Routing & Device Layers Study Guide

01

The Router — What It Does & Its AnatomyTOPIC 01 OF 17

// Router Description

Concept	Detail
Router	A Layer 3 device that uses IP addressing to forward packets between networks, connecting two or more lines from different networks
How it works	Reads a packet's IP address to determine the destination network, then uses its routing table/policy to direct the packet onward
Internetwork	Routers in different networks connected together to create one larger internetwork

// External Components

Component	Function
Console port	Local configuration via terminal emulation software; needs no prior config — the port used to set up a "blank" router
Auxiliary port	Remote configuration via modem; must be configured before use; should be disabled for security in the field
Network interfaces	Ethernet/Token Ring for LAN connections, synchronous serial for WAN; configured via TFTP, virtual terminals, Cisco Security Device Manager, or network management stations

// Internal Components (Memory)

Memory	Holds
ROM	Diagnostic & boot-up (bootstrap) routines
FLASH	The Internetwork Operating System (IOS)
NVRAM	The startup-configuration file (non-volatile)
RAM	Working memory: running-configuration, a copy of the IOS, routing tables, and process data

// Startup sequenceBootstrap runs from ROM → hardware interfaces are tested → IOS loads from FLASH into RAM → startup-config copies from NVRAM into RAM, becoming the running-config. Changes to the running-config are volatile — if the router loses power without copying running-config back to NVRAM, all changes are lost.

02

Gateways & Autonomous SystemsTOPIC 02 OF 17

// Router / Gateway Types

Type	Role
Interior router	Operates within a single LAN
Exterior router	Directs packets between hosts in one LAN and hosts in another LAN
Border router / gateway	Connects a LAN to a Wide Area Network (WAN)
Gateway (modern usage)	A device that converts data from one protocol/format to another (e.g., TCP/IP to IPX/SPX)
Default gateway	An IP address on a Layer 3 device that's a host's access point off its own subnet — the nearest router interface on that subnet

// Autonomous System (AS)

Term	Definition
AS (RFC 1930)	"A connected group of one or more IP prefixes run by one or more network operators which has a SINGLE and CLEARLY DEFINED routing policy." Example: the internal networks within an Air Force Base
Areas	Groups of contiguous networks and attached hosts within an AS; also called routing domains
Interior Gateway	Exchanges info within an AS using Interior Gateway Protocols (IGPs): RIP, IGRP, OSPF, EIGRP
Exterior Gateway	Moves info between AS's using Exterior Gateway Protocols (EGPs), e.g. BGP. Routing from one AF Base to another is inter-AS routing

03

Internetworking Challenges & Broadcast DomainsTOPIC 03 OF 17

// The 4 Common Internetworking Challenges

Challenge	Description
Connectivity	Supporting communication between very different technologies, media, and speeds
Reliable service	Consistent, dependable access to network resources for users and organizations
Network management	Centralized support & troubleshooting: Fault, Configuration, Accounting, Performance, Security
Flexibility	Accommodating network expansion/contraction and new applications/services

// Broadcast Domain

Concept	Detail
Broadcast domain	A portion of a network limited by its router connection to a specific group of hosts on a common LAN segment
Local broadcast	Devices in the domain share a common local broadcast address of 255.255.255.255, received by all computers on the segment
Subnet	Hosts in a broadcast domain also share a common logical Network Layer (directed broadcast) addressing scheme, i.e. a subnet
Segmentation example	Router breaks the classful network 172.16.0.0/16 into smaller broadcast domains on interfaces F0/0 (172.16.30.1/24), F0/1, and F0/2 — a more efficient use of address space

// NoteRouters and switches are the primary devices used to overcome internetworking challenges — routers segment networks into broadcast domains, while switches (and routers) segment collision domains.

04

Addressing & Routed vs. Routing ProtocolsTOPIC 04 OF 17

// Physical vs. Network Addressing

Type	Detail
Physical (MAC) addressing	Sends info between two directly connected Layer 2 interfaces. Hosts usually have one MAC address; routers have multiple (one per interface). Each router interface is its own collision & broadcast domain
Network (logical) addressing	Sends info between networks; used at Layer 3. IPv4/IPv6 are logical addresses. Not permanent to a device — typically tied to a segment or VLAN

// Routed Protocols vs. Routing Protocols

Term	Definition
Routed protocol (network protocol)	Provides the logical addressing a router uses to determine a packet's destination network. Examples: IP, IPX, AppleTalk. Occurs at the upper 5 OSI layers
Routing protocol	Delivers those routed-protocol messages by building/maintaining routing tables (RIP, OSPF, EIGRP, BGP)
Simplified view: routed protocols are the messages; routing protocols deliver those messages.

// Internet Protocol (IP) — 2 Primary Responsibilities

#	Responsibility
1	Connectionless, best-effort delivery of packets through an internetwork based on logically assigned addresses
2	Fragmentation & reassembly of packets to support data links with different Maximum Transmission Unit (MTU) sizes

05

Key Support Protocols — ARP, Hello & ICMPTOPIC 05 OF 17

// Address Resolution Protocol (ARP)

Concept	Detail
Purpose	Maps IP (network) addresses to MAC addresses
ARP cache	Memory where a resolved IP-to-MAC mapping is stored for reuse
Single LAN	Source broadcasts an ARP request; only the host owning the destination IP replies with its MAC address
Across LANs	The router (default gateway) acts as proxy — it replies to the ARP request with its own MAC address, becoming the effective next hop for the destination

// Hello Protocol & ICMP

Protocol	Function
Hello Protocol	Used by various routing protocols for neighbor discovery and as a keep-alive to confirm a connected router/link is still functional
ICMP (Internet Control Message Protocol)	Network Layer management protocol reporting errors/info back to the source: Destination Unreachable, Time Exceeded, Router Advertisement, Router Solicitation, Echo Request/Reply
Ping (Packet Internet Groper)	Sends an ICMP echo request to test IP reachability. A Network-Layer-to-Network-Layer test only — it does not check the entire protocol stack

06

Router Functions — Path Determination & Packet SwitchingTOPIC 06 OF 17

// Path Determination Messaging

Message Type	Used By	Detail
Broadcast (routing update)	Distance Vector protocols	Sends the entire routing table to directly connected neighbor routers
Multicast (link-state advertisement)	Link State protocols	Informs routers of the sender's link status to build a full topology picture

// Packet Switching Process

Step	Action
1	Host determines destination is on a different network — sends an ARP request to learn its default gateway's (router's) MAC address (or uses its ARP cache)
2	Host sends the packet with the router's MAC address (Layer 2 header) and the destination host's IP address (Layer 3 header)
3	Router receives it, examines the destination Network Layer address, and either forwards it or discards it if the path is unknown
4	If forwarding, the router swaps source/destination MAC addresses for the next hop and transmits — repeats until the destination is reached

// Constant vs. changingAs a packet crosses the internetwork, its Layer 2 (MAC) addresses change at every hop, but its Layer 3 (IP) source/destination addresses remain constant end to end.

// Why a Packet Gets Discarded

Reason	Detail
No routing table entry	Router has no listing that can be used to forward the packet
Bad version number	IP header version number is incorrect
TTL expired	Time to Live counter reaches zero while routing
Checksum error	Bit error during transmission fails the CRC/checksum check
Security bits	DoD security bits are set and the receiving system isn't authorized
Fragmentation not allowed	Packet needs fragmenting but the "allow fragmentation" flag isn't set
Network issues	Congested router with full buffers, or a temporarily unusable connection

07

Static, Default & Dynamic RoutesTOPIC 07 OF 17

// Route Types

Type	Detail
Static route	Manually configured by the admin as the only path; doesn't change unless the admin changes it. Good for security & reducing traffic, simple, but unsuitable for large, changing networks since it can't react to failures
Default route (gateway of last resort)	A special static route used when no route to the destination is known. Sends "non-routable" packets (destinations not in the routing table) somewhere useful instead of discarding them
Dynamic route	Learned automatically: routers exchange info with other routers, recalculate routes on topology changes, and update the routing table at regular intervals. Examples: RIP, IGRP, OSPF, EIGRP, BGP

// IP routing, one hop at a timeThe entire route isn't known up front. At each router, the next hop is calculated by matching the packet's destination against the routing table's destination/next-hop entries. Routers don't confirm delivery — error reporting back to the source is left to ICMP.

08

Administrative DistanceTOPIC 08 OF 17

// The Concept

Concept	Detail
Administrative Distance (AD)	When a router knows multiple paths to the same destination from more than one routing source, it chooses the path with the lowest AD
Rule of thumb	The lower the AD, the more trustworthy the route

// Example From the Study Guide

Source	Administrative Distance
EIGRP	90
OSPF	110

// AppliedA path learned via EIGRP (AD=90) will be used to forward a packet before a path to the same destination learned via OSPF (AD=110), since 90 is lower (more trusted) than 110.

09

Routing MetricsTOPIC 09 OF 17

// Common Metrics Used to Rate Paths

Metric	What It Measures
Path length	Most common metric — sum of arbitrary link costs, or simple hop count (number of routers traversed)
Reliability	Dependability of a link, usually described by its bit-error rate; assigned as an arbitrary rating by the admin
Delay	Time to move a packet source-to-destination; driven by bandwidth, port queues, congestion, and physical distance
Bandwidth	Available traffic capacity of a link; a higher-bandwidth link isn't always the better route if it's busier
Load	How busy a resource (router) is — CPU utilization, packets processed per second
Communication cost	Operating-expense based; some orgs prefer their own (slower but free) lines over costly public lines. Set by the network admin

// Hybrid metricsSophisticated routing algorithms can combine several metrics into a single hybrid metric to select the best route.

10

Routing Algorithms — Distance Vector vs. Link StateTOPIC 10 OF 17

// Table 3-1: Distance Vector vs. Link State

Category	Distance Vector	Link State
Updates sent	At regular intervals + on change	Only when status changes
Message content	All/part of the routing table (larger)	Just the changed link status (smaller)
Message destination	Broadcast	Multicast
Sent to	Neighboring routers only	Everywhere in the area
Convergence	Slower	Faster
Prone to routing loops	More prone	Less prone
CPU / memory needs	Less	More
Cost to implement/support	Less expensive	More expensive

// Distance Vector

Trait	Detail
Approach	Determines direction (vector) and distance to each link; each router sends its entire routing table to neighbors only, via broadcast
"Routing by rumor"	Nickname for DV updates — routers don't know where info originally came from and must assume it's correct
Advantages	Simple to understand/configure; low processor demand; less expensive
Disadvantages	Limited by hop count (unsuitable for large networks); RIPv1 doesn't support VLSM; builds tables from unverifiable neighbor data

// Link State (Shortest Path First)

Trait	Detail
Approach	Builds a complete topological map in memory using multicast link-state advertisements (LSAs); "sees" the entire path to the destination
Advantages	Fast convergence; supports VLSM; each router only advertises the state of its own links; less prone to routing loops
Disadvantages	Requires more CPU power & memory; more expensive to implement and support

11

Interior Gateway Protocols — RIP, OSPF & EIGRPTOPIC 11 OF 17

// RIP (Routing Information Protocol) — Distance Vector

Trait	Detail
Metric	Hop count, limited to 15
Updates	Broadcast every 30 seconds and on topology change; only the best (lowest metric) route kept; slower convergence, one router at a time
RIPv1 limitation	No support for variable length subnet masking (VLSM) — no subnet mask info in updates
RIPv2	Adds VLSM support (subnet mask in updates) and multicast updates for faster convergence
RIPng	Version developed for IPv6

// OSPF (Open Shortest Path First) — Link State

Trait	Detail
Origin	Created in the late 1980s to solve RIP's inability to handle large, diverse networks
Algorithm	Dijkstra's Shortest Path First (SPF) algorithm builds a shortest-path tree to each router
Cost metric	100 Mbps reference bandwidth ÷ interface bandwidth (e.g. a 100 Mbps link = cost 1); reference bandwidth can be adjusted so faster links don't tie with slower ones
Hierarchy	AS (routing domain) divided into areas; routers spanning areas are area border routers with separate topology databases per area
Backbone	Area 0 — distributes routing info between areas; consists of all area border routers and their attached networks
Tables	Neighbor table, Topology table (from LSAs), Routing table (from the SPF-computed shortest-path tree)
Classless	Advertises subnet masks with each destination — supports VLSM. OSPFv2 = IPv4, OSPFv3 = IPv6
Advantages	Supports very large networks; fast SPF convergence; no routing loops; classless/VLSM; smaller updates only on change
Disadvantages	Complex, requires structured topology and trained staff; link-state database is memory-heavy; SPF grows CPU-intensive as topology grows

// EIGRP (Enhanced Interior Gateway Routing Protocol) — Balanced Hybrid

Trait	Detail
Origin	Cisco proprietary protocol; converted to an open standard in 2013
Default metrics	Bandwidth and delay (reliability, load, and MTU may also be used)
"Balanced hybrid"	Combines link-state and distance-vector traits — maintains neighbor routing tables like DV, but only sends multicast updates on topology change (no periodic updates) like LS
Algorithm	Diffusing Update Algorithm (DUAL) Finite State Machine (FSM)
Tables	Separate Neighbor, Topology, and Routing tables maintained per protocol
Successor / feasible successor	DUAL FSM determines the best route (successor) and a backup route (feasible successor) from the topology table
Advantages	Fast convergence when a feasible successor exists; supports VLSM; smaller updates only on change; scales to large networks
Disadvantages	Higher memory needs (3 tables); complex/CPU-intensive during instability; no area concept

12

Exterior Gateway Protocol — BGPTOPIC 12 OF 17

// Border Gateway Protocol (BGP)

Trait	Detail
Role	The predominant Exterior Gateway Protocol — "the protocol that runs the Internet." BGP-4 implements inter-AS/inter-domain IP routing policy, used between ISPs
Classification	A path vector protocol
Reliability	Uses TCP for reliable update acknowledgements; periodic keep-alives maintain the TCP connection
Metrics	Does not use hop count, bandwidth, or delay. Uses attributes/path vectors — network policies manually configured by admins
Neighbor discovery	No automatic discovery — admins must manually define BGP neighbors and initiate a TCP session between them
Scale	As of June 2019, Internet BGP routing tables held more than 780,000 routes and growing

// Small vs. large scaleSmall, standardized networks can use one simple metric (e.g. RIP's hop count). Given the complexity of routing between Autonomous Systems, no single metric works — so BGP relies on manually-defined attributes/path vectors instead.

