Overview
Network Fundamentals is 15% of the 200-901 exam and has nine objectives. Objective 6.1 covers MAC addresses and VLANs, and 6.2 covers IP addresses, routes, subnet masks or prefixes, and default gateways. Objectives 6.3 and 6.4 describe switches, routers, firewalls and load balancers and ask you to read a topology diagram with port values. Objective 6.5 covers the management, data and control planes, and 6.6 the IP services DHCP, DNS, NAT, SNMP and NTP.
Objective 6.7 asks you to recognise common protocol ports such as SSH, Telnet, HTTP, HTTPS and NETCONF. Objective 6.8 asks you to diagnose application connectivity problems caused by NAT, blocked transport ports, proxies and VPNs, and 6.9 to explain how network constraints such as bandwidth and latency affect applications. The depth is lighter than the 200-301 CCNA, but the focus is on how networks affect software.
How it's tested
Questions are short and practical. Expect topology diagrams with addresses and ports, scenarios where an application cannot reach an API, and direct recall of port numbers and IP service functions. Many items ask you to choose the most likely cause of a described connectivity symptom.
-
Read the diagram
A topology shows hosts, switches, routers, a firewall and a load balancer with addresses and ports, and you trace a path or spot a misconfiguration.
-
Which service or port?
A function such as time synchronisation or name resolution, or a protocol such as NETCONF, is given and you choose the service or port number.
-
Why can't it connect?
An application fails to reach a server, and you diagnose NAT, a blocked port, proxy settings, VPN routing or a gateway error.
A script on a laptop reaches a cloud API from home but times out from the corporate office, where browsers work normally. Browsers use the configured corporate proxy, while the script connects directly and the firewall blocks direct outbound HTTPS. Configuring the script's HTTPS_PROXY environment variable or proxies argument resolves the problem without any change to the API call.
Objectives 9
Official objectives from the Cisco outline, in outline order.
6.1 Describe the purpose and usage of MAC addresses and VLANsLayer 2 addressing and segmentation.
- What it means
- A MAC address is a 48-bit hardware address, written as twelve hexadecimal digits, that identifies a network interface on a local segment. A VLAN logically divides a switched network into separate broadcast domains identified by a VLAN ID from 1 to 4094.
- What to understand
- Switches learn source MAC addresses and forward frames by destination MAC within a VLAN. The first half of a MAC address is the vendor's OUI. Access ports carry one VLAN, while trunk ports carry several using 802.1Q tags. Devices in different VLANs need a router or Layer 3 switch to communicate.
- How it shows up
- Explain why two hosts on the same switch cannot communicate, or what a trunk carries.
- Common confusion
- Thinking MAC addresses are used to route between networks.
6.2 Describe the purpose and usage of IP addresses, routes, subnet mask / prefix, and gatewaysLayer 3 addressing and forwarding decisions.
- What it means
- An IP address identifies a host on a network; the subnet mask or prefix length divides it into network and host portions. Routes tell a device which next hop or interface reaches a destination network, and the default gateway is the router a host uses for destinations outside its own subnet.
- What to understand
- A host compares the destination with its own network using the mask: local destinations are reached directly, remote ones through the gateway. Routers choose the most specific matching route. Know private IPv4 ranges (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16) and basic IPv6 notation. Simple prefix calculations, such as hosts in a /24 or /26, may appear.
- How it shows up
- Find the cause of a host reaching local but not remote systems, or calculate a subnet's range.
- Common confusion
- Setting a default gateway outside the host's own subnet.
6.3 Describe the function of common networking components (such as switches, routers, firewalls, and load balancers)What each device contributes to the path.
- What it means
- Switches forward frames within a LAN using MAC addresses. Routers forward packets between networks using IP routes. Firewalls filter traffic using rules based on addresses, ports, applications and connection state. Load balancers spread client requests across multiple servers behind a virtual IP and monitor server health.
- What to understand
- Each device can be the reason an application call succeeds or fails: a router without a route, a firewall without a rule, or a load balancer whose pool members fail health checks. Multilayer switches combine switching and routing, and next-generation firewalls add application awareness.
- How it shows up
- Match a function to a device in a scenario.
- Common confusion
- Expecting a switch to filter traffic by TCP port.
