1.1Network components and topologies

CCNA is the entry point for network engineers. It is not a test of rote terminology but of which device to choose for a given requirement, how to configure it, and where to look first when something breaks. This section organizes the "cast"—the devices that make up a network and their roles—and how to arrange them (topology), as real-world design judgment. The goal is to be able to choose between, say, a router and a switch, or a firewall and an IPS, based on the problem you want to solve rather than on feature vocabulary.

1.1.1Device roles

• A router is an L3 device that forwards packets between different networks (subnets) based on IP addresses. It is a broadcast-domain boundary and handles WAN connectivity and inter-subnet routing. By contrast, an L2 switch forwards frames at high speed within a single segment based on MAC addresses, while an L3 switch integrates routing into switching to perform inter-VLAN routing at high speed.
• A next-generation firewall (NGFW) is a security device that adds application identification, user identification, and intrusion prevention on top of traditional port/protocol-based control. An IPS (Intrusion Prevention System) inspects traffic, detects known attack patterns, and blocks them (unlike an IDS, which only detects, an IPS sits inline and actively stops traffic). NGFWs often embed IPS functionality.
• An AP (access point) is an L2 device that bridges wireless clients onto the wired LAN. To centrally manage many APs, a WLC (Wireless LAN Controller) is deployed to unify AP configuration, RF management, and client control (the split-MAC architecture). Endpoints (PCs, smartphones, IP phones, etc.) and servers are the hosts that serve as the origin/destination of communication.
• PoE (Power over Ethernet) delivers both data and power over a single LAN cable, so APs, IP phones, and surveillance cameras can be installed without electrical wiring. Power delivery differs by standard, increasing from 802.3af (up to ~15.4 W) to 802.3at (PoE+, ~30 W) to 802.3bt (PoE++, up to ~60-100 W). You must confirm the standard matches between the sourcing device (the switch side, PSE) and the powered device (PD).

1.1.2Topologies and design models

• A 3-tier design splits an enterprise LAN into an access layer (endpoint connectivity), a distribution layer (policy application and aggregation), and a core layer (high-speed backbone); the larger the scale, the more the layered separation pays off in scalability and maintainability. A 2-tier (collapsed core) merges distribution and core into one layer, reducing layers and cost for small-to-medium scale.
• A spine-leaf topology is a two-tier design for data centers: every leaf (server-access switch) connects to every spine (backbone), so any two servers reach each other in an equal, predictably low number of hops. It suits the east-west (server-to-server) traffic that dominates virtualization/cloud. A SOHO setup serves a small office/home office with a single combined router/switch/AP, while a WAN provides wide-area connectivity linking geographically separated sites.

1.1.3On-premises and cloud

• On-premises means installing devices and servers within your own facilities and maintaining/operating them yourself. It carries large upfront investment (CAPEX) but keeps devices and data fully under your control. Cloud consumes a provider's infrastructure on a pay-as-you-go basis (OPEX), with the advantages of on-demand elastic scaling and reduced operational burden.
• In practice it is rarely all-or-nothing; a hybrid approach is common—on-prem for sensitive data and low-latency needs, cloud for variable load and disaster recovery. The decision axes are cost structure, control/compliance, speed of scaling, and availability requirements, not simply "cloud because it is newer."

Suppose you are designing the network for a small company relocating its office. The requirements are: "three floors, about 120 PCs, 30 ceiling-mounted wireless APs, VLANs separated per floor with inter-department traffic controlled by routing, and active blocking of external attacks." First, each floor edge needs access-layer switches to connect the many endpoints and APs; since running individual power to ceiling APs is impractical, you select PoE-capable switches (802.3at/PoE+ or higher, based on AP power draw). For inter-VLAN routing across floors, aggregating the per-floor L2 switches into an L3 switch (serving as distribution) is faster than backhauling to a router, and at 120 devices a 2-tier (collapsed core) is judged sufficient. Configuring 30 APs one by one invites configuration drift, so you centralize them with a WLC. The requirement to "actively block external attacks" cannot be met by a detection-only IDS; placing an NGFW with inline-blocking IPS at the boundary is appropriate. Deciding to "stand up a separate core router for a full 3-tier because it sounds complete" would be overkill, losing the balance of layers and cost relative to the site's scale and expected growth. The key point is that each requirement (scale, VLANs, powering, central management, active blocking) is the basis for judging which device and which topology to choose.

1.1.4Section summary

• A router is the L3 subnet/broadcast-domain boundary, an L2 switch forwards frames within a segment, and an L3 switch integrates fast inter-VLAN routing
• An IPS actively blocks (an IDS only detects), a WLC centrally manages many APs, and PoE carries data and power on one cable (wattage differs by standard)
• Choose topology by scale: 2-tier for small-to-medium, 3-tier for large, and spine-leaf for data-center east-west traffic. Decide on-prem vs. cloud by cost structure and control/scaling requirements