Routers and their Layer 3 role
A router forwards packets between different IP networks using a routing table. Every interface on a router belongs to a separate subnet — traffic crossing from one subnet to another must pass through the router, which makes routing decisions based on destination IP. Routers also provide the default gateway for hosts; without a router, a host can only reach other devices on the same subnet.
On the CCNA exam, routers are the device that connects your LAN to the WAN and the internet. They run routing protocols like OSPF and EIGRP, perform NAT at the network edge, and terminate VPN tunnels. A router with sub-interfaces on a single trunk port is the classic router-on-a-stick topology used for inter-VLAN routing.
Layer 2 vs Layer 3 switches
A Layer 2 switch makes forwarding decisions based on MAC addresses. It builds a MAC address table by learning source MACs on each port, then forwards frames only to the correct destination port instead of flooding. All ports on a Layer 2 switch share the same broadcast domain unless VLANs are configured — VLANs create separate broadcast domains on the same physical switch.
A Layer 3 switch adds IP routing capability on top of switching hardware. It can route between VLANs using Switched Virtual Interfaces (SVIs) without needing an external router. In a three-tier campus design, Layer 3 switches sit at the distribution and core layers, routing between VLANs at wire speed. The key exam distinction: Layer 2 switches forward frames, Layer 3 switches can also route packets, but they still switch within a VLAN.
PoE (Power over Ethernet) switches deserve a specific callout. They deliver DC power over Ethernet cabling to IP phones, wireless access points, and cameras — eliminating separate power adapters. PoE (802.3af) delivers up to 15.4 W per port; PoE+ (802.3at) up to 30 W; PoE++ (802.3bt) up to 90 W. The switch must have a PoE budget large enough to power all connected devices simultaneously.
Next-Generation Firewalls and IPS
A traditional firewall filters traffic based on IP addresses and ports. A Next-Generation Firewall (NGFW) goes further: it performs deep packet inspection, identifies applications regardless of port (application awareness), and can enforce policies based on user identity, not just IP. NGFWs also include integrated IPS, URL filtering, and malware sandboxing.
An Intrusion Prevention System (IPS) analyzes traffic for attack signatures and anomalous patterns. Unlike a firewall that drops traffic based on policy, an IPS drops traffic based on detected threats. It sits inline in the traffic path — if it goes down without a bypass mechanism, it can disrupt connectivity. The CCNA exam distinguishes IDS (detect and alert) from IPS (detect and block inline).
For CCNA, remember that firewalls are stateful — they track connection state and automatically allow return traffic for established sessions. A stateless ACL on a router must explicitly permit return traffic; a firewall does this automatically.
Wireless Access Points and WLCs
A Wireless Access Point (WAP) connects wireless clients to the wired network. Autonomous APs operate independently and must be configured one by one. Lightweight APs offload configuration and management to a Wireless LAN Controller (WLC), which pushes policies to all APs centrally. This makes large deployments manageable — you configure SSIDs, security, and QoS on the WLC, and every AP applies those settings automatically.
The WLC also handles client roaming. When a client moves from one AP to another within the same WLC domain, the WLC manages the handoff without the client re-authenticating. This is transparent Layer 2 roaming. For the CCNA exam, know that lightweight APs use CAPWAP tunnels to communicate with the WLC, and that AP modes include local, monitor, sniffer, flex-connect, and bridge.
Endpoints and servers
Endpoints are end-user devices: laptops, desktops, smartphones, tablets, IP phones, and IoT sensors. They generate the traffic that everything else carries. Servers are endpoints too — web servers, file servers, DNS servers, DHCP servers — but they're typically in the data center behind distribution-layer switches.
Understanding endpoint role matters for security policy: you segment endpoints into VLANs by type (user VLAN, voice VLAN, IoT VLAN) and apply ACLs at the distribution layer to limit what endpoints can reach. A compromised IoT device on a flat network can reach every other device; on a segmented network it can only reach its VLAN.