); load and reliability are not used unless the K values are changed. The wide metric in named mode also handles very fast links. For two routers to become neighbours they need the same autonomous system number, the same K values, a shared subnet, and matching authentication if it is configured. Passive interfaces and ACLs blocking 224.0.0.10 are other common causes of no neighbour.

I know thisEIGRP Practise it in a lab →

Highest weight (Cisco only, local to the router), then highest local preference, then locally originated routes, then shortest AS path, then lowest origin (IGP before EGP before incomplete), then lowest MED, then eBGP over iBGP, then lowest IGP metric to the next hop, then the oldest route, then the lowest router ID. The practical summary: local preference decides outbound traffic inside your AS, and AS-path prepending and MED are how you try to influence inbound traffic.

I know thisBGP

A route learned from one iBGP peer is not passed on to another iBGP peer, to prevent loops, so iBGP needs a full mesh by default. You work around it with route reflectors (a reflector re-advertises routes between its clients) or confederations. Related: eBGP changes the next hop to itself and iBGP does not, so you usually need next-hop-self toward iBGP peers, or the next hop is unreachable and the route is not used.

I know thisBGP Practise it in a lab →

Different protocols use different metrics, so redistributed routes need a seed metric. Redistributing in both directions at two places can create loops, because a route can leave one protocol and return through the other, and administrative distance then decides which copy wins, often the wrong one. Make it safe by tagging routes as they are redistributed and denying that tag coming back, filtering with route-maps or prefix-lists, and redistributing at one point where you can.

I know thisRouting Practise it in a lab →

All three give hosts one virtual gateway address that survives a router failure. HSRP is Cisco's: one active and one standby router, default priority 100, hello 3 seconds and hold 10 seconds, and pre-emption is off by default. VRRP is the open standard: a master and backups, pre-emption on by default. GLBP, also Cisco, load-balances: one router (the AVG) hands out different virtual MAC addresses so several routers forward traffic for the same gateway address. With mixed vendors, choose VRRP.

I know thisHigh availability

RSTP converges in about a second or less by replacing timers with a proposal and agreement handshake between switches; the port roles are root, designated, alternate and backup, and the states are discarding, learning and forwarding. PortFast makes a host-facing port forward at once. BPDU Guard shuts down a PortFast port that receives a BPDU, which means a switch was plugged in by mistake. Root Guard stops a port from accepting a better bridge ID, so a rogue switch cannot become the root.

I know thisSwitching

It classifies traffic (by ACL, protocol recognition or an existing mark), marks it (DSCP in the IP header: EF 46 for voice, AF41 for interactive video, CS3 for signalling), and treats each class differently in the queues. Low Latency Queueing gives voice a strict priority queue with a bandwidth cap so it cannot starve the rest; CBWFQ shares what is left between the other classes. Mark at the edge, trust marks only from devices you control, and remember QoS only matters where there is congestion. Policing drops or re-marks excess traffic; shaping buffers it and delays it.

I know thisQoS

MPLS forwards packets by a short label instead of looking up the destination IP address at every hop. Labels are distributed by LDP (or by the IGP and BGP in some designs). Inside the core, a router swaps the top label and forwards, without needing the customer's routes. Penultimate hop popping means the second-to-last router removes the label, so the last router does one lookup instead of two. Its biggest uses are Layer 3 VPNs and traffic engineering.

I know thisMPLS

A standard ACL (1 to 99) matches only the source address, so place it close to the destination. An extended ACL (100 to 199) matches source, destination, protocol and port, so place it close to the source and drop unwanted traffic early. ACLs are read top to bottom and the first match wins, and every ACL ends with an implicit deny any. The wildcard mask is the inverse of the subnet mask (0.0.0.255 matches a whole /24). ACLs are stateless: they judge each packet alone and do not remember connections.

I know thisACLs Practise it in a lab →

An ACL checks every packet against its rules and has no memory. A stateful firewall records each connection that an allowed packet opens, then lets the return traffic back in automatically and drops unsolicited packets arriving from the outside. On an ASA, the security levels (inside 100, outside 0, DMZ in between) allow traffic from high to low by default and need an explicit permit from low to high; since version 8.3 the ACL names the server's real address, not its translated one.

I know thisFirewalls

Phase 1 (the IKE SA) authenticates the two peers and agrees the encryption, hash, Diffie-Hellman group and lifetime that protect their own negotiation. Phase 2 (the IPsec SA) then negotiates how the actual data is protected, usually with ESP, for the traffic matched by the crypto ACL. Both sides must match on proposals, pre-shared key, and mirrored ACLs. It uses UDP 500, UDP 4500 for NAT traversal, and ESP (IP protocol 50). Phase 1 up but no encrypted traffic usually points at the crypto ACL or routing.

I know thisVPN

DHCP snooping lets only trusted ports answer DHCP, which stops rogue DHCP servers, and it builds a binding table of IP, MAC, VLAN and port. Dynamic ARP Inspection uses that table to drop forged ARP replies, which stops ARP spoofing and man-in-the-middle attacks. Port security limits how many MAC addresses a port may learn and what it does when the limit is broken (shut down, restrict or protect), which stops MAC flooding and unauthorised devices.

I know thisLayer 2 security

Switch spoofing: an attacker's device negotiates a trunk using DTP and then reaches every VLAN. Double tagging: the attacker adds two 802.1Q tags, and the first switch strips the one matching the native VLAN and forwards the frame with the inner tag into another VLAN. Prevent it by turning DTP off (switchport nonegotiate), setting access ports explicitly to access mode, using an unused VLAN as the native VLAN, and pruning the allowed VLANs on trunks.

I know thisLayer 2 security

AAA is authentication (who are you), authorisation (what may you do) and accounting (what did you do). RADIUS is an open standard over UDP that combines authentication and authorisation and encrypts only the password; it is common for network access such as Wi-Fi and VPN. TACACS+ is Cisco's, uses TCP, separates the three functions and encrypts the whole packet body, which is why it is preferred for device administration with per-command authorisation.

I know thisAAA Practise it in a lab →

Telnet sends everything, including passwords, in clear text; SSH encrypts the session. Steps: set a hostname and a domain name, generate RSA keys (crypto key generate rsa, 2048 bits), create a local user, set the vty lines to transport input ssh with login local, and use SSH version 2. Then restrict who may connect with an ACL on the vty lines (access-class), and set an exec-timeout.

I know thisDevice hardening Practise it in a lab →

Define the problem precisely first: who, what, since when, and what changed. Then follow the packet, in both directions: is the interface up, does the host have the right address and gateway, is there a route there and a route back, is an ACL or firewall in the way. Test the middle of the path to halve the search, compare a working device with a failing one, change one thing at a time and write it down, and confirm the fix and that nothing next to it broke.

I know thisMethod

IP connectivity is fine, so the fault is name resolution. Check that the host has a DNS server configured and that it is reachable (DHCP options or a static setting), that the DNS server answers (nslookup or dig against it), and that the name exists. On a Cisco router, ip domain-lookup with no name server configured causes long delays when a mistyped command is treated as a hostname.