13

Router Logical Security & STIGsTOPIC 13 OF 17

// Logical Security

Concept	Detail
Logical security	Administrator's responsibility — authentication, password protection, and configuration practices. Password protection is the most basic step, but not the only one

// Security Technical Implementation Guides (STIG)

Concept	Detail
STIG	A methodology for standardized secure installation & maintenance of computer software and hardware; "locks down" typically permissive software to reduce vulnerabilities
Origin	Term coined in 1998 by the Defense Information Systems Agency (DISA)
Scope	Recommended admin processes spanning a device's full lifecycle; validated with STIG scanning software
Advanced STIGs	Can cover corporate network design — routers, firewalls, DNS servers, and switches
Standards body	STIGs + NSA Guides = the configuration standards for DOD Information Assurance (IA) devices/systems, maintained by DISA Field Security Operations (FSO)
Access	STIG viewer and STIGs available at cyber.mil/stigs/

14

IP Addressing Scheme ApplicationTOPIC 14 OF 17

// Two Application Methods

Method	Detail
Dynamic	An IP address an ISP (or DHCP server) lets a device use temporarily; if unused it can be reassigned to another device; typically assigned via DHCP with no user intervention required
Static	Manually applied — by a technician via CLI on switches/routers, or directly on a PC. Can also be applied as a reservation on a DHCP server

15

The Three-Layer Model & the Core LayerTOPIC 15 OF 17

// Cisco's Three-Layer Hierarchical Model

Concept	Detail
Purpose	A conceptual framework (like the OSI model) that breaks complex network design into smaller, manageable problems, letting each tier optimize hardware/software for a specific role
Three layers	Core, Distribution, and Access

// Core Layer

Concept	Detail
Definition	The literal core of the network — often called the "high-speed backbone." Its only purpose is transporting large amounts of traffic reliably and quickly
Traffic handling	User data is processed at the distribution layer, which forwards requests to the core only when necessary
Devices	Normally high-speed switches and routers
Fault tolerance	Essential — a core failure (link or device) can affect every user, especially traffic to the outside world, so redundancy is critical

// Core Layer Design Considerations

Consideration	Guidance
Speed	Don't slow down traffic — avoid access control lists, routing, and packet filtering here when possible
Workgroups	Don't connect access-layer devices directly to the core — defeats the hierarchical model
Scalability	Avoid expanding the core as the internetwork grows; prefer upgrades over expansion
Reliability & redundancy	Use Data Link technologies/media supporting both speed and redundancy — fiber (FDDI), FastEthernet with redundant links, or ATM
Protocols	Choose routing protocols with lower convergence times / fast Layer 2 switching; avoid ACL checking, encryption, and address translation here

16

Distribution LayerTOPIC 16 OF 17

// Definition

Concept	Detail
Role	The communication point between the access layer and the core layer
Primary functions	Routing, filtering, WAN access, and determining how/whether packets access the core
Path decisions	Determines the fastest way to service user requests (e.g., how a file request is forwarded to a server); forwards to the core after finding the best path
Aggregation point	Aggregates multiple access switches and must handle a large volume of traffic; employs both Layer 2 and Layer 3 devices

// Policies Implemented Here

Policy	Detail
Filtering & security	Access lists, packet filtering, queuing, security/network policies, address translation, firewalls
Redistribution	Redistributes between routing protocols, including static routing
Inter-VLAN routing	Routes between VLANs and supports other workgroup functions
Domains	Defines broadcast and multicast domains

// AvoidFunctions that exclusively belong to another layer — e.g., directly connecting PCs, which belongs to the access layer.

17

Access LayerTOPIC 17 OF 17

// Definition

Concept	Detail
Role	Ensures frames are delivered to end-user computers; the aggregation point connecting nodes (hosts) like workstations via hubs and switches
Nickname	Often called the "desktop layer" since most devices connected to access switches are desktop computers
Local resources	Provides access to the resources most users need locally, such as printers and certain servers
Switch characteristics	Many ports, low cost — built to connect multiple desktop devices up to the distribution layer

// Functions at This Layer

Function
Shared bandwidth devices
Switched bandwidth devices
Layer 2 functions such as VLAN membership
Traffic filtering based on MAC address