Network Fundamentals · Topic 1 of 17
Network Components and Their Roles
Learn what routers, switches, firewalls, IPS, access points, controllers, endpoints, servers and PoE do in a network and how each one fits in the design.
- 6 min
- Exam objective 1.1
- A router connects networks and makes decisions by IP address.
- A Layer 2 switch makes decisions by MAC address and does not route.
- A Layer 3 switch switches and routes, so it can do inter-VLAN routing.
What it is
A network is built from a small set of device types, and each one has a clear job.
If you know the job, you can tell where a device belongs in a diagram and what problem it solves.
This topic covers eight building blocks:
- routers
- Layer 2 and Layer 3 switches
- next-generation firewalls and intrusion prevention systems
- access points
- controllers
- endpoints
- servers
- Power over Ethernet
How it works
Each device forwards or filters traffic using a different piece of information.
Forwarding devices
Routers connect different IP networks. A router reads the destination IP address of a packet, looks it up in its routing table, and forwards the packet out of the right interface.
Every interface on a router is its own broadcast domain, so a router stops broadcasts. Routers also connect a site to a WAN or the internet.
Layer 2 switches connect devices inside one network. They read the destination MAC address of a frame, look it up in a MAC address table, and forward the frame out of the right port.
Each port is its own collision domain. A Layer 2 switch does not route between IP networks. It can split a network into several VLANs, but traffic between VLANs still needs a Layer 3 device.
Layer 3 switches do everything a Layer 2 switch does, and they can also route between VLANs and networks. They do this in hardware, which makes inter-VLAN routing fast.
They are common in the core and distribution parts of a campus network. A Layer 3 switch uses routed ports or switched virtual interfaces (SVIs) as gateways.
| Device | Decides by | Stops broadcasts? |
|---|---|---|
| Layer 2 switch | Destination MAC address | No |
| Layer 3 switch | MAC address and IP address | Between VLANs, yes |
| Router | Destination IP address | Yes, on every interface |
Ask what the device reads. MAC address means switch, IP address means router, and a Layer 3 switch does both.
Security devices
Next-generation firewalls (NGFW) filter traffic like a classic firewall, but they understand more. A classic firewall decides using addresses, ports and connection state.
An NGFW can also identify the application, tie traffic to a user, filter by web category and check for malware. Many include an intrusion prevention engine.
Intrusion prevention systems (IPS) inspect traffic for known attack patterns and unusual behaviour. An IPS sits in line with the traffic, so it can block an attack as it happens.
Its passive cousin, an intrusion detection system (IDS), only watches a copy of the traffic and raises an alert.
Wireless and management devices
Access points (AP) connect wireless clients to the wired network. The AP turns a radio signal into a normal Ethernet frame.
Many APs are lightweight, which means they depend on a wireless LAN controller for configuration and policy. An autonomous AP is configured on its own.
Controllers centralise management. A wireless LAN controller (WLC) manages many lightweight APs from one place, handling configuration, channel and power choices, and client roaming.
Lightweight APs talk to the WLC over a tunnel protocol called CAPWAP. A network controller such as Cisco Catalyst Center (earlier called DNA Center) manages and monitors wired and wireless devices and supports automation.
Endpoints and servers
Endpoints are the devices people and things use to reach the network: laptops, phones, tablets, printers, cameras and IoT sensors. They are the source or destination of most traffic.
Servers provide a service to other devices. Common examples are web, file, email, DNS and DHCP servers. A server may be a physical machine or a virtual one.
Power over Ethernet
Power over Ethernet (PoE) sends electrical power over the same twisted-pair cable that carries data. This removes the need for a separate power outlet near each device.
The device that supplies power is the power sourcing equipment (PSE), usually a switch. The device that receives it is the powered device (PD), such as an IP phone, access point or camera.
The common standards are:
| Standard | Name | Power at the switch port |
|---|---|---|
| 802.3af | PoE | up to 15.4 W |
| 802.3at | PoE+ | up to 30 W |
| 802.3bt | PoE++ (Type 3 and Type 4) | up to 60 W and 90 W |
The power actually available to the device is a little lower, because some power is lost in the cable. On a Cisco switch, show power inline shows how much power each port is delivering.
What to remember for the exam
Nine facts cover most questions on this objective.
- A router connects networks and makes decisions by IP address.
- A Layer 2 switch makes decisions by MAC address and does not route.
- A Layer 3 switch switches and routes, so it can do inter-VLAN routing.
- An NGFW adds application, user and web awareness to a firewall.
- An IPS sits in line and can block. An IDS only watches and alerts.
- A lightweight AP is managed by a WLC. CAPWAP is the tunnel between them.
- A controller gives one place to manage many devices.
- PoE lets the switch power a phone, AP or camera over the data cable.
- 802.3af is 15.4 W, 802.3at is 30 W, and 802.3bt reaches 60 W or 90 W.
IPS and IDS differ by position, not by what they detect. In line means IPS, and a copy of the traffic means IDS.
Common mistakes
These five mix-ups come up most often.
Calling every box with ports a switch. A switch forwards by MAC address within a network. A router forwards by IP address between networks. A Layer 3 switch does both, which is the source of many mix-ups.
Mixing up IPS and IDS. The key difference is position. An IPS is in the traffic path and can stop the traffic. An IDS only receives a copy.
Thinking an AP routes traffic. An AP bridges wireless clients onto the wired network. The routing happens elsewhere.
Forgetting the power budget. A switch has a limited total PoE budget. Plugging in too many power-hungry devices can leave some without power.
Assuming a controller carries all user data. In many designs, a controller manages the APs while user traffic still goes straight from the AP onto the wired network.
Check yourself
Work through these three prompts.
What do a Layer 2 switch, Layer 3 switch and router forward by?
MAC address, MAC and IP addresses, and IP address.
How does an IPS differ from an IDS?
An IPS sits in line and can block. An IDS watches a copy and alerts.
How do a lightweight AP, WLC and PoE bring a client online?
PoE powers the AP, CAPWAP links it to the WLC, and the AP connects the client.
Topic 1 of 17 in Network Fundamentals
Test yourself on Network Fundamentals
The full Cisco CCNA 200-301 question bank has 1,206 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by Cisco. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.