I know thisConnectivity

That is an automatic private address (APIPA): the client sent DHCP discovers and got no offer. Check that the DHCP server is running and has free addresses in the pool, that the client port is in the right VLAN, that the trunk carries the VLAN, and, if the server is in another subnet or VLAN, that the gateway interface has ip helper-address pointing at it. DHCP snooping on an untrusted uplink can also silently drop the server's replies.

I know thisConnectivity

Each host needs the right address, mask and gateway for its VLAN. Then the inter-VLAN routing: a router-on-a-stick sub-interface or a Layer 3 switch SVI for each VLAN, with the interface up and the right dot1Q encapsulation. Check the trunk between the switch and the router carries both VLANs and the native VLAN matches, and that no ACL on the SVI or sub-interface blocks the traffic. The ARP table on each host tells you whether the gateway answers at all.

I know thisConnectivity Practise it in a lab →

ExStart and Exchange are where the routers swap database descriptions, and the classic cause of a stall there is an MTU mismatch: one side sends a database description packet the other cannot accept. Compare the MTU on both interfaces (show interfaces, show ip ospf interface) and make them equal; ip ospf mtu-ignore hides the problem rather than fixing it. A duplicate router ID, or an ACL dropping unicast packets between the two, are the next things to check.

I know thisOSPF Practise it in a lab →

A duplex or speed mismatch: one side is set to full duplex and the other falls back to half duplex (when auto-negotiation is turned off on one end), producing late collisions, CRC errors and runts on the half-duplex side while the link stays "up". Compare show interfaces on both ends, set both to auto, or hard-set both identically. A bad cable or a damaged port also causes CRC errors, so test those next.

I know thisPerformance

Outbound is yours to control: raise the local preference on routes from the preferred exit, because it is shared across your whole AS and is checked early. Inbound can only be influenced, because the choice is made in other networks: AS-path prepending makes a path look longer, MED suggests an entry point to one neighbouring AS, and communities let you ask a provider to change its local preference or stop advertising to certain peers. Communities are not sent unless send-community is enabled on the neighbour.

I know thisBGP

VXLAN carries Layer 2 frames inside UDP (port 4789) with a 24-bit VNI, giving about 16 million segments instead of 4094 VLANs, and VTEPs at the edge encapsulate and decapsulate. BGP EVPN is the control plane that replaces flood-and-learn: route type 2 carries MAC and MAC/IP addresses, type 3 carries the multicast membership used for broadcast, unknown unicast and multicast, and type 5 carries IP prefixes for routing between VNIs. An anycast gateway lets every leaf answer for the same default gateway so hosts can move.

I know thisData centre

The route distinguisher (RD) is added to a customer prefix to make it unique inside the provider's BGP, so two customers can both use 10.0.0.0/24; it does not control who gets the route. The route target (RT) is an extended community that does the controlling: a VRF exports routes with an RT and imports routes that carry the RTs it is configured for, which is how sites are joined into a VPN, or kept apart. The PEs exchange the routes with MP-BGP in the vpnv4 address family, and the packet carries two labels, a transport label and a VPN label.

I know thisMPLS

A router accepts a multicast packet only if it arrives on the interface the router would itself use to reach the packet's source (or the RP for shared-tree traffic). This is the reverse path forwarding check, and it prevents loops. If the unicast route toward the source points out of a different interface than the one the stream arrives on, the packet is dropped, even when the multicast tree looks perfect. Fix the unicast routing, or add a static mroute. Check with show ip rpf.

I know thisMulticast

Detect the failure fast: BFD with timers of tens or hundreds of milliseconds, instead of waiting for routing hellos and dead timers. Then react fast: tune the IGP (fast hellos, SPF and LSA throttling, incremental SPF), and pre-compute backup paths so forwarding can switch before the protocol reconverges, such as EIGRP feasible successors, OSPF loop-free alternates or MPLS fast reroute, and BGP PIC. Remember the trade-off: aggressive timers on a flapping link make the network less stable, so test them.

I know thisConvergence

Physical (cables, hubs, signals), Data Link (Ethernet, MAC addresses, switches), Network (IP, routers), Transport (TCP and UDP, port numbers), Session (keeps a conversation open, for example NetBIOS or RPC), Presentation (formats and encrypts data, for example TLS or JPEG) and Application (HTTP, DNS, SMTP).

In practice engineers use the TCP/IP model, which folds the top three into one application layer. What interviewers want is that you troubleshoot from the bottom up: link first, then addressing, then the application.

I know thisFundamentals

ARP finds the MAC address for an IPv4 address on the same subnet. The host broadcasts "who has 10.1.1.1?", the owner answers with its MAC address in a unicast reply, and both sides cache the result (show ip arp, arp -a). For an address on another subnet the host ARPs for its default gateway, never for the remote host.

A gratuitous ARP is an ARP a device sends about its own address without being asked. It detects duplicate IP addresses and updates other devices' caches after a failover, for example when an HSRP standby becomes active.

I know thisFundamentals

A MAC address is a 48-bit hardware address burned into the network card. It is flat, has no idea of location, and is only used on the local link. An IP address is a logical, hierarchical address (network part and host part) assigned by configuration or DHCP, and routers use it to forward across networks.

We need both because routing needs a hierarchy that scales, while delivery on each link needs the hardware address. ARP joins the two. The MAC address changes at every router hop; the IP addresses stay the same end to end (unless NAT changes them).

I know thisFundamentals

FTP 20/21, SSH 22, Telnet 23, SMTP 25, DNS 53 (UDP, and TCP for zone transfers and large replies), DHCP 67 server / 68 client, TFTP 69, HTTP 80, NTP 123, SNMP 161 and traps on 162, HTTPS 443, Syslog 514 (UDP), RDP 3389. For routing: BGP uses TCP 179, OSPF is IP protocol 89 and EIGRP is IP protocol 88, so they have no port at all.

Interviewers often follow up with "TCP or UDP?", so know which transport each one uses.

I know thisFundamentals

A /26 (255.255.255.192). It has 6 host bits, so 2 to the power 6 minus 2 = 62 usable addresses, the smallest block that fits 50. A /27 gives only 30. The first such subnet is 10.10.0.0/26, usable .1 to .62, broadcast .63, and the /24 holds four of them.

The method to say aloud: find the smallest power of two that is at least the hosts plus 2, the number of host bits is that power, and the prefix is 32 minus it.

I know thisAddressing

10.0.0.0/8, 172.16.0.0/12 (172.16 to 172.31) and 192.168.0.0/16, defined in RFC 1918. They are not routed on the internet, so every organisation can reuse them inside, and NAT/PAT translates them to public addresses on the way out. They exist because there are not enough public IPv4 addresses for every device.

Related ranges worth knowing: 127.0.0.0/8 loopback, 169.254.0.0/16 link-local (APIPA), and 100.64.0.0/10 for carrier-grade NAT.

I know thisAddressing

Drop leading zeros in each 16-bit group, and replace one run of all-zero groups with "::", once only, or the address becomes ambiguous. 2001:0db8:0000:0000:0000:0000:0000:0001 becomes 2001:db8::1.

Types: global unicast (2000::/3, routable on the internet), link-local (fe80::/10, on every interface, used for neighbour discovery and as the next hop of routing protocols), unique local (fc00::/7, the private range), multicast (ff00::/8, which replaces broadcast) and anycast (one address on several devices, the nearest answers).

I know thisAddressing

A Layer 2 switch forwards frames by MAC address inside a VLAN. To move traffic between VLANs it needs a router, often as router-on-a-stick with subinterfaces on a trunk. A Layer 3 switch can also route: you create SVIs (interface vlan 10 with an IP address) and enable ip routing, and it routes between VLANs in hardware at wire speed. It can also make a port routed with no switchport.

In campus networks the distribution and core layers are usually Layer 3 switches.

I know thisSwitching

One router interface connected to a switch trunk routes between VLANs by using one subinterface per VLAN. On the router: interface g0/0.10, encapsulation dot1Q 10, ip address 192.168.10.1 255.255.255.0, and the same for each VLAN, and the physical interface must be no shutdown. On the switch the port facing the router is a trunk allowing those VLANs. Each VLAN's hosts use their subinterface address as the default gateway.

The common faults: wrong VLAN number in encapsulation dot1Q, the VLAN not allowed on the trunk, or the physical interface left shut.

I know thisSwitching

Both are neighbour discovery protocols: every device announces its name, model, software, the port it is sending from and its management address, so show cdp neighbors detail or show lldp neighbors detail draws the physical topology without walking to the rack. CDP is Cisco only; LLDP is the open standard for mixed vendors, and IP phones use LLDP-MED or CDP to learn their voice VLAN.

Turn it off on ports facing the internet, customers or untrusted users, because it gives an attacker the model and software version to look up vulnerabilities.

I know thisSwitching

VTP (VLAN Trunking Protocol) copies the VLAN database from a server switch to clients in the same domain over trunks, so VLANs are created in one place. Modes are server, client and transparent (transparent passes VTP on but keeps its own VLANs), and version 3 adds a primary server.

The danger: a switch with a higher configuration revision number, added to the network with the same domain name, can overwrite every switch's VLAN list and drop users from their VLANs. Many sites therefore run transparent mode, or reset the revision (change the domain name) before connecting a switch.

I know thisSwitching

Longest prefix match comes first, always. If the table has 10.0.0.0/8 via R1 and 10.1.1.0/24 via R2, traffic for 10.1.1.5 goes to R2, because /24 is more specific, whatever the administrative distance or metric.

Administrative distance only decides between the same prefix learned from different sources (for example OSPF 110 against a static route 1), and the metric decides between routes to the same prefix from the same protocol. Interviewers like this question because many candidates say "lowest AD" first.

I know thisRouting

A static route configured with a higher administrative distance than the main route, so it stays out of the routing table until the main route disappears. For example, the primary path is learned by OSPF (AD 110), and ip route 0.0.0.0 0.0.0.0 203.0.113.1 200 is the backup over a second link. When OSPF loses the route, the static one is installed.

Watch for: a static route to an Ethernet next hop is only removed when that interface goes down, so for real failover track the path with IP SLA.

I know thisRouting

RIP is a distance-vector protocol that counts hops (maximum 15), sends its table periodically and converges slowly; it is mainly for labs and tiny networks. OSPF is an open-standard link-state protocol: every router in an area has the same map and runs SPF, the metric is cost from bandwidth, and it scales with areas. EIGRP is an advanced distance-vector protocol, originally Cisco, with a composite metric (bandwidth and delay by default), DUAL, and pre-computed backup paths (feasible successors), so it converges very fast.

AD: EIGRP 90, OSPF 110, RIP 120.

I know thisRouting

The client asks its configured DNS server, which answers from its cache or resolves recursively: it asks a root server, which points to the top-level domain server (.com), which points to the domain's authoritative server, which gives the answer. The answer is cached for its TTL.

Records: A (name to IPv4), AAAA (to IPv6), CNAME (an alias to another name), MX (mail server for a domain), PTR (reverse lookup, IP to name), NS (the authoritative servers) and TXT (free text, used for SPF and domain verification). Queries use UDP 53; large answers and zone transfers use TCP 53.

I know thisServices

Because logs, debugs, certificates and authentication all depend on the right time. Without NTP, syslog messages from different devices cannot be lined up during an outage, certificates can look expired or not yet valid, and Kerberos or one-time passwords fail.

Configure ntp server with two or more sources, set the time zone, and add service timestamps log datetime msec so logs carry the time. Stratum says how far a clock is from the reference: a lower stratum is closer. NTP authentication stops a rogue server from moving the clock.

I know thisServices

SNMP lets a monitoring system read counters and status from devices (polling with GET, interface traffic, CPU, errors) and receive alerts the device sends on its own (traps or informs). Each value has an OID in a MIB.

SNMPv1 and v2c protect access with only a community string, sent in clear text, and a read-write community lets anyone who sniffs it change the configuration. SNMPv3 adds users, authentication (SHA) and encryption (AES); use the authPriv level. In any version, restrict SNMP to the management station with an ACL.

I know thisServices

Password recovery through the console: reload, send a Break during boot to enter ROMMON, set the configuration register to 0x2142 (confreg 0x2142) so the router ignores the startup configuration, and boot. Then copy startup-config running-config to bring the configuration back without losing it, set a new enable secret, set config-register 0x2102, and copy running-config startup-config.

Watch for: interfaces come up shut after the copy, so no shutdown them, and the register must go back to 0x2102 or the next reload loses the configuration again.

I know thisOperations

Eight levels, 0 to 7: emergencies, alerts, critical, errors, warnings, notifications, informational, debugging. A lower number is more severe, and choosing a level sends that level and everything more severe.

A common choice is logging trap informational (6) to the syslog server, which includes interface up/down (level 3 and 5 messages) and configuration changes, with logging buffered for the local copy. Debugging (7) is only for a short troubleshooting window, because it can flood the CPU and the server.

I know thisOperations

2.4 GHz travels further and through walls better, but it has only three non-overlapping 20 MHz channels (1, 6 and 11), is crowded, and suffers interference from Bluetooth and microwaves. 5 GHz has many more channels and more speed, but a shorter range. 6 GHz (Wi-Fi 6E) adds even more clean spectrum.

In a design, neighbouring access points use different channels, and clients that can are steered to 5 GHz (band steering).

I know thisWireless

An autonomous AP is configured one by one and does everything itself. A lightweight AP joins a wireless LAN controller with CAPWAP: the controller holds the configuration, channels and power for all APs, and control traffic (and by default client data) is tunnelled to it. In FlexConnect mode the AP switches data locally, which suits branches.

The controller model gives central management, roaming between APs, and radio resource management across the whole site.

I know thisWireless

The data plane forwards packets (lookups, rewriting headers, sending out the port). The control plane decides how to forward (routing protocols, spanning tree, ARP) and builds the tables the data plane uses. The management plane is how people and tools reach the device (SSH, SNMP, APIs).

Software-defined networking moves the control decisions, or at least the configuration, to a central controller that talks to devices through southbound APIs (NETCONF, RESTCONF, OpenFlow) and offers northbound REST APIs to applications. Cisco DNA Center and ACI are examples.

I know thisAutomation

JSON is a text format for structured data: objects in curly braces with "key": value pairs, arrays in square brackets, and strings, numbers, true, false and null. REST APIs mostly use it. XML says the same with opening and closing tags, and NETCONF uses it. YAML says it with indentation and dashes and is easy for people to write, which is why Ansible playbooks use it.

