Networking (CompTIA Network+) learning path: everything to study, topic by topic

The seven OSI layers and the TCP/IP model: function of each layer, PDUs, encapsulation and de-encapsulation, and which devices, protocols and addresses operate at each layer

Routers, switches, firewalls, IDS/IPS, load balancers, proxies, access points, wireless LAN controllers, VPN headends, hubs, bridges, media converters and CDNs: purpose, placement and layer of operation

Deployment and service models, NFV, VPC/VNet constructs, security groups and network ACLs, cloud gateways (internet, NAT, transit), VPN and direct connectivity, and the shared responsibility model for networking

Well-known ports and protocols (SSH, DNS, DHCP, HTTP/S, SMTP, SNMP, LDAP, RDP, NTP, SMB, syslog and more), TCP versus UDP, connection-oriented behavior, IP protocols such as ICMP/ESP/GRE, and unicast, multicast, anycast and broadcast traffic

Copper (Cat 5e/6/6a/8, coax, twinax) and fiber (single-mode, multimode) media, Ethernet standards and distances, SFP/QSFP transceivers and connectors (RJ45, LC, SC, MPO), BiDi/WDM, and topologies including star, mesh, hybrid, spine-and-leaf, three-tier and point-to-point

IPv4 classes and private ranges, APIPA, loopback, CIDR and VLSM subnetting, subnet math, and IPv6 address types, notation, SLAAC and transition mechanisms (dual stack, tunneling, NAT64)

Topology design beyond the basics: full mesh versus hub-and-spoke link counts (n(n-1)/2), SD-WAN overlays with centralized policy and application-aware path selection, spine-leaf data center fabrics, VXLAN encapsulation and the 24-bit VNI, the demarcation point between provider and customer, and SLA versus MOU documents

Static and dynamic routing, administrative distance and longest-prefix match, OSPF, EIGRP, BGP, RIP, default routes, route summarization, NAT/PAT, FHRP (HSRP/VRRP), and VRF and inter-VLAN routing

VLANs and 802.1Q trunking, native VLAN, Spanning Tree variants, link aggregation (LACP), port mirroring, port security, Power over Ethernet, jumbo frames, MAC and ARP tables, and duplex/speed negotiation

802.11 standards (a/b/g/n/ac/ax), 2.4/5/6 GHz bands and channels, SSID/BSSID/ESS, antenna types, controller-based versus autonomous APs, roaming, MIMO/MU-MIMO, WPA2/WPA3, site surveys and cellular technologies

IDF/MDF and telecommunications rooms, racks and rack units, patch panels, cable management, structured cabling, power (UPS, PDU, redundant circuits), HVAC, labeling and demarc, and wiring standards T568A/B

Layer 2 and layer 3 switching details: jumbo frames and end-to-end MTU consistency, inter-VLAN routing with switch virtual interfaces (SVI), unknown-unicast flooding and the MAC address table, STP edge protection with PortFast and BPDU guard, first hop redundancy with VRRP and HSRP virtual IP addresses, and RIP's 15-hop limit

Wireless design and security details: RF coverage planning and site surveys, 802.11r fast roaming, band steering to 5 and 6 GHz, hidden node problem and RTS/CTS, guest captive portal with client isolation, 802.11w protected management frames against forged deauthentication, and capacity and airtime planning for dense areas

Network diagrams, IP address management, asset inventory, SLAs, baselines, hardware/software life-cycle (EOL/EOS), change management process, configuration baselines, backups, golden configs and templates

SNMP (v1/v2c/v3, traps, MIBs, OIDs), NetFlow/IPFIX, syslog, SIEM integration, interface statistics, baselines, thresholds and alerting, uptime and latency probes, and packet capture for analysis

RPO, RTO, MTTR and MTBF, hot/warm/cold sites, high availability and redundancy (active-active, active-passive), load balancing, link redundancy, backups and tabletop exercises