6.4 Interpret a basic network topology diagram with elements such as switches, routers, firewalls, load balancers, and port valuesReading addresses, links and ports from a diagram.
- What it means
- Topology diagrams show devices as icons connected by links, labelled with interface names, IP addresses, subnets, VLANs and sometimes TCP or UDP port values for services.
- What to understand
- To interpret one, trace the path from client to server: which subnet each host is in, which gateway it uses, which firewall it crosses and what port must be open, and whether a load balancer's virtual IP fronts the servers. Errors such as a host in the wrong subnet or a missing port rule are often visible directly on the diagram.
- How it shows up
- Identify which device or port blocks a flow shown on a diagram.
- Common confusion
- Assuming the client connects to a server's real IP when a load balancer virtual IP is shown.
6.5 Describe the function of management, data, and control planes in a network deviceSeparating how devices are managed, how they decide and how they forward.
- What it means
- The management plane handles administrative access and configuration, through SSH, SNMP, NETCONF, RESTCONF and similar. The control plane builds forwarding decisions using routing protocols, spanning tree and ARP. The data plane, or forwarding plane, moves user traffic according to those decisions, often in hardware.
- What to understand
- Automation APIs operate on the management plane, while routing protocols such as OSPF operate on the control plane. Controllers in software-defined networking centralise parts of the control plane. A question may describe traffic being forwarded while the device cannot be managed, which points to a management plane problem.
- How it shows up
- Assign a protocol or activity to the correct plane.
- Common confusion
- Placing routing protocol exchanges in the data plane.
6.6 Describe the functionality of these IP Services: DHCP, DNS, NAT, SNMP, NTPCore services every network relies on.
- What it means
- DHCP assigns IP addresses, masks, gateways and DNS servers automatically. DNS resolves names to IP addresses. NAT translates private addresses to public ones, often with port address translation. SNMP collects data from and sends traps from network devices. NTP synchronises device clocks.
- What to understand
- Each service affects automation: DHCP and DNS determine how scripts find hosts, NAT changes the addresses seen on the far side, SNMP is the older polling-based monitoring method that telemetry and APIs complement, and accurate time from NTP matters for logs, certificates and token expiry.
- How it shows up
- Choose the service that matches a described need or failure.
- Common confusion
- Confusing DHCP, which provides addresses, with DNS, which resolves names.
6.7 Recognize common protocol port values (such as SSH, Telnet, HTTP, HTTPS, and NETCONF)Port numbers used by management and application protocols.
- What it means
- Common ports include FTP 21, SSH 22, Telnet 23, SMTP 25, DNS 53, DHCP 67 and 68, HTTP 80, NTP 123, SNMP 161 and traps 162, HTTPS 443, and NETCONF over SSH 830. RESTCONF normally uses HTTPS on 443.
- What to understand
- Know whether each uses TCP or UDP: DNS uses UDP mainly and TCP for large responses or zone transfers, DHCP, NTP and SNMP use UDP, while SSH, Telnet, HTTP, HTTPS and NETCONF use TCP. Firewall and troubleshooting questions depend on these values.
- How it shows up
- State the port a protocol uses or the rule needed to allow it.
- Common confusion
- Choosing 22 for NETCONF; NETCONF uses its own SSH subsystem on 830.
6.8 Diagnose application connectivity issues (NAT problem, Transport Port blocked, proxy, and VPN)Common reasons an application cannot reach a service.
- What it means
- Applications fail to connect when NAT hides or changes addresses, when a firewall blocks the destination port, when a required proxy is not configured in the application, or when a VPN changes routing so traffic goes through a tunnel or is split differently.
- What to understand
- Symptoms help: a connection timeout often means a blocked port or missing route, a refused connection means nothing is listening, a proxy problem shows when browsers work but scripts do not, and VPN issues appear when access changes with the tunnel up or down. Inbound connections to a host behind NAT need port forwarding, which affects webhook receivers.
- How it shows up
- Pick the most likely cause and fix for a described connection failure.
- Common confusion
- Blaming the API when a timeout points to a blocked port or missing proxy setting.
6.9 Explain the impacts of network constraints on applicationsHow bandwidth, latency, jitter and loss shape application behaviour.
- What it means
- Network constraints include limited bandwidth, latency, jitter, packet loss and MTU limits. Each affects applications differently depending on whether they are interactive, real time or bulk transfer.