All three carry the same data; the skill is reading a nested structure and finding a value, for example the IP address of an interface inside a list of interfaces.

I know thisAutomation

OSPF is a two-level hierarchy: inter-area routes are passed by ABRs through the backbone, and an ABR only accepts summary LSAs heard over area 0. This rule stops inter-area routing loops. An area that does not touch area 0 cannot get or give inter-area routes.

A virtual link is a logical area 0 connection tunnelled through a transit area between two ABRs (area 1 virtual-link <router-id>). It is a repair tool, for example after a merger, and the transit area cannot be a stub. The real fix is to redesign so every area touches the backbone.

I know thisOSPF

Broadcast (the Ethernet default) discovers neighbours with multicast hellos and elects a DR and BDR, with hello 10 and dead 40 seconds. Point-to-point has no DR election and forms the adjacency directly; it is the best choice on a link with only two routers, even an Ethernet one, because it converges faster and makes a simpler LSA. Non-broadcast (old Frame Relay) needs neighbours configured by hand and has 30/120 timers. Point-to-multipoint treats a hub-and-spoke cloud as a set of point-to-point links with no DR.

A network type mismatch can still form a neighbour but leaves routes missing, because the two sides describe the link differently in their LSAs.

I know thisOSPF

Only at area borders: an ABR summarises inter-area routes with area X range, and an ASBR summarises external routes with summary-address. Inside an area every router must have the identical link-state database, because each one runs SPF on that same map, so no router can hide detail inside its own area.

Summarisation shrinks routing tables and stops a flapping link in one area from causing SPF runs elsewhere. The cost: a summary can attract traffic for a destination that is actually down (a black hole), so a discard route to Null0 is installed on the summarising router.

I know thisOSPF

A stub router (eigrp stub connected summary, the default) tells its neighbours it is not a transit path. When a route is lost, the hub routers do not send queries to the stub, which keeps the query domain small. Without it, a hub with hundreds of spokes would query every spoke and could hit stuck-in-active, where a query is never answered and the neighbour is reset.

Use it on every branch router in hub-and-spoke designs. Summarisation also bounds queries, because a router that only has the summary answers immediately.

I know thisEIGRP

It turns on unequal-cost load balancing, which only EIGRP among the common IGPs can do. With variance 2, any feasible successor whose metric is less than twice the best metric is also installed, and traffic is shared in proportion to the metrics.

The route must still pass the feasibility condition (its reported distance is lower than the current feasible distance), so variance can never add a loop. maximum-paths limits how many routes are installed.

I know thisEIGRP

Idle, Connect, Active, OpenSent, OpenConfirm, Established. Idle waits to start, Connect is trying the TCP connection to port 179, Active means that attempt failed and BGP keeps retrying, OpenSent and OpenConfirm exchange and check the OPEN messages, and Established exchanges routes.

Stuck in Active usually means no TCP session: the neighbour address is not reachable, the peering uses loopbacks without update-source loopback0 (or without ebgp-multihop for eBGP), an ACL or firewall blocks TCP 179, or the other side has no neighbour statement for us. A wrong remote-as shows up as a notification during OpenSent instead.

I know thisBGP

An eBGP route keeps the external neighbour's address as its next hop when it is passed to iBGP peers. If those internal routers have no route to that external address (it is usually not in the IGP), the BGP route is not valid and is never used.

neighbor X next-hop-self on the border router rewrites the next hop to its own address (normally a loopback reachable through the IGP). The alternative is to advertise the external link into the IGP. On a route reflector, next-hop-self is not applied to reflected routes by default.

I know thisBGP

A route reflector is allowed to break the iBGP split-horizon rule: it reflects routes learned from a client to all other clients and non-clients, and routes from non-clients to clients. So the clients only need a session with the reflector instead of a full mesh, which for n routers would be n(n-1)/2 sessions.

Loops are prevented by two attributes the reflector adds: ORIGINATOR_ID (the router that first put the route into the AS, which ignores it if it comes back) and CLUSTER_LIST (the clusters the route passed through; a reflector that sees its own cluster ID drops it). Use two reflectors per cluster for redundancy.

I know thisBGP

PBR forwards packets by rules other than the destination address: a route-map matches traffic with an ACL (source address, port, protocol) and sets the next hop or the exit interface, and it is applied with ip policy route-map on the incoming interface.

Uses: sending guest traffic out of a cheaper internet link, sending one application over a specific path, or forcing traffic through a firewall. Watch for: it only applies to traffic entering the interface it is on, it bypasses the routing table so a dead next hop can black-hole traffic unless you track it with IP SLA, and traffic the router generates itself needs ip local policy.

I know thisRouting

A VRF (virtual routing and forwarding instance) is a separate routing table on one router. Interfaces are placed in a VRF, and their routes and traffic stay inside it, so overlapping addresses can be used in different VRFs, like several routers in one box.

VRF-Lite is VRFs without MPLS: each VRF is carried between routers on its own subinterface or VLAN, with a routing protocol per VRF. It is used to separate guest, corporate and management traffic. Commands remember the VRF: ping vrf GUEST 10.1.1.1, show ip route vrf GUEST.

I know thisRouting

Unicast reverse path forwarding checks the source address of each arriving packet against the routing table. In strict mode the packet is dropped unless the best route back to its source points out of the same interface it came in on; in loose mode the source only has to be in the table at all.

It stops spoofed source addresses, which is the basis of many denial-of-service attacks (BCP 38). Use strict mode on single-homed customer edges, and loose mode where routing can be asymmetric, such as multi-homed internet edges, because strict mode would drop legitimate traffic there.

I know thisRouting

IP SLA sends a test (an ICMP echo, a DNS query, an HTTP request) every few seconds from the router, and a track object turns up or down with its result. Statics and HSRP can depend on a track object.

For a dual-ISP edge: ip sla 1 icmp-echo to a reliable address beyond ISP 1, sourced from the ISP 1 interface; track 1 ip sla 1 reachability; ip route 0.0.0.0 0.0.0.0 ISP1 track 1; and a floating default via ISP 2 with AD 10. If the far side of ISP 1 fails while our link stays up, the route is removed and traffic moves to ISP 2. Without tracking it would keep forwarding into the dead path.

I know thisHigh availability

PVST+ runs one classic 802.1D spanning tree per VLAN, with slow (30 to 50 second) convergence. Rapid PVST+ runs one 802.1w RSTP instance per VLAN, converging in about a second with proposal and agreement. Both let you load-share by making different switches root for different VLANs, but a large number of VLANs means many instances, each sending BPDUs.

MST (802.1s) maps many VLANs to a few instances, so you might have two instances for 1000 VLANs. All switches in an MST region must agree on region name, revision and VLAN-to-instance mapping, or they become separate regions.

I know thisSwitching

Both protect against a unidirectional link: one fibre strand fails, so a switch still sends but no longer receives. A blocking port that stops receiving BPDUs would decide the root path has gone and start forwarding, creating a loop.

UDLD sends its own hellos and in aggressive mode err-disables a port that stops hearing its neighbour. Loop Guard puts a non-designated port that stops getting BPDUs into loop-inconsistent (blocking) instead of forwarding, and recovers when BPDUs come back. Use them on point-to-point links between switches, especially fibre.

I know thisSwitching

Classification picks out traffic (by ACL, NBAR or existing marking). Marking writes a value into the packet so later devices trust it: DSCP in the IP header (EF 46 for voice, AF41 for video, CS3 or AF31 for signalling), or CoS in the 802.1Q tag.

Policing enforces a rate by dropping or re-marking the excess at once, so it suits incoming traffic and provider edges. Shaping buffers the excess and sends it later, smoothing the rate at the cost of delay, so it suits outgoing traffic toward a slower provider rate. Queuing (LLQ, CBWFQ) then decides what leaves first under congestion.

I know thisQoS

After a merger both companies may use 10.1.0.0/16. To let them talk without renumbering, the router translates both directions: inside sources become an address the other side does not use, and the outside overlapping addresses are presented as a different block (ip nat outside source static or a pool). DNS answers must also be translated, or the hosts get the real overlapping address.

The same idea appears with partners and VPNs, where each side is only shown a translated range. It works, but troubleshooting gets harder, which is why renumbering is the long-term fix.

I know thisServices

GRE is a tunnel that wraps any packet, including multicast, in a new IP header, so routing protocols can run across it, but it does not encrypt. IPsec encrypts but on its own (policy-based) does not carry multicast routing traffic. GRE over IPsec gives both: routing protocols run in the tunnel and IPsec protects it.

DMVPN builds on this with multipoint GRE and NHRP: spokes have one tunnel to the hub, register their public address with it, and build spoke-to-spoke tunnels on demand (phase 2 and phase 3), so the hub does not need a configuration line per spoke and branch-to-branch traffic does not trombone through the hub.

I know thisVPN

Both configure and read devices using YANG data models instead of CLI text. NETCONF runs over SSH (port 830), encodes in XML, and has operations such as get, get-config, edit-config and commit with candidate datastores and locking, so a change can be validated and applied as one transaction.

RESTCONF exposes the same YANG data over HTTPS with REST verbs (GET, POST, PUT, PATCH, DELETE) and JSON or XML, so it is easy to use from any HTTP tool or language. Choose NETCONF for transactional changes across many devices, RESTCONF for simple integrations and reading state.

I know thisAutomation

YANG is a modelling language that describes what configuration and state data a device has and how it is structured: containers, lists with keys, leaves with types and limits. A model, for example ietf-interfaces or the vendor's native model, says exactly what an interface entry looks like.

NETCONF, RESTCONF and gNMI carry data that follows these models, which is what makes automation reliable: you send structured data that is checked against the model instead of screen-scraping CLI output. OpenConfig models aim to be the same across vendors.

I know thisAutomation

Ansible is agentless: a control node reads an inventory of devices and runs playbooks (YAML) of tasks using modules, which for network devices connect over SSH (network_cli) or NETCONF/HTTP APIs. Variables and Jinja2 templates generate per-device configuration.

Idempotent means running the same playbook twice gives the same result and the second run changes nothing, because the module compares the desired state with the current state and only acts on differences. Use --check and --diff to see what would change before touching production.

I know thisAutomation

Read the device list from a file or inventory, then connect to each switch with a library such as Netmiko (SSH and CLI) or NAPALM (one API for several vendors), run the show command, and save or parse the result. Parse with TextFSM or Genie templates so you get structured data instead of text, and run the connections in parallel (threads or Nornir) so 100 devices take seconds, not minutes.

Good answers mention: credentials from a vault or environment, never in the script; handling timeouts and devices that fail without stopping the run; and logging which devices succeeded.

I know thisAutomation

Every leaf (where servers connect) links to every spine, and spines never link to each other. Any server is therefore exactly leaf, spine, leaf away from any other, so delay is predictable, and with a routed underlay (OSPF, IS-IS or eBGP) and ECMP all links are active.

The three-tier design (access, aggregation, core) was built for north-south traffic and relied on spanning tree, which blocks links. Modern applications send mostly east-west traffic between servers, and spine-leaf scales out simply: add spines for bandwidth, add leaves for ports. VXLAN EVPN usually provides the Layer 2 overlay on top.

I know thisData centre

Virtual port channel lets two Nexus switches act as one for port channels, so a server or switch can bundle links to both and lose either switch without spanning tree blocking anything.

The peer link carries control traffic (synchronising MAC tables and state) and, during a failure, data between the peers, so it is a high-bandwidth port channel. The peer keepalive is a separate heartbeat (usually the management network) that tells each switch whether the other is alive, so they can tell a peer-link failure from a dead peer and avoid both acting as primary (split brain). Both must have the same vPC domain, and consistency checks block a vPC whose configuration differs.

I know thisData centre

Personal (PSK) uses one shared passphrase for everyone, so one leak means changing it on every device, and you cannot tell users apart. Enterprise uses 802.1X: the access point (or WLC) is the authenticator, it passes EAP between the client and a RADIUS server (for example Cisco ISE), and each user logs in with their own credentials or certificate (PEAP or EAP-TLS). The RADIUS server can return a VLAN or policy per user.

WPA3 improves both: SAE replaces the PSK handshake (resisting offline password guessing), and an Enterprise 192-bit mode exists.

I know thisWireless

Every ACL ends with an invisible deny any, so traffic that matches no line is dropped. An ACL with only deny lines therefore blocks everything.

Common mistakes: the order of lines (the first match wins, so a broad permit above a specific deny makes the deny useless); wrong wildcard masks (0.0.0.255, not 255.255.255.0); applying it in the wrong direction (in versus out) or on the wrong interface; forgetting return traffic or routing protocol traffic, which the implicit deny then blocks; and editing a numbered ACL by deleting it, which removes the whole list. Use named ACLs with sequence numbers and check the hit counters with show access-lists.

I know thisACLs

With security levels: each interface has a level from 0 (outside, untrusted) to 100 (inside, trusted). Traffic from a higher level to a lower level is allowed by default, traffic from lower to higher is denied unless an access-list permits it, and traffic between interfaces of the same level is denied unless same-security-traffic permit is set.

Because the ASA is stateful, return traffic for an allowed connection is allowed automatically. Once an ACL is applied to an interface, it replaces the default for that direction. Modern firewalls (FTD, zone-based firewalls) use zones and policies instead of levels, but the idea is the same.

I know thisFirewalls

A DMZ is a separate network segment, usually a third firewall interface, for servers the internet must reach, such as web, mail or DNS servers. The firewall allows the internet in to those services only, and allows little or nothing from the DMZ into the internal network.

If a public server is compromised, the attacker lands in the DMZ, not inside, and still has to get through the firewall to reach internal systems. The internal network can reach the DMZ servers for management, but connections the other way are tightly limited.

I know thisFirewalls

A stateful firewall decides by addresses, ports and connection state. A next-generation firewall also identifies the application whatever port it uses (so it can allow Teams but block a file-sharing app on 443), ties traffic to users and groups from the directory, runs an intrusion prevention system against known attacks, filters URLs by category, checks files for malware, and can decrypt TLS to inspect it.

The trade-offs: decryption and deep inspection cost throughput, and decryption raises privacy and certificate questions, so policies usually exclude banking and health sites.