DHCP (DORA, scopes, reservations, relay), DNS record types and resolution, DNSSEC, DoH/DoT, NTP and time sync, IPAM, SLAAC/DHCPv6, and service dependencies such as proxies and SD-WAN overlays

Site-to-site and client VPNs (IPsec, TLS/SSL), split versus full tunnel, SSH, RDP, jump hosts, out-of-band and console management, API-based management, ZTNA, SSO and role-based access to network devices

Encryption in transit, certificates and PKI, IAM, MFA, 802.1X, NAC, security terminology (risk, vulnerability, exploit, threat, CIA), physical controls (badges, cameras, locks, biometrics), and deception technologies (honeypots, honeynets)

Log and configuration audits, compliance regimes (PCI DSS, GDPR, HIPAA), data locality, VLAN and subnet segmentation, screened subnets (DMZ), micro-segmentation, IoT/OT and guest isolation, zero trust

DoS/DDoS, on-path (MITM), ARP/DNS poisoning, VLAN hopping, rogue DHCP/AP, evil twin, deauthentication, social engineering, malware, brute force, and the defenses: ACLs, port security, DHCP snooping, DAI, IDS/IPS, firewalls, rate limiting, patching and hardening

Authentication and access protocols and defenses: Kerberos tickets and the KDC, TACACS+ versus RADIUS for device administration, hardening of network devices (default credentials, SSH over Telnet, unused ports), NAC with posture checks and a remediation VLAN, web application firewalls, and zero-day vulnerabilities and compensating defenses

The CompTIA seven-step method: identify the problem, establish a theory, test, plan and implement, verify full functionality and implement preventive measures, document findings; bottom-up, top-down and divide-and-conquer

Incorrect cable type, open/short, crosstalk, attenuation, EMI, bad ports or SFPs, transceiver mismatch, duplex mismatch, speed mismatch, PoE issues, CRC errors, giants and runts, and interface error counters

Wrong gateway, incorrect VLAN or subnet mask, duplicate IP, DHCP exhaustion, DNS failures, routing loops, asymmetric routing, certificate errors, ACL blocks, wireless interference and roaming, latency, jitter, packet loss, congestion and QoS

ping, traceroute/tracert, nslookup/dig, ipconfig/ifconfig/ip, arp, netstat/ss, nmap, tcpdump, Wireshark, route print, show commands, cable testers, tone generators, OTDR, optical power meter, Wi-Fi analyzers, loopback plugs and protocol analyzers

Diagnosing and tuning network performance: MTU mismatches and path MTU discovery, QoS classification and DSCP marking, TCP window size and the bandwidth-delay product on long fat links, interface output discards and drops, and uplink oversubscription ratios

Physical-layer and test-tool knowledge: plenum versus riser cable ratings, fiber polarity (Tx to Rx), OTDR for fault location, tone generator and probe, loopback and port testers, iperf throughput tests, nmap port scans, network TAPs for passive capture, and environmental sensors in the telecom room

Configuring and verifying normal-range VLANs across switches, access and 802.1Q trunk ports, native VLAN and allowed-VLAN lists, DTP behavior, CDP and LLDP neighbor discovery, and Layer 2/Layer 3 EtherChannel with LACP

Basic operation of Rapid PVST+: root bridge election by bridge ID, root, designated and alternate port roles, port states and fast convergence, PortFast, BPDU Guard, root guard and per-VLAN load balancing

Reading the IOS routing table (codes, prefix, AD/metric, next hop), the forwarding decision (longest prefix, then administrative distance, then metric), IPv4 and IPv6 static and floating static routes, and configuring and verifying single-area OSPFv2 (router ID, network/interface commands, DR/BDR, neighbor states, passive interfaces)

Why hosts need a resilient default gateway and how HSRP, VRRP and GLBP provide a virtual IP and virtual MAC with active/standby election, priority, preemption and tracking

Configuring and verifying inside source NAT (static, dynamic pool and PAT overload), NTP client/server, DHCP server, client and relay (ip helper-address), DNS role, SNMP managers/agents/traps, syslog facilities and severity levels 0-7, and TFTP/FTP for images and configs

QoS forwarding per-hop behavior: traffic classification and marking (CoS, DSCP, IP precedence), trust boundaries, queuing (FIFO, WFQ, CBWFQ, LLQ), congestion avoidance (tail drop, WRED), policing versus shaping, and voice, video and data requirements

Autonomous, cloud-based and split-MAC (lightweight with WLC) wireless architectures, AP modes (local, FlexConnect, monitor, sniffer, bridge), CAPWAP, physical connections of AP, WLC, access and trunk ports and LAG, WLAN creation in the controller GUI with WPA2-PSK, QoS profiles and advanced settings

Configuring and verifying IPv6 addressing and prefixes on interfaces (global unicast, link-local, EUI-64, SLAAC), enabling ipv6 unicast-routing, IPv6 static and default routes, neighbor discovery, and verifying client IP parameters on Windows, macOS and Linux

IOS modes and navigation, running versus startup configuration, show and debug basics, console/VTY/AUX lines, enabling SSH (hostname, domain, RSA keys, transport input ssh), local passwords and secrets, TACACS+/RADIUS and cloud-managed access, and virtualization fundamentals (VMs, containers, VRFs)

Standard and extended ACLs (wildcard masks, ordering, implicit deny, placement), port security, DHCP snooping and dynamic ARP inspection, AAA concepts, IPsec site-to-site and remote-access VPNs, wireless security protocols WPA, WPA2 and WPA3, and password policy and MFA

Impact of automation on network management, traditional versus controller-based networking, SDN planes and the overlay, underlay and fabric model, REST APIs (HTTP verbs, CRUD, authentication, data encoding), JSON structure, configuration management with Ansible and Terraform, and generative and predictive AI/ML in network operations

Enterprise design principles: hierarchical two-tier and three-tier campus, collapsed core, spine-leaf fabrics, modularity, resiliency and high availability (FHRP, StackWise, VSS, redundant supervisors, NSF/SSO), scalability, WAN and branch connectivity options, cloud edge and on-premises versus cloud-hosted services, and Cisco Catalyst platform roles

Working principles of Cisco Catalyst SD-WAN: management, control and orchestration planes (SD-WAN Manager, Controller, Validator) and WAN Edge routers, OMP, TLOCs, VPNs/VRFs, DTLS/TLS control connections, IPsec data plane tunnels, centralized and localized policy, application-aware routing, zero-touch provisioning and SASE or cloud on-ramp integration

Working principles of Cisco SD-Access: underlay, overlay and fabric roles (control plane node, border node, edge node, fabric WLC), LISP control plane, VXLAN data plane, Security Group Tags and TrustSec policy, virtual networks versus scalable groups, host onboarding with ISE and Catalyst Center, and fabric-in-a-box and transit options

Reading and interpreting QoS configurations written with the Modular QoS CLI: class-maps, policy-maps and service-policies, ACL and DSCP match criteria, marking, CBWFQ and LLQ priority queues, policing and shaping parameters (CIR, Bc, Be), WRED, hierarchical policies, trust boundaries on campus switches and verification with show policy-map interface

Device virtualization (Type 1 and Type 2 hypervisors, VMs, containers, virtual switches, SR-IOV, NFV), data path virtualization (VRF-Lite, GRE tunnels, IPsec tunnels, DMVPN concepts) and network virtualization concepts (VXLAN, LISP, overlay versus underlay, multi-tenancy)

Layer 2 infrastructure for the enterprise: static and dynamic 802.1Q trunking (DTP), EtherChannel with LACP and PAgP including load balancing, Rapid PVST+ and MST regions, instances and revisions, STP enhancements (PortFast, BPDU Guard and Filter, Root Guard, Loop Guard, UDLD), and troubleshooting of Layer 2 loops and inconsistencies