- What to understand
- High latency slows chatty APIs that make many sequential calls, so batching or asynchronous design helps. Low bandwidth slows large transfers such as image downloads. Jitter and loss hurt voice and video more than file transfers. Applications can adapt with caching, compression, retries with backoff and placing workloads closer to users.
- How it shows up
- Choose the constraint that explains an application symptom, or the design change that reduces it.
- Common confusion
- Adding bandwidth to fix a problem caused by latency.
High-yield concepts
The terms, rules and formulas this domain turns into questions most often.
-
VLAN
Logical broadcast domain on a switch.
- Remember
- Inter-VLAN traffic needs Layer 3.
- Tested as
- Layer 2 scenarios.
- Trap
- Expecting hosts in different VLANs to talk directly.
-
Default gateway
Router a host uses for remote destinations.
- Remember
- Must be in the host's subnet.
- Tested as
- Connectivity troubleshooting.
- Trap
- Blaming DNS when the gateway is wrong.
-
Prefix length
Number of network bits, as in /24.
- Remember
- Determines subnet size.
- Tested as
- Addressing questions.
- Trap
- Counting network and broadcast addresses as usable.
-
Management plane
Where configuration and monitoring access happens.
- Remember
- APIs, SSH and SNMP live here.
- Tested as
- Plane classification.
- Trap
- Putting OSPF here.
-
NAT
Translates private to public addresses.
- Remember
- Inbound needs port forwarding.
- Tested as
- Webhook and connectivity issues.
- Trap
- Assuming outside hosts can reach private addresses directly.
-
NTP
Synchronises clocks.
- Remember
- Time drift breaks certificates and tokens.
- Tested as
- IP services matching.
- Trap
- Treating it as optional for automation.
-
SNMP ports
161 for polling, 162 for traps.
- Remember
- Uses UDP.
- Tested as
- Port recall.
- Trap
- Choosing TCP.
-
NETCONF port
TCP 830 over SSH.
- Remember
- Not 22 and not 443.
- Tested as
- Port recall and firewall rules.
- Trap
- Picking 22.
-
Proxy settings
Scripts may need explicit proxy configuration.
- Remember
- Browsers can work while scripts fail.
- Tested as
- Diagnosis scenarios.
- Trap
- Changing the API code instead of proxy settings.
-
Latency vs bandwidth
Delay per round trip versus data rate.
- Remember
- Chatty APIs suffer from latency.
- Tested as
- Constraint impact questions.
- Trap
- Buying bandwidth for a latency problem.
Side by side
Concepts candidates mix up, compared on the point that decides the answer.
Device planes
| Concept | Meaning | Key difference | Common trap |
|---|---|---|---|
| Management plane | Configuration and monitoring access | SSH, SNMP, NETCONF, RESTCONF | Thinking APIs affect forwarding directly |
| Control plane | Builds forwarding decisions | Routing protocols, STP, ARP | Placing user traffic here |
| Data plane | Forwards user traffic | Hardware-based forwarding | Placing routing updates here |
IP services
| Concept | Meaning | Key difference | Common trap |
|---|---|---|---|
| DHCP | Assigns addressing information | Address, mask, gateway, DNS | Confusing it with DNS |
| DNS | Resolves names to addresses | Name lookup | Blaming it for gateway errors |
| NAT | Translates addresses | Private to public | Forgetting inbound port forwarding |
| NTP | Synchronises time | Clock accuracy | Ignoring its effect on certificates |
Connectivity symptoms
| Concept | Meaning | Key difference | Common trap |
|---|---|---|---|
| Timeout | No reply received | Blocked port or missing route | Assuming the service is down |
| Connection refused | Host replied with reset | Nothing listening on port | Opening more firewall rules |
| Works in browser only | Script bypasses proxy | Proxy configuration missing | Rewriting the request |
Exam traps
Each trap is an answer that looks right. Learn the clue that should change your mind.
-
NETCONF port
- What candidates pick
- Port 22 because NETCONF runs over SSH
- Why it looks right
- SSH is commonly on 22
- Why it's wrong
- NETCONF uses a dedicated SSH subsystem on TCP 830.
Clue to watch for The question names NETCONF specifically.