I know thisFirewalls

A site-to-site VPN joins two networks: the routers or firewalls at each site build an IPsec tunnel between them, and users notice nothing. A remote-access VPN connects one user's device to the company network, using a client (AnyConnect/Secure Client, GlobalProtect) over SSL/TLS or IPsec, with user authentication, often with MFA, and an address from a pool.

For remote access, also know split tunnelling: only company traffic goes through the tunnel and internet traffic goes direct, which saves bandwidth but means internet traffic is not inspected by the company.

I know thisVPN

Phase 1 first (show crypto isakmp sa or show crypto ikev2 sa): the peers must reach each other (UDP 500, and 4500 with NAT), and the encryption, hash, Diffie-Hellman group, authentication method and pre-shared key must match. MM_NO_STATE usually means no reply or a proposal mismatch.

Then phase 2 (show crypto ipsec sa): the transform sets must match, and the crypto ACLs or traffic selectors must be exact mirror images on the two sides. Then check that interesting traffic actually triggers the tunnel, that NAT is not translating it before encryption (add a NAT exemption), and that the encrypt and decrypt counters both increase.

I know thisVPN

802.1X is port-based access control: a switch port lets no traffic through (except EAP) until the device connected to it has authenticated. The supplicant is the client software on the device, the authenticator is the switch (or access point) that relays EAP inside RADIUS, and the authentication server (RADIUS, for example Cisco ISE) checks the credentials and can return a VLAN or a downloadable ACL.

Devices that cannot do 802.1X, such as printers, fall back to MAB, which authenticates the MAC address. Watch for: a default timeout that delays devices booting with PXE, and a fallback policy for when RADIUS is unreachable.

I know thisLayer 2 security

Port security limits which and how many MAC addresses a port accepts (maximum, static or sticky addresses). When a new address breaks the rule: in shutdown mode (the default) the port goes err-disabled and stops all traffic until it is recovered with shutdown/no shutdown or errdisable recovery; in restrict mode the offending frames are dropped, logged and counted; in protect mode they are dropped silently.

Sticky learning writes learned addresses into the running configuration, so save the configuration or they are lost at reload.

I know thisLayer 2 security

It depends on the method list. aaa authentication login default group tacacs+ local tries TACACS+ first and falls back to the local user database only if no server answers. If the server answers and rejects you, the fallback is not used.

So always configure a local fallback account with a strong secret, and keep the console method able to reach it. A method list with only group tacacs+ can lock everybody out when the server or the path to it fails. Test the fallback before you need it.

I know thisAAA

Management access: SSH version 2 only, an ACL on the VTY lines (access-class) allowing only the management network, exec-timeout, login block-for against password guessing, and AAA with per-user accounts and a local fallback. Secrets: enable secret with a strong hash, service password-encryption for the rest. Services: turn off unused ones (HTTP server, CDP on outside ports, ip source-route), shut unused ports and put them in an unused VLAN.

Then protect the control plane (control-plane policing), authenticate routing protocols, send logs to a syslog server, use NTP, and use SNMPv3 instead of community strings.

I know thisDevice hardening

Traffic addressed to the router itself (routing protocols, SSH, SNMP, ICMP, ARP) is handled by its CPU, which is far slower than the forwarding hardware. A flood of such traffic, by attack or by mistake, can starve the routing protocols and take the network down.

CoPP applies a QoS policy to the control-plane interface: it classifies that traffic and polices each class to a safe rate, giving routing protocols the most room and limiting ICMP and management traffic. Start in monitor mode and look at the counters before dropping, or you can cut your own SSH or BGP sessions.

I know thisDevice hardening

A denial-of-service attack exhausts a resource (bandwidth, connection tables, a server's CPU) so legitimate users cannot be served. A distributed attack does it from thousands of machines, often a botnet, so blocking one source does nothing, and reflection attacks (DNS, NTP, memcached) amplify small spoofed requests into huge replies.

Defences: rate limiting and SYN cookies on servers and firewalls, uRPF and anti-spoofing filters at the edge, remotely triggered black-hole routing to drop traffic to the target upstream, and for large volumetric attacks a scrubbing service from the provider or a CDN, because no on-site device survives a link that is already full.

I know thisThreats

The attacker places themselves between two hosts. On a LAN the usual way is ARP spoofing: the attacker sends ARP replies claiming the default gateway's IP address, hosts update their caches, and their traffic flows through the attacker. A rogue DHCP server handing out the attacker as gateway or DNS server does the same.

Defences: DHCP snooping (only trusted ports may answer DHCP) and Dynamic ARP Inspection (ARP replies are checked against the snooping bindings), plus 802.1X so unknown devices cannot connect, and encryption (TLS, IPsec) so intercepted traffic cannot be read.

I know thisThreats

Bottom-up (start at the physical layer and work up), top-down (start at the application), divide and conquer (start in the middle, often with ping, and go up or down by the result), follow the path (hop by hop with traceroute), compare with a working configuration, and swap components.

In practice: first define the problem precisely (who, what, since when, what changed), then divide and conquer with ping and traceroute because it narrows the fault quickly, then confirm the cause, fix it, verify, and document. The question "what changed?" solves a large share of real incidents.

I know thisMethod

Start with show interfaces status and show interfaces gX/Y. err-disabled means a protection shut it: show errdisable recovery or the logs say why (port security, BPDU Guard, UDLD, link flap); fix the cause, then shutdown/no shutdown. Orange on a working link can also mean spanning tree is blocking it (show spanning-tree interface).

"notconnect" means no link: check the cable, the patch panel, the far device, and speed or duplex hard-set to values the other side cannot use. On fibre, check the SFP type matches on both ends and the receive light level (show interfaces transceiver). "disabled" means someone typed shutdown.

I know thisConnectivity

The internet works, so the host, its VLAN, the gateway and the default route are fine; the fault is on the path to that server. Traceroute from the user's VLAN to the server shows where it stops. Then check: a route to the user subnet on the data-centre side (return traffic often fails, not the outbound traffic), an ACL or firewall rule between the two zones, a host firewall on the server, and the server's own default gateway.

Also test the server from another VLAN: if everyone fails it is the server side, if only this VLAN fails it is routing or policy for this subnet.

I know thisConnectivity

An MTU problem. Small packets such as pings pass, but full-size 1500-byte packets are too big for some link on the path, typically a tunnel (GRE, IPsec, PPPoE) that adds headers. Normally the router sends an ICMP "fragmentation needed" message and the sender lowers its packet size, but if a firewall blocks that ICMP, large packets just vanish (a PMTUD black hole).

Test with ping using a large size and the don't-fragment bit (ping 10.1.1.1 size 1500 df-bit) and lower it until it passes. Fix by setting ip tcp adjust-mss (for example 1360) on the tunnel and allowing ICMP unreachables through firewalls.

I know thisConnectivity

Asymmetric routing or a one-sided rule. The common causes: the return route is missing or points elsewhere on the far side; a stateful firewall sees only one direction of a flow (because the return comes back through a different firewall) and drops it; an ACL applied in one direction only; NAT translating in one direction; or uRPF strict mode dropping the return path.

Traceroute from both ends and compare the paths, then check the routing tables and the firewall connection table on each path.