Deploying enterprise wireless: Cisco wireless architectures and AP modes, AP discovery and CAPWAP join, Catalyst 9800 WLC deployment options (centralized, FlexConnect, embedded wireless, Mobility Express and cloud), RF fundamentals (channels, power, coverage, 802.11ax and Wi-Fi 6/6E), roaming and mobility groups, WLAN security (WPA3, 802.1X, PSK, guest), and wireless troubleshooting

Layer 3 infrastructure: multi-area OSPF (LSA types, area types, ABR and ASBR, summarization, network types, authentication), EIGRP (named mode, DUAL, feasible successors, metrics, stub, summarization), route redistribution between protocols, route filtering with prefix lists and route maps, policy-based routing, and troubleshooting of adjacencies and loops

BGP in enterprise networks: eBGP and iBGP peering, neighbor states, path attributes and best-path selection (weight, local preference, AS path, origin, MED), route filtering and manipulation with route maps and communities, multihoming to one or two ISPs, route reflectors, and verification with show ip bgp commands

IP services for the enterprise: IP multicast (group addressing, IGMP, PIM sparse mode, RP, RPF), NAT and PAT variants, NTP hierarchy and authentication, DHCP and DNS services at scale, first-hop redundancy design, and device high availability features such as NSF, SSO and graceful restart

Diagnosing network problems with debug and conditional debug, ping, traceroute, SNMP (v2c and v3) and syslog; configuring Flexible NetFlow records, exporters and monitors; SPAN, RSPAN and ERSPAN capture; IP SLA probes with tracking; and interpreting the telemetry

Cisco Catalyst Center (formerly DNA Center): device discovery and inventory, templates and Day-N configuration, software image management, plug and play, policy and fabric provisioning, Assurance health scores and issue workflows, path trace, and traditional versus AI-powered workflows such as AI network analytics, AI-enhanced issue resolution and natural-language assistants

Model-driven programmability: the benefits of YANG data modeling, modules, containers, lists and leaves, NETCONF over SSH (RPCs, datastores, operations), RESTCONF over HTTPS (methods, URIs, media types for JSON and XML), model-driven telemetry, and configuring and verifying these interfaces on IOS XE

Automation skills: reading basic Python (variables, data types, loops, conditionals, functions, modules, requests library), constructing valid JSON, Catalyst Center and SD-WAN Manager REST APIs, interpreting HTTP response codes and payloads, EEM applets (events, actions, conditions), and agent-based versus agentless orchestration (Puppet, Chef, Ansible, Terraform)

Securing network devices: AAA with local, RADIUS and TACACS+ (authentication, authorization and accounting methods, privilege levels, role-based CLI), line and VTY access control, control plane protection (CoPP, CPPr), routing protocol authentication, unicast RPF, IPv6 first-hop security, 802.1X, MACsec, and ACLs and infrastructure ACLs

REST API security (authentication with tokens, OAuth 2.0 and API keys, TLS, rate limiting, least privilege, input validation) and network security design: perimeter and segmentation, NGFW and IPS placement, ISE and TrustSec, zero trust, VPN and secure access service edge, and integrating security with fabrics and automation

How OSPF routers become neighbors and reach full adjacency: the Down, Init, 2-Way, ExStart, Exchange, Loading and Full states, the parameters that must match (area, hello and dead timers, authentication, stub flags, subnet and MTU), router ID and DR/BDR election effects, and how to diagnose stuck states such as ExStart/Exchange from an MTU mismatch or Init from one-way hellos

Multi-VRF route sharing with route distinguishers and route-target import/export (shared services and extranet leaking, plus leaking risks), and generic data center overlays outside SD-Access: VXLAN encapsulation, VNI to VLAN/VRF mapping, VTEPs, flood-and-learn versus BGP EVPN control plane, and EVPN route types for MAC and IP advertisement

Choosing and using on-device diagnostic tools: Embedded Packet Capture (capture points, buffers, filters, export), conditional and platform debugs, ping and traceroute options (source, size, DF bit, extended), SNMP polling versus traps and version security, and IP SLA probes for synthetic measurement, with the CPU and production-safety cost of each tool

