Network components
What routers, Layer 2 and Layer 3 switches, next-generation firewalls, access points, controllers, endpoints, servers and PoE each do in an enterprise network.
Device roles
Device roles at a glance
Maintains a routing table; each interface is a separate broadcast domain.
Learns source MACs per port; forwards, floods, or filters frames.
Uses SVIs and routed ports to route between VLANs at wire speed.
Converts 802.11 frames to 802.3 Ethernet; one BSS per radio/SSID.
A WLC manages lightweight APs; Cisco DNA Center manages the fabric.
Network components and their function
| Component | Primary function | Operates mainly at | Typical placement |
|---|---|---|---|
| Router | Selects paths and forwards packets between IP networks | Layer 3 | WAN edge, between subnets, internet edge |
| L2 switch | Forwards frames between ports using the MAC table | Layer 2 | Access/distribution inside a LAN |
| L3 switch | Combines switching with inter-VLAN routing | Layers 2–3 | Distribution/core of a campus LAN |
| NGFW / IPS | Filters traffic using application and threat context | Layers 3–7 | Trust boundary, internet edge, DC edge |
| Access point | Associates wireless clients and bridges to Ethernet | Layer 2 (802.11 ↔ 802.3) | Ceilings/walls across the coverage area |
| WLC / controller | Centralizes AP config, RF management and roaming | Control/management plane | Data center or cloud |
| Endpoint | Originates and consumes traffic | All layers (host stack) | Desktops, phones, IoT devices |
| Server | Provides services to endpoints | All layers (host stack) | Data center, server room, cloud |
A next-generation firewall (NGFW) goes beyond port/protocol filtering: it identifies applications regardless of port, inspects TLS metadata, enforces user identity rules and can terminate VPNs. An IPS (intrusion prevention system) compares traffic against exploit signatures and anomaly models and blocks matches inline; an NGFW usually embeds IPS as one function of the device.
Two controller roles appear on the blueprint. A wireless LAN controller (WLC) terminates CAPWAP tunnels from lightweight APs, pushes SSID and radio configuration, and coordinates roaming. Cisco DNA Center is the enterprise SDN controller: it holds inventory, intent and policy and programs devices through southbound APIs.
Power over Ethernet
Power over Ethernet (PoE) delivers DC power over the same UTP pairs that carry data, so phones, cameras and APs need no local power supply. Standards differ in how much power a powered device may draw; the switch advertises a class and the device negotiates what it needs.
PoE standards and power budgets
| Standard | Common name | PSE output | PD receives | Pairs used |
|---|---|---|---|---|
| 802.3af | PoE | 15.4 W | 12.95 W | 2 pairs |
| 802.3at | PoE+ | 30 W | 25.5 W | 2 pairs |
| 802.3bt Type 3 | PoE++ / UPoE (Cisco proprietary name) | 60 W | 51 W | 4 pairs |
| 802.3bt Type 4 | PoE++ / UPoE | 90 W | 71.3 W | 4 pairs |
Applying and verifying
- Users
- 40 wired PCs + 20 wireless laptops + 10 IP phones
- Site
- One floor, single ISP handoff
- The 10 IP phones and the APs need power: choose 802.3at (PoE+) access switches; phones and typical APs draw under 25 W, though a high-powered AP could need 802.3bt on that port.
- Wired and wireless clients share VLANs: the APs bridge client traffic onto the wired LAN, so AP uplinks are access or trunk ports depending on how many SSIDs map to VLANs.
- Inter-VLAN traffic needs a Layer 3 device: a Layer 3 switch at distribution or a router-on-a-stick provides default gateways.
- The ISP handoff terminates on the router; an NGFW function at the edge enforces policy for internet traffic.
Reading a diagram for 'which device does this job' is the skill the exam checks — role first, brand never.
Common mistakes
- Assuming a Layer 2 switch can route between VLANs — it cannot; you need a router or a Layer 3 switch SVI.
- Calling every firewall a NGFW — stateful port/protocol filtering alone is not next-generation.
- Expecting PoE budget to be unlimited — the switch has a total wattage budget shared across ports.
- Treating the WLC as a mandatory data-path hop — CAPWAP tunnels carry client traffic to the WLC only in tunnelled (local mode) designs.
Observation: IP phone boots, displays no network, switch port shows link.
- Missing voice VLAN configuration on the access port
- PoE delivered but data VLAN misconfigured
- Port security or err-disabled state blocking the port
| Check | Indicates |
|---|---|
show interfaces status / show interface gi0/1 | err-disabled or down status points to a port-level cause, not DHCP or voice VLAN. |
show power inline gi0/1 | Confirms the phone actually negotiated and is drawing power. |
show running-config interface gi0/1 | Reveals a missing switchport voice vlan or a wrong access VLAN. |
Correction: Apply the missing voice/data VLAN config or clear the err-disabled state after fixing the cause.
Phone registers and show cdp neighbors shows the device; call succeeds end to end.
Related resources
Sources
- Cisco CCNA 200-301 v1.1 Exam Topics (official PDF) — reviewed 2026-11-02
Targets CCNA 200-301 v1.1 objectives. Supplemental blocks are labeled beyond exam scope.