I know thisConnectivity

The network statement needs an exact match in the routing table: network 10.0.0.0 mask 255.255.0.0 only advertises if 10.0.0.0/16 itself exists (add a static to Null0 if it is only a summary). Then check outbound filters (prefix lists, route-maps, distribute lists), and show ip bgp neighbors X advertised-routes to see what is really sent.

On the receiving side, check inbound filters, the AS-path (a router drops routes that contain its own AS), a next hop it cannot reach, and for iBGP the split-horizon rule. A soft clear (clear ip bgp X soft) applies policy changes without dropping the session.

I know thisBGP

They must share a subnet on the connected interfaces and both have EIGRP running on those interfaces (the network statement or the interface in the named-mode address family). The AS number must match, the K values must match, and if authentication is configured the key chain and key must match. A passive interface sends no hellos.

Also check that an ACL is not blocking IP protocol 88 or the multicast address 224.0.0.10, and the logs: EIGRP reports K-value mismatches and authentication failures. debug eigrp packets hello shows whether hellos are seen at all.

I know thisEIGRP

A Layer 2 loop and a broadcast storm. Broadcasts circle forever because Ethernet frames have no TTL, MAC addresses flap between ports, and every device spends its time on the flood.

Find it fast: show mac address-table notification or the logs for MAC flapping between two ports, show interfaces for huge broadcast counters, and look for a recently added cable or unmanaged switch. Break the loop by shutting the port. Then find why spanning tree did not block it: PortFast with BPDU Guard missing, spanning tree turned off, or a device that drops BPDUs. Storm control limits the damage next time.

I know thisSwitching

First confirm the link is actually full: interface counters, load and output drops (show interfaces) or the monitoring graph. Then see who: NetFlow or IPFIX exported to a collector shows the top talkers, applications and conversations; on the router, show flow monitor cache or ip accounting gives a quick look. NBAR identifies the applications.

With a cause in hand, fix it: QoS to protect business traffic, rate-limiting the offender, moving backups out of hours, or adding bandwidth. A packet capture (SPAN or EPC) helps when flows are not enough.

I know thisPerformance

DHCP Discover is a broadcast and routers do not forward broadcasts. The remote VLAN's gateway needs ip helper-address pointing to the DHCP server, so it relays the request as a unicast and fills in its own address (giaddr), which tells the server which scope to use.

Then check: the server has a scope for that subnet, with free addresses, and a route back to the gateway address; DHCP snooping, if enabled, trusts the uplink toward the server; and no ACL blocks UDP 67/68.

I know thisServices

Association works, so radio and authentication are mostly fine; the fault is in reaching DHCP. Check the WLAN is mapped to the right VLAN or interface on the controller, that the VLAN is allowed on the trunk to the controller or the FlexConnect AP's switch port, that the gateway has an ip helper-address, and that the DHCP scope is not exhausted (guest networks often run out because leases are too long).

If only some users fail after 802.1X, check the VLAN the RADIUS server returns for their group.

I know thisWireless

Inside an area OSPF is link state, so loops cannot form. Between areas it behaves like distance vector: ABRs pass summary (type 3) LSAs, and the rule that inter-area routes must pass through area 0, plus ABRs ignoring type 3 LSAs received over non-backbone areas, prevents loops.

Problems appear with redistribution: two ASBRs redistributing between OSPF and another protocol can feed a route back in, and with E2 routes the cost to the ASBR is ignored, so traffic can take a long path. Fixes are route tags with filtering at each redistribution point, E1 routes where the internal cost matters, and summarising carefully so a summary does not hide a failure.

I know thisOSPF

All are external routes redistributed into OSPF. E2 (the default) keeps only the external metric set at redistribution, the same everywhere in the domain, and ignores the internal cost to reach the ASBR. E1 adds the internal cost to the external metric, so each router picks the nearest exit. When both exist for a prefix, E1 is preferred over E2 regardless of metric. For two E2 routes with the same metric, the lower forward cost to the ASBR breaks the tie.

N1 and N2 are the same thing inside an NSSA (type 7 LSAs), which the ABR translates into E1 or E2 (type 5) for the rest of the domain.

I know thisOSPF

IS-IS runs directly on Layer 2 (not on IP), so it is independent of IPv4 or IPv6 and carries both in TLVs easily, and adding new features means adding TLVs. Areas are defined per router rather than per interface: Level 1 routers know their area, Level 2 forms the backbone, and L1/L2 routers join them, and the backbone is simply the contiguous L2 routers, with no need for an area 0 that everyone touches. It has fewer LSP types and a simpler design than OSPF's many LSA types and area kinds.

Providers like it because it is stable at very large scale, carries MPLS-TE and segment routing extensions cleanly, and an IGP not running over IP is harder to attack from outside.

I know thisIS-IS

A community is a 32-bit tag (written ASN:value) attached to routes, used to group routes and drive policy elsewhere: a customer tags routes 65000:80 and the provider's route-maps set local preference 80 for them, or a tag means "do not advertise to peers in Europe". Extended communities carry route targets in MPLS VPNs, and large communities (12 bytes) fit 32-bit AS numbers.

Well-known: no-export (do not send outside the AS or confederation), no-advertise (do not send to any peer), local-AS (do not send outside the sub-AS), and blackhole (65535:666, asking the provider to drop traffic to the prefix during an attack). They are only sent if send-community is configured.

I know thisBGP

Prefix Independent Convergence. Normally after a failure BGP has to recompute and reprogram each prefix one by one, so with a full internet table convergence takes minutes. PIC makes the forwarding table hierarchical: many prefixes point to one shared path-list, and a backup path (an alternative next hop, made possible with additional-paths or a unique RD per PE) is pre-installed.

PIC Core: when the IGP route to a next hop changes, only the shared entry is updated. PIC Edge: when an edge router or link fails, the shared entry switches to the pre-computed backup. Either way the time does not depend on the number of prefixes, and failover takes well under a second.

I know thisBGP

A BGP speaker normally advertises only its best path for each prefix. A route reflector therefore hides every other path from its clients: they see one exit, which breaks multipath, slows failover (they must wait for the reflector to choose and send a new best path) and can cause sub-optimal routing or MED oscillation.

Add-path (RFC 7911) lets a speaker advertise several paths for the same prefix, each with a path identifier, after both sides negotiate the capability. Clients then hold backup paths for PIC and can use multipath. The cost is more memory and updates, so advertise the best two or the paths that differ by exit.

I know thisBGP

Filter what you accept: prefix lists against bogons, your own prefixes, default route (unless wanted) and anything longer than /24 for IPv4 or /48 for IPv6; max-prefix limits per peer; and RPKI origin validation, dropping routes whose origin AS is invalid. Filter what you send: only your own and customers' prefixes, so you never leak a full table and become a transit by accident.

Protect the session: TCP-AO or MD5 authentication, the GTSM TTL check (ttl-security hops), and control-plane policing. Customers' prefixes should be checked against IRR records, and MANRS lists these practices.

I know thisBGP

In a Layer 3 VPN the provider takes part in the customer's routing: each PE has a VRF per customer, learns customer routes with a PE-CE protocol, and carries them in MP-BGP, so the customer sees the provider as a router.

