Network Implementations and Security

Week of 2026-10-06 · Download .docx

Objectives

Identify Ethernet and fiber standards by speed, cable type, and maximum distance.
Distinguish between IEEE 802.11 wireless standards by band, generation, and key feature.
Explain how VLANs segment a switched network and what is required to route between them.
Describe how NAT allows multiple private hosts to share a single public IP address.
Compare WEP, WPA, WPA2, and WPA3 and explain why WPA3 is required for new deployments.

Key terms

10GBASE-T: IEEE 802.3an Ethernet standard delivering 10 Gbps over Cat6A copper cable up to 100 meters.
802.11ax: Wi-Fi 6 — the IEEE wireless standard using OFDMA and improved MU-MIMO for high-density environments; operates on both 2.4 GHz and 5 GHz bands.
VLAN: Virtual Local Area Network — a logical network segment created on a managed switch that isolates broadcast domains without requiring separate physical hardware.
802.1Q: IEEE VLAN tagging standard — adds a 4-byte tag to Ethernet frames identifying the VLAN; used on trunk ports connecting switches.
NAT: Network Address Translation — translates private IP addresses to a shared public IP address (and port number) for outbound internet communication.
PAT: Port Address Translation — a form of NAT that uses unique port numbers to distinguish each internal device sharing one public IP; also called overloaded NAT.
WPA3: Wi-Fi Protected Access 3 — current strongest Wi-Fi security standard; uses SAE to replace the WPA2 PSK handshake, preventing offline dictionary attacks.
SAE: Simultaneous Authentication of Equals — the WPA3 handshake mechanism that prevents offline dictionary attacks by requiring interactive proof of knowledge.
STP: Spanning Tree Protocol (IEEE 802.1D) — prevents Layer 2 loops in redundant switch topologies by placing blocking ports on all but one active path.
LACP: Link Aggregation Control Protocol (IEEE 802.3ad) — dynamically bundles multiple physical Ethernet links into a single logical link for increased bandwidth and redundancy.
PoE: Power over Ethernet (IEEE 802.3af/at/bt) — delivers DC power alongside Ethernet data over standard Cat cable, powering IP phones, APs, and cameras.
DMZ: Demilitarized Zone — a network segment between the internet and the internal LAN that hosts public-facing servers while shielding the internal network from direct internet exposure.
ACL: Access Control List — an ordered set of permit and deny rules on a router or firewall that filters traffic based on source/destination IP, port, and protocol.

The concept

Module 2 covers the physical and logical technologies that build real networks: Ethernet standards for wired connections, wireless 802.11 generations, VLANs for logical segmentation, NAT for IP address conservation, and security mechanisms from STP to firewalls.

Ethernet standards define cable type and maximum distance. 1000BASE-T (Gigabit Ethernet) runs at 1 Gbps over Cat5e or Cat6 for up to 100 meters — the standard for desktop connections today. 10GBASE-T delivers 10 Gbps over Cat6A for 100 meