CCNA quiz 3: switching, VLANs and STP

802.1Q inserts a 4-byte tag carrying the VLAN ID so the receiving switch knows which VLAN each frame belongs to.

The native VLAN (VLAN 1 by default) is sent untagged. It must match on both ends, and best practice is to change it to an unused VLAN.

Use switchport mode access followed by switchport access vlan 20. The trunk command controls which VLANs a trunk carries.

Each VLAN is a separate network, so traffic between them must be routed by a router (router-on-a-stick) or a Layer 3 switch using SVIs.

STP blocks redundant paths so there is only one active path between switches, preventing broadcast storms. A blocked port takes over if a link fails.

The switch with the lowest bridge ID wins: lowest priority first, and the lowest MAC address breaks a tie.

PortFast skips the listening and learning states on ports connected to end devices, so PCs get network access straight away.

BPDU Guard shuts (err-disables) the port, because a BPDU means someone connected a switch to a port meant for an end device.

In shutdown mode (the default) a violation err-disables the port. Restrict drops and logs; protect drops silently.

show interfaces trunk lists trunk ports, their native VLAN and the allowed and active VLANs. show vlan brief lists access ports only.

In global configuration, enter vlan 30, then in VLAN configuration mode type name SALES.

All ports start in VLAN 1, which is also the default native VLAN. Good practice is to move user ports and the native VLAN elsewhere.

Only the forwarding state sends user frames. Learning builds the MAC table but does not forward yet.

The default priority is 32768 (plus the VLAN ID with extended system ID). Lowest bridge ID wins the root election.

EtherChannel combines up to eight links into one logical link for more bandwidth and redundancy, without STP blocking them.

LACP (802.3ad/802.1AX) is the open standard. PAgP is Cisco proprietary.

switchport nonegotiate disables DTP. Combined with manual access or trunk mode, it prevents switch spoofing.

The switch records the source MAC address of each incoming frame against the port it arrived on.

Unknown unicast frames are flooded within the VLAN. When the destination replies, the switch learns its port.

An alternate port is blocked but can take over quickly if the root port fails.