In a Layer 2 VPN the provider just carries Ethernet frames. VPWS is a point-to-point pseudowire (an Ethernet line between two sites, signalled by LDP or BGP); VPLS is a multipoint emulated switch, where PEs learn MAC addresses and flood unknown frames to the other PEs. The customer runs its own routing over it. EVPN is the modern replacement for VPLS, with BGP carrying MAC addresses, all-active multihoming and less flooding.

I know thisMPLS

Segment routing lets the source put the path into the packet as a list of segments (labels in SR-MPLS, or IPv6 addresses in SRv6). A prefix SID identifies a router and means "go there by the shortest path", an adjacency SID means "use this link". The IGP (IS-IS or OSPF) advertises the SIDs, so LDP is no longer needed, and the core keeps no per-flow state, unlike RSVP-TE.

It makes traffic engineering simpler (SR-TE policies computed by the head end or a controller), and TI-LFA gives sub-50 ms protection for almost any topology. SRGB (the global block) must be consistent across routers to keep prefix SID labels identical everywhere.

I know thisMPLS

The labels add bytes: 4 per label, so an L3 VPN packet carries 8 more bytes (transport and VPN labels), more with TE or fast reroute. If any core link has a 1500-byte MTU, a full 1500-byte customer packet no longer fits. MPLS cannot fragment labelled packets easily, and ICMP replies from inside the core may not reach the customer, so large packets just disappear.

Fix the core: set the MPLS MTU (and interface MTU) on core links to at least 1500 plus the label stack, often 9000 on modern networks. Test with ping using a large size and the DF bit across the path.

I know thisMPLS

Dense mode floods traffic everywhere and prunes back where nobody wants it, then repeats every few minutes, so it only suits networks where receivers are everywhere. Sparse mode is pull-based: receivers join toward a rendezvous point (shared tree, *,G), sources register with the RP, and the last-hop router can switch to the shortest-path tree (S,G) once traffic flows. The RP must be known by every router (static, Auto-RP or BSR).

Source-specific multicast needs no RP at all: the receiver says which source it wants (IGMPv3), and the network builds the (S,G) tree directly. It is simpler and safer, and is used in the 232/8 range for IPTV and finance feeds.

I know thisMulticast

At the receiver's router: does show ip igmp groups show the join? If not, check IGMP version and that IGMP snooping or querier exists on the switch. Then show ip mroute for the group: is there a (*,G) with an incoming interface toward the RP? Check the RP is known (show ip pim rp mapping) and PIM neighbours exist on each hop.

Walk upstream hop by hop, following the RPF interface of each entry, until the (S,G) entry disappears or packets stop. At each hop check the RPF check (show ip rpf source), a TTL that is too low, and ACLs. At the first-hop router check the source registers with the RP.

I know thisMulticast

Both route between VNIs at the leaf (distributed anycast gateway). In asymmetric IRB the ingress leaf routes and bridges: it routes into the destination VNI and sends the packet in that VNI, so every leaf must have every VLAN and VNI configured, which does not scale.

In symmetric IRB the ingress leaf routes into an L3VNI (one per tenant VRF), the egress leaf routes again out of the L3VNI into the destination VLAN. Each leaf only needs the VNIs of its own hosts plus the L3VNI. Type 2 routes then carry two labels (the L2VNI and the L3VNI) and the router MAC, and type 5 routes carry external prefixes. Symmetric is what most fabrics use.

I know thisData centre

Two ways. Ingress replication (head-end replication): the leaf sends a unicast copy to every other VTEP in the VNI, whose list it learns from EVPN type 3 routes. It needs no multicast in the underlay and is simpler, but the leaf does more work with many VTEPs. Multicast underlay: each VNI maps to a multicast group, and the underlay (PIM, often with anycast RP) delivers one copy to all interested VTEPs, which is more efficient at scale.

EVPN also reduces the flooding itself: ARP suppression answers ARP from the leaf's cache of type 2 MAC/IP routes, and unknown unicast can be dropped because EVPN already knows every MAC.

I know thisData centre

It lets one server or switch connect to two or more leaves with a port channel, like vPC, but standards based and without a peer link. The links to the shared device form an Ethernet Segment, identified by an ESI that every attached leaf is configured with.

EVPN routes do the work: type 4 routes elect a designated forwarder per VLAN so only one leaf sends broadcast traffic down the segment, type 1 (Ethernet auto-discovery) routes let remote leaves load-share across all leaves of the segment (aliasing) and withdraw them all at once if a link fails (mass withdrawal), and split-horizon labels stop a leaf from sending a frame back to the segment it came from.

I know thisData centre

Mark at the edge, as close to the source as possible, and trust markings only from trusted devices (phones, not PCs): voice EF, interactive video AF41, signalling CS3, business data AF21, scavenger CS1, everything else default.

On the WAN edge: shape to the contracted rate if it is lower than the physical port, so queuing happens on our router and not in the provider's; inside the shaper, a low-latency priority queue for voice, policed to about a third of the link so it cannot starve the rest; CBWFQ bandwidth guarantees for video and business data; WRED on the data classes; and the scavenger class gets the minimum. Check the provider's classes and remark to their DSCP values if needed.

I know thisQoS

All pre-compute a backup next hop so forwarding switches in tens of milliseconds, before the IGP reconverges. A loop-free alternate is a neighbour whose own shortest path to the destination does not come back through us; it is simple but many topologies (rings especially) have none.

Remote LFA tunnels the packet (with LDP) to a node further away, the PQ node, from which the destination is reached without looping back, covering most ring cases. TI-LFA, with segment routing, uses a segment list to steer the packet along the post-convergence path, and covers every single link or node failure in any topology, so it is the modern choice.

I know thisConvergence

Start from requirements: applications and where they live, bandwidth, availability per site class, security policy and budget. A typical answer: SD-WAN at the branches with two transports (MPLS or broadband plus LTE), application-aware routing and local internet breakout for SaaS, with a cloud security service enforcing the same policy everywhere; data centres connected by redundant links, each with redundant edges and firewalls.

Inside the data centres spine-leaf with EVPN; in campuses a routed access or collapsed core. Segment users, guests, IoT and management with VRFs and SGTs end to end. Then plan IP addressing that summarises per region, monitoring, automation for branch rollout, and a failure test plan.

I know thisDesign

A controller defines the policy once and pushes it to every edge, instead of configuring each router by hand. Edges build encrypted overlay tunnels across any transport (MPLS, broadband, LTE) and measure loss, delay and jitter on each one continuously, then steer each application to the path that meets its SLA, and move it when a path degrades.

It makes cheap internet links usable for business traffic, allows direct internet access for SaaS with central security policy, gives zero-touch provisioning of new branches, and shows per-application visibility. Cisco Catalyst SD-WAN (Viptela) has vManage for management, vSmart controllers for policy and routes (OMP), vBond for orchestration, and the WAN edges.

I know thisDesign

Instead of segmenting by IP address and VLAN, TrustSec gives each user or device a Security Group Tag when it authenticates (ISE assigns it by role, for example Employee, Contractor, Printer). The tag travels with the traffic, inline in the Ethernet frame or learned through SXP, and enforcement points apply SGACLs from a matrix of source group to destination group.

Policy then says "contractors may not reach finance servers" regardless of where they plug in or what address they get, so the rules stay small and do not change when the network is readdressed. Cisco SD-Access is built on this with VXLAN carrying the tags.

I know thisSecurity