Overview
Network Access is 20% of the CCNA and is the switching domain, where much of the hands-on configuration lives. It has nine objectives. VLANs covers configuring and verifying normal-range VLANs across switches, access ports, data and voice VLANs, the default VLAN and inter-VLAN connectivity. Interswitch connectivity covers trunk ports, 802.1Q tagging and the native VLAN. Layer 2 discovery covers CDP and LLDP. EtherChannel covers Layer 2 and Layer 3 link bundles with LACP. Rapid PVST+ covers spanning tree root bridge and port roles, PortFast, and the protection features root guard, loop guard, BPDU guard and BPDU filter. Wireless covers Cisco wireless architectures and AP modes, WLAN component connections, device management access, and interpreting the WLAN GUI.
The first objectives use configure and verify, meaning simulation questions. The exam rewards CLI fluency and reading show output, with VLANs and trunking the most heavily tested.
How it's tested
CCNA questions in this domain are often simulations asking you to configure VLANs, trunking, EtherChannel or spanning tree, or to interpret show output. CCNA questions are scenario-based, and many are hands-on simulations needing real Cisco IOS commands and show-output interpretation, so read the scenario and apply the configuration or concept it points to before answering.
-
VLAN and trunk config
A segmentation or interswitch need is described, and you configure VLANs, access or trunk ports.
-
Spanning tree and EtherChannel
A loop-prevention or bundling need is described, and you interpret spanning tree or configure EtherChannel.
-
Discovery and wireless
A discovery, wireless or management need is described, and you choose CDP/LLDP, the architecture or access method.
Two switches must carry traffic for several VLANs between them over a single link. An access port carries only one VLAN, so it cannot do this. Configuring the link as an 802.1Q trunk port tags frames with their VLAN IDs so multiple VLANs cross the single link between switches, which is the interswitch-connectivity configuration the exam expects, with the native VLAN carrying untagged traffic.
Domains 9
Official domains from the Cisco outline, in outline order.
2.1 Configure and verify VLANs spanning multiple switchesAccess ports, data and voice VLANs, default VLAN, inter-VLAN connectivity.
- What it means
- This covers configuring and verifying normal-range VLANs across multiple switches: creating VLANs, assigning access ports, data and voice VLANs, the default VLAN, and enabling connectivity between VLANs via a router or Layer 3 switch.
- What to understand
- VLANs segment a switched network into separate broadcast domains. Access ports belong to one VLAN, voice VLANs carry phone traffic separately, and inter-VLAN routing requires a router-on-a-stick or a Layer 3 switch with SVIs. Configuring and verifying VLANs by command is a core, heavily tested skill.
- How it shows up
- A segmentation or inter-VLAN need is described, and you must configure or verify VLANs and access ports.
- Common confusion
- Forgetting that inter-VLAN communication needs a router or Layer 3 switch, or confusing access with trunk ports.
2.2 Configure and verify interswitch connectivity (trunking, 802.1Q, native VLAN)Trunk ports, 802.1Q tagging and the native VLAN.
- What it means
- This covers configuring and verifying interswitch connectivity: trunk ports that carry multiple VLANs between switches, 802.1Q VLAN tagging, and the native VLAN that carries untagged traffic on a trunk.
- What to understand
- A trunk port carries traffic for many VLANs between switches, tagging frames with 802.1Q so the receiving switch knows the VLAN. The native VLAN is sent untagged and must match on both ends. Misconfigured trunks and native VLAN mismatches are common, tested problems.
- How it shows up
- An interswitch connectivity need is described, and you must configure a trunk or diagnose a native VLAN mismatch.
- Common confusion
- Confusing access and trunk ports, or mismatching the native VLAN between two trunk ends.
2.3 Configure and verify Layer 2 discovery protocols (CDP and LLDP)CDP and LLDP.
- What it means
- This covers configuring and verifying Layer 2 discovery protocols: Cisco Discovery Protocol and the open-standard Link Layer Discovery Protocol, which let devices learn about directly connected neighbors.
- What to understand
- CDP is Cisco-proprietary and LLDP is the open standard; both discover directly connected devices and their details. Knowing that LLDP is vendor-neutral while CDP is Cisco-only is a frequent exam point, along with how to enable and read neighbor information.
- How it shows up
- A discovery need is described, and you must choose or configure CDP or LLDP.
