Domain 2 — Network Implementations

Week of 2026-10-13 · Download .docx

Objectives

Configure and explain VLANs, trunk ports, and Spanning Tree Protocol on managed switches.
Compare routing protocols (RIP, OSPF, EIGRP, BGP) by type, algorithm, and metric.
Compare 802.11 wireless standards, security protocols (WEP through WPA3), and site survey principles.
Explain WAN technologies including MPLS, SD-WAN, IPsec VPN types, and cloud connectivity.

Key terms

802.1Q: IEEE trunking standard — adds a 4-byte VLAN tag to Ethernet frames on trunk ports.
STP: Spanning Tree Protocol — elects a Root Bridge and blocks redundant paths to prevent bridging loops.
RSTP: Rapid Spanning Tree Protocol — converges in seconds vs. STP's 30–50 seconds.
OSPF: Open Shortest Path First — link-state IGP using Dijkstra's SPF algorithm; no hop limit.
BGP: Border Gateway Protocol — path-vector EGP used between autonomous systems on the internet.
AD: Administrative Distance — lower AD wins when multiple routing sources learn the same route.
WPA3: Wi-Fi security standard using SAE (Dragonfly) handshake — resistant to offline dictionary attacks.
OFDMA: Orthogonal Frequency Division Multiple Access — Wi-Fi 6 technique for simultaneous multi-client service.
SAE: Simultaneous Authentication of Equals — WPA3 key exchange replacing the vulnerable WPA2 4-way handshake.
MPLS: Multiprotocol Label Switching — provider WAN using short labels instead of IP lookups; QoS-aware.
SD-WAN: Software-Defined WAN — policy-based real-time traffic steering across multiple WAN links.
IPsec ESP: Encapsulating Security Payload — provides both encryption AND authentication for VPN tunnels.
DMVPN: Dynamic Multipoint VPN — spoke-to-spoke direct tunnels using NHRP to avoid hub-and-spoke bottleneck.

The concept

SWITCHING AND VLANs

A switch builds its MAC address table by observing source MAC addresses on incoming frames. When a destination MAC is unknown, the switch floods the frame to all ports except the source. VLANs partition a single physical switch into multiple logical broadcast domains. Each VLAN is isolated — a host in VLAN 10 cannot reach a host in VLAN 20 without a Layer 3 routing decision. Access ports carry traffic for one VLAN without a tag. Trunk ports carry traffic for multiple VLANs simultaneously, adding a 4-byte 802.1Q header to each frame containing the VLAN ID. Without Spanning Tree Protocol (STP), redundant trunk links create infinite loops — STP elects a Root Bridge (lowest Bridge ID) and places redundant ports in a blocking state. RSTP (802.1w) converges in 1–2 seconds instead of STP's 30–50 seconds by using proposal/agreement handshakes and edge ports.

ROUTING PROTOCOLS

Static routes are manually defined and require no overhead, but they do not adapt when the topology changes. Dynamic routing protocols auto-discover paths and adjust to failures. Interior Gateway Protocols (IGPs) operate within a single Autonomous System: RIP is distance-vector (shares full routing table with neighbors every 30 seconds; max 15 hops), OSPF is link-state (floods LSAs; all routers build the same topology map; Dijkstra SPF algorithm; no hop limit), EIGRP is Cisco's hybrid. BGP (Border Gateway Protocol) is the Exterior Gateway Protocol connecting ISPs on the internet, using AS-path as its routing metric. Administrative Distance (AD) resolves conflicts when multiple protocols learn the same route — lower AD wins (directly connected=0, static=1, OSPF=110, RIP=120).

WIRELESS NETWORKING

The 802.11 family spans three frequency bands: 2.4 GHz (better range, more interference, only 3 non-overlapping channels: 1, 6, 11), 5 GHz (higher throughput, shorter range, many channels), and 6 GHz (Wi-Fi 6E — cleanest spectrum). Wireless security evolved from WEP (broken RC4, never use) through WPA (TKIP, vulnerable) to WPA2 (AES-CCMP, strong) and WPA3 (SAE handshake, GCMP-256, perfect forward secrecy). WPA3's SAE prevents offline dictionary attacks against captured handshakes. Wi-Fi 6 (802.11ax) adds OFDMA for dense environments and MU-MIMO for simultaneous multi-client transmissions. A site survey validates AP placement, coverage, and channel assignments before deployment.

WAN TECHNOLOGIES AND VPNs

WAN connectivity options range from dedicated leased lines (T1/T3, fixed committed bandwidth) to MPLS (label-based forwarding, QoS-aware, provider-managed) and SD-WAN (software-defined, multi-link steering). IPsec provides encryption and authentication for VPN tunnels: AH provides integrity only (no encryption); ESP provides both encryption and authentication (the standard choice). Site-to-site VPNs connect two networks via a permanent IPsec tunnel between gateway devices. DMVPN allows spoke sites to build dynamic direct tunnels to each other instead of routing everything through the hub. Cloud dedicated connections (AWS Direct Connect, Azure ExpressRoute) bypass the public internet for predictable latency.

Standards alignment: CompTIA Network+ Objective 2.1 (Implementations); Maryland Blueprint College and Career Readiness — Technology and Engineering.

Worked examples

Example 1: A school has two switches and wants to isolate student (VLAN 10) from staff (VLAN 20) traffic. The link between the two switches is configured as a trunk port (802.1Q). Student PCs connect to access ports tagged to VLAN 10; staff PCs connect to access ports tagged to VLAN 20. A Layer 3 switch or router-on-a-stick interface is required for any inter-VLAN communication. A packet from a student PC arrives, the switch adds the VLAN 10 tag, crosses the trunk, and the receiving switch strips the tag and forwards to the student VLAN only.

Example 2: A company has three offices. Currently all branch-to-branch VPN traffic routes through headquarters (hub-and-spoke). Video calls between Branch A and Branch B are degraded because packets travel HQ→A→HQ→B. The network team deploys DMVPN. Using NHRP, Branch A and Branch B dynamically discover each other's public IPs and build a direct IPsec tunnel, cutting latency in half and removing HQ as a bottleneck.

Common mistakes

Forgetting that trunk ports carry ALL VLANs by default — you must explicitly restrict VLANs on a trunk to limit broadcast domains.
Confusing OSPF AD (110) with RIP AD (120) — lower AD is more trusted; OSPF wins over RIP for the same route.
Using channel 3 on 2.4 GHz — it overlaps with both channel 1 and 6, causing interference; only use 1, 6, and 11.
Assuming IPsec AH encrypts data — AH only provides integrity and authentication; ESP is required for confidentiality.
Treating RSTP and STP as interchangeable — RSTP is a separate standard (802.1w) that converges in seconds; STP (802.1D) takes up to 50 seconds.

Self-check

Try each question before reading the answer. Answers at the bottom of this page.

1. Which port type on a switch carries multiple VLANs using 802.1Q tags?

Access port
Trunk port
Mirror port
Console port

2. What algorithm does OSPF use to compute the shortest path?

Bellman-Ford
Distance vector
Dijkstra's SPF
Path vector

3. WPA3 replaces WPA2's PSK handshake with which mechanism?

TKIP
CCMP
SAE (Simultaneous Authentication of Equals)
EAP-TLS

4. IPsec ESP differs from IPsec AH in that ESP provides:

Integrity only
Encryption only
Both encryption and authentication
Key exchange only

5. SD-WAN routes traffic by:

Using only the MPLS link
Selecting the best WAN path per application in real time
Replacing all routing protocols
Eliminating encryption overhead

Self-check answers

1. B — Trunk ports carry frames from multiple VLANs with 802.1Q tags to identify which VLAN each frame belongs to.
2. C — OSPF uses Dijkstra's Shortest Path First algorithm, applied to each router's local copy of the link-state database.
3. C — SAE (Dragonfly key exchange) is resistant to offline dictionary attacks, unlike WPA2's 4-way handshake.
4. C — ESP provides both confidentiality (encryption) and authentication, making it the standard choice for VPN tunnels.
5. B — SD-WAN continuously measures link quality and steers each application to the best available path (MPLS, broadband, LTE).

Canvas is the official record. This companion enhances the PGCC curriculum; it does not replace it. Last name and class year only. Students with a 504 plan or IEP: your accommodations apply.

↑ Back to top