How clients roam between access points and controllers: intra-controller, inter-controller Layer 2 and Layer 3 roaming, mobility groups and domains, anchor and foreign controllers with tunneled traffic, mobility peer configuration on Catalyst 9800, fast roaming with 802.11r/k/v and OKC, and the effects of roaming on IP addressing and sessions

Using machine learning and generative AI in network management safely: predictive analytics and anomaly baselining, Catalyst Center AI features (AI network analytics, AI-enhanced issue resolution, natural-language assistants), data quality and bias, hallucination and prompt-injection risk, privacy of telemetry sent to models, human approval gates, change control and auditability of AI-recommended changes

Spoofed-source filtering with unicast Reverse Path Forwarding (strict versus loose mode, asymmetric routing and multihoming effects, allow-default, ACL exceptions) and port-based access control with 802.1X: supplicant, authenticator and authentication server roles, EAP-TLS, PEAP and EAP-FAST, certificate versus credential trade-offs, and MAB fallback

Designing site-to-site and hub-and-spoke overlays: DMVPN with multipoint GRE and NHRP (hub as next hop server, spokes registering their NBMA addresses, spoke-to-spoke resolution requests in Phase 2, no route summarization at the hub and next-hop preservation, Phase 3 with NHRP redirect and shortcut), IPsec protection with route-based virtual tunnel interfaces (tunnel protection ipsec profile) versus policy-based crypto maps with ACL-defined interesting traffic, transport versus tunnel mode when IPsec protects GRE, and tunnel overhead handling with ip mtu and ip tcp adjust-mss

Reading and troubleshooting IPsec negotiation: IKEv1 phase 1 main mode states (MM_NO_STATE, MM_SA_SETUP, MM_KEY_EXCH, MM_KEY_AUTH, QM_IDLE) from show crypto isakmp sa, IKEv2 proposal, policy, keyring and profile matching and the NO_PROPOSAL_CHOSEN notification seen with debug crypto ikev2, and phase 2 verification with show crypto ipsec sa packet counters (encaps/encrypt versus decaps/decrypt) to locate one-way traffic, ACL, NAT or routing faults

Policy design in Cisco SD-WAN: direct internet access with local breakout (NAT on the VPN 0 transport interface and a service-VPN default route toward VPN 0) versus backhauling traffic to a data center, application-aware routing policies with SLA classes (loss, latency, jitter thresholds measured by BFD on every tunnel) and path preference with fallback, and Cloud OnRamp for SaaS that probes paths to applications such as Microsoft 365 and selects the best exit

Details of the switching and routing control plane that ENCOR tests: private VLAN primary, isolated and community secondary VLANs with promiscuous ports, VTP modes (server, client, transparent, off), configuration revision numbers and the risk of overwriting VLANs, CEF glean adjacencies punted to the CPU for ARP resolution, and EIGRP neighbor requirements (matching autonomous system, K-values, shared subnet and authentication)

Port-based access control behaviors: 802.1X with MAC Authentication Bypass fallback for supplicant-less devices (authentication order dot1x mab, timeout before fallback), the critical VLAN (inaccessible authentication bypass) used when all RADIUS servers are dead with reinitialization when they return, RADIUS Change of Authorization (CoA) to re-authenticate, disconnect or push a new policy without user action, and host modes (single-host, multi-host, multi-domain, multi-auth)

Infrastructure and edge hardening: IP Source Guard filtering spoofed source addresses using the DHCP snooping binding table, key chains with send and accept lifetimes for hitless authentication key rollover (requires time sync), MACsec 802.1AE hop-by-hop Layer 2 encryption with MKA key agreement, storm control thresholds and actions for broadcast, multicast and unknown unicast, zone-based firewall default policy (traffic between zones denied unless a zone-pair policy permits it), and DNS-layer security that blocks malicious domains by resolver policy before a connection is made