-
Webhook behind NAT
- What candidates pick
- The webhook URL is wrong
- Why it looks right
- URL errors are common
- Why it's wrong
- The receiver sits behind NAT with no inbound mapping, so the service cannot reach it.
Clue to watch for A private address in the webhook target.
-
Browser works, script fails
- What candidates pick
- The API is down
- Why it looks right
- The script returns an error
- Why it's wrong
- The browser uses the corporate proxy while the script does not, so direct traffic is blocked.
Clue to watch for Mention of a corporate network or proxy.
-
Plane classification
- What candidates pick
- OSPF on the management plane
- Why it looks right
- It is configured by administrators
- Why it's wrong
- OSPF exchanges routes to build forwarding tables, which is control plane work.
Clue to watch for The protocol builds or shares routing information.
-
Slow chatty API
- What candidates pick
- Upgrade the link bandwidth
- Why it looks right
- More bandwidth sounds faster
- Why it's wrong
- Many small sequential calls are limited by round-trip latency, not throughput.
Clue to watch for Small payloads and many requests over a long-distance link.
Answer framework
Follow these steps for addressing, service or connectivity questions in this domain.
- Locate the source and destination, noting their subnets, VLANs and gateways, and whether a router or Layer 3 device is needed between them.
- Identify every device on the path, such as a firewall, load balancer, NAT boundary, proxy or VPN tunnel, from the stem or the diagram.
- Determine the protocol and port the application uses and whether it runs over TCP or UDP, then check each device would allow it.
- Match the symptom to a cause: a timeout, a refused connection, a name resolution failure or a browser-only success each point somewhere different.
- Choose the narrowest fix that removes the cause, such as a rule, a proxy setting, a port mapping or a gateway correction, rather than redesigning the network.
Practice question
Want more like this? The CCNA Automation practice test has questions for every domain.
Checklist
0 of 10
Tick each one you can do without notes. Your ticks stay in this browser.
Study strategy
If you already hold the 200-301 CCNA or work in networking, treat this domain as a review and spend no more than a few sessions on it. Focus on what is specific to developers: protocol ports including NETCONF 830, the three device planes, and the four connectivity problems named in objective 6.8. If you come from software, start with addressing and subnetting basics, then the roles of switches, routers, firewalls and load balancers, until you can explain a packet's path from a laptop to a cloud API.
Make a flash card set for the port numbers with TCP or UDP noted, and practise until recall is instant. Then reproduce the connectivity failures yourself: run a small webhook receiver behind home NAT, try a script through a corporate proxy, and block a port with a local firewall rule, noting the error each produces. Finish by drawing two or three topology diagrams from memory and tracing a request across each, which prepares you for diagram-based items.
FAQ
How much of CCNA Automation is Network Fundamentals?
Network Fundamentals is 15% of the 200-901 exam, with nine official objectives covering Layer 2 and 3 basics, devices, planes, IP services, ports and application connectivity.
Is this domain as deep as the 200-301 CCNA?
No. The objectives use describe, recognise and interpret verbs and focus on what automation engineers need, not on configuring routing protocols or switching features.
Which port numbers should I memorise?
At least SSH 22, Telnet 23, DNS 53, DHCP 67 and 68, HTTP 80, NTP 123, SNMP 161 and 162, HTTPS 443 and NETCONF 830.
Is subnetting tested?
Objective 6.2 covers subnet masks and prefixes, so expect basic calculations such as whether two addresses share a subnet, but not the volume of subnetting found on the 200-301 CCNA.
What are the four connectivity problems named in the blueprint?
Objective 6.8 lists NAT problems, blocked transport ports, proxies and VPNs as causes of application connectivity issues.
Why does NTP matter for automation?
Accurate time is needed for certificate validation, token expiry, log correlation and telemetry timestamps, so clock drift can break API calls.
Other Networking certifications
Where the same subject shows up in other exams. Cards marked "Same subject" open the matching domain.
Test your Domain 6 knowledge
Check your recall of ports, IP services and device planes and your ability to diagnose connectivity failures with timed Domain 6 questions.
Keep going
- Training Training Built on your Weak areas
- Practice test Questions by domain, with explanations
- Mock exam Full length, timed like the real exam
- Readiness test Find your weakest domain in minutes
- Cheat sheet Key terms and formulas on one page
- Ask the CCNA Automation AI tutor Get any concept explained your way