- Common confusion
- Confusing CDP (Cisco-proprietary) with LLDP (open standard).
2.4 Configure and verify Layer 2 and Layer 3 EtherChannel (LACP)Link bundles with LACP.
- What it means
- This covers configuring and verifying EtherChannel: bundling multiple physical links into one logical link for bandwidth and redundancy, at Layer 2 or Layer 3, using LACP, the open-standard negotiation protocol.
- What to understand
- EtherChannel aggregates links so they act as one, increasing bandwidth and providing redundancy without spanning tree blocking them. LACP is the open standard, PAgP is Cisco-proprietary, and links can also be set statically to on. Matching settings on both ends is required for the bundle to form.
- How it shows up
- A bandwidth or redundancy need is described, and you must configure EtherChannel with the right protocol.
- Common confusion
- Confusing LACP (open standard) with PAgP (Cisco-proprietary), or mismatching the mode on each end.
2.5 Interpret the basic operation of Rapid PVST+ Spanning Tree ProtocolRoot bridge, port roles and states, PortFast, and STP protection.
- What it means
- This covers interpreting Rapid PVST+ spanning tree: root bridge election by lowest bridge ID, port roles and states, PortFast for edge ports, and the protection features root guard, loop guard, BPDU guard and BPDU filter.
- What to understand
- Spanning tree prevents switching loops by electing a root bridge and placing redundant ports into blocking states. The lowest bridge ID wins the root election. PortFast speeds up edge ports, and the protection features guard against rogue bridges and loops. Interpreting show spanning-tree output is the tested skill.
- How it shows up
- Spanning tree output or behavior is described, and you must interpret the root, roles, states or protection feature.
- Common confusion
- Misreading port roles and states, or confusing the protection features such as root guard and BPDU guard.
2.6 Describe Cisco wireless architectures and AP modesWireless deployment models and access point modes.
- What it means
- This covers describing Cisco wireless architectures, such as autonomous, controller-based (split-MAC) and cloud-managed deployments, and access point modes such as local and other operating modes.
- What to understand
- Wireless can be autonomous with standalone APs, controller-based where a wireless LAN controller manages lightweight APs, or cloud-managed. AP modes determine how an access point operates. Understanding these architectures and when each applies is the descriptive knowledge expected.
- How it shows up
- A wireless deployment need is described, and you must identify the architecture or AP mode.
- Common confusion
- Confusing autonomous with controller-based (split-MAC) wireless architectures.
2.7 Describe physical infrastructure connections of WLAN componentsAP, WLC, access and trunk ports, and LAG.
- What it means
- This covers describing how WLAN components physically connect: access points, wireless LAN controllers, the access and trunk ports used, and link aggregation between the controller and the switched network.
- What to understand
- Access points connect to switch ports, controllers connect to the network often via trunk ports and link aggregation, and the right port types carry management and client VLAN traffic. Understanding these physical connections is needed to deploy and troubleshoot wireless.
- How it shows up
- A WLAN connection need is described, and you must identify the correct port type or connection.
- Common confusion
- Confusing when access versus trunk ports are used for WLAN component connections.
2.8 Describe network device management accessConsole, Telnet, SSH, HTTP/HTTPS, TACACS+/RADIUS and cloud managed.
- What it means
- This covers describing network device management access methods: console, Telnet, SSH, HTTP and HTTPS, TACACS+ and RADIUS for authentication, and cloud-managed access, and their security implications.
- What to understand
- Devices are managed in-band or out-of-band through several methods, and secure options such as SSH and HTTPS should replace insecure Telnet and HTTP. TACACS+ and RADIUS centralize authentication, and cloud-managed access was added in v1.1. Choosing the secure management method is the key point.
- How it shows up
- A device-management need is described, and you must choose the access method or secure protocol.
- Common confusion
- Choosing insecure Telnet or HTTP where SSH or HTTPS should be used.
2.9 Interpret the wireless LAN GUI configuration for client connectivityWLAN creation, security settings and QoS profiles in the GUI.
- What it means
- This covers interpreting the wireless LAN controller GUI for client connectivity: creating a WLAN, configuring security settings, and applying QoS profiles so clients connect correctly.
- What to understand
- Configuring a WLAN in the controller GUI involves naming the WLAN, setting its security such as WPA2, and applying QoS. Interpreting these GUI settings to ensure clients can connect securely is the expected skill, complementing the CLI focus of the rest of the domain.
- How it shows up
- A WLAN GUI configuration is shown, and you must interpret the settings for client connectivity.
- Common confusion
- Misinterpreting the security or QoS settings needed for clients to connect.
High-yield concepts
The terms, rules and formulas this domain turns into questions most often.
-
VLANs
Segment a switch into broadcast domains.
- Remember
- Isolate traffic logically.
- Tested as
- Switching questions.
- Trap
- Expecting isolation without VLANs.
-
Access vs. trunk port
One VLAN versus many VLANs.
- Remember
- Trunks tag with 802.1Q.
- Tested as
- Switching questions.
- Trap
- Confusing the two.
-
Native VLAN
Untagged traffic on a trunk.
- Remember
- Must match on both ends.
- Tested as
- Trunking questions.
- Trap
- Native VLAN mismatch.
-
Inter-VLAN routing
Routing between VLANs.
- Remember
- Needs a router or Layer 3 switch.
- Tested as
- VLAN questions.
- Trap
- Expecting a Layer 2 switch to route.
-
CDP vs. LLDP
Cisco-proprietary versus open standard.
- Remember
- LLDP is vendor-neutral.
- Tested as
- Discovery questions.
- Trap
- Confusing the two.
-
EtherChannel and LACP
Bundling links; LACP is the open standard.
- Remember
- PAgP is Cisco-proprietary.
- Tested as
- Bundling questions.
- Trap
- Confusing LACP and PAgP.
-
Spanning tree root bridge
Elected by lowest bridge ID.
- Remember
- Prevents loops.
- Tested as
- STP questions.
- Trap
- Misjudging the root election.
-
STP protection features
Root guard, loop guard, BPDU guard, BPDU filter.
- Remember
- Guard against rogue bridges and loops.
- Tested as
- STP questions.
- Trap
- Confusing the features.
-
Wireless architectures
Autonomous, controller-based, cloud-managed.
- Remember
- Controllers manage lightweight APs.
- Tested as
- Wireless questions.
- Trap
- Confusing the architectures.
-
Secure management access
SSH and HTTPS over Telnet and HTTP.
- Remember
- Prefer secure protocols.
- Tested as
- Management questions.
- Trap
- Using insecure Telnet or HTTP.
Side by side
Concepts candidates mix up, compared on the point that decides the answer.
Access port vs. trunk port
| Concept | Meaning | Key difference | Common trap |
|---|---|---|---|
| Access port | Carries one VLAN | Connects end devices | Confusing with a trunk |
| Trunk port | Carries many VLANs | Tags with 802.1Q, connects switches | Native VLAN mismatch |
CDP vs. LLDP and LACP vs. PAgP
| Concept | Meaning | Key difference | Common trap |
|---|---|---|---|
| CDP / PAgP | Cisco-proprietary | Cisco-only | Assuming vendor-neutral |
| LLDP / LACP | Open standard | Vendor-neutral | Confusing with the Cisco versions |
Autonomous vs. controller-based wireless
| Concept | Meaning | Key difference | Common trap |
|---|---|---|---|
| Autonomous | Standalone APs | Each AP managed individually | Confusing with controller-based |
| Controller-based | WLC manages lightweight APs | Centralized management | Confusing with autonomous |
Exam traps
Each trap is an answer that looks right. Learn the clue that should change your mind.
-
Access port for multiple VLANs
- What candidates pick
- Use an access port to carry several VLANs between two switches.
- Why it looks right
- Access ports connect to the switch.
- Why it's wrong
- An access port carries one VLAN; a trunk port with 802.1Q tagging carries multiple VLANs between switches.
Clue to watch for Multiple VLANs must cross a single interswitch link.
-
Layer 2 switch routes VLANs
- What candidates pick
- Expect a Layer 2 switch alone to route between VLANs.
- Why it looks right
- The switch has the VLANs.
- Why it's wrong
- Inter-VLAN routing needs a router (router-on-a-stick) or a Layer 3 switch with SVIs.
Clue to watch for Hosts in different VLANs must communicate.
-
PAgP is vendor-neutral
- What candidates pick
- Choose PAgP for an EtherChannel to a non-Cisco switch.
- Why it looks right
- PAgP bundles links.
- Why it's wrong
- PAgP is Cisco-proprietary; LACP is the open standard for multi-vendor EtherChannel.
Clue to watch for The link connects to non-Cisco equipment.
-
Native VLAN mismatch
- What candidates pick
- Set different native VLANs on each end of a trunk.
- Why it looks right
- Each switch is configured.
- Why it's wrong
- The native VLAN must match on both trunk ends, or untagged traffic is misassigned and errors occur.
Clue to watch for A trunk shows native VLAN mismatch messages.
-
Telnet for management
- What candidates pick
- Use Telnet to manage a device remotely.
- Why it looks right
- Telnet provides remote access.
- Why it's wrong
- Telnet is insecure and sends data in clear text; SSH should be used for secure remote management.
Clue to watch for Remote management must be secure.
Answer framework
For any Domain 2 scenario, use these steps to find the answer CCNA expects.
- Identify whether the need is VLANs and trunking, EtherChannel or spanning tree, or discovery, wireless and management.
- For segmentation, configure VLANs and access ports, use trunk ports with 802.1Q and a matching native VLAN between switches, and route between VLANs with a router or Layer 3 switch.
- For redundancy and loops, configure EtherChannel with LACP for multi-vendor links and interpret Rapid PVST+ roles, states and protection features.
- For discovery, use CDP or the open-standard LLDP, and for management prefer secure SSH and HTTPS.
- For wireless, identify the architecture and AP mode, the component connections, and interpret the WLAN GUI for secure client connectivity.
Practice question
Want more like this? The CCNA practice test has questions for every domain.
Checklist
0 of 10
Tick each one you can do without notes. Your ticks stay in this browser.
Study strategy
This is the switching domain and it is intensely hands-on, so spend your time at a real or simulated switch CLI rather than memorizing commands. Start with VLANs and trunking, the most heavily tested topics: configure VLANs across switches, set access and trunk ports with matching native VLANs, and enable inter-VLAN routing. Practice reading show vlan and show interfaces trunk output.
Next, master spanning tree interpretation, Rapid PVST+ root election, port roles and states, and the v1.1 protection features, and configure EtherChannel with LACP. Learn the open-standard-versus-Cisco pairs (LLDP and LACP versus CDP and PAgP), which the exam loves to test. Then cover the descriptive wireless objectives and secure management access.
Because simulation items hand you show output and ask what is broken, practice interpreting, not just configuring. Build a three-switch topology with a trunk and an EtherChannel, then change the bridge priority and check show spanning-tree to watch the port roles change. Afterwards, move to Domain 3, IP Connectivity.
FAQ
How much of the CCNA is Domain 2?
Network Access is 20% of the exam, the switching domain, with much of the hands-on configuration content.
What is the difference between an access port and a trunk port?
An access port carries traffic for a single VLAN and connects end devices. A trunk port carries traffic for multiple VLANs between switches, tagging frames with 802.1Q, and uses a native VLAN for untagged traffic.
Which discovery and bundling protocols are open standards?
LLDP is the open-standard discovery protocol (CDP is Cisco-proprietary), and LACP is the open-standard EtherChannel protocol (PAgP is Cisco-proprietary). The exam frequently asks which is vendor-neutral.
How does spanning tree choose the root bridge?
By the lowest bridge ID, which combines the bridge priority and MAC address. The root bridge is the reference point from which spanning tree builds a loop-free topology.
What is needed for inter-VLAN routing?
A router using router-on-a-stick with subinterfaces, or a Layer 3 switch with switched virtual interfaces. A Layer 2 switch alone cannot route between VLANs.
Why avoid Telnet for management?
Telnet sends data, including credentials, in clear text. SSH encrypts the session and should be used for secure remote management, as should HTTPS over HTTP.
How does Domain 2 connect to the rest of the exam?
It applies the switching concepts from Domain 1 and builds the switched network that IP Connectivity in Domain 3 routes across, with security features extended in Domain 5.
Other Networking certifications
Where the same subject shows up in other exams. Cards marked "Same subject" open the matching domain.
Test your Domain 2 knowledge
You have covered VLANs, trunking, EtherChannel, spanning tree and wireless access. Test whether you can configure and interpret switching under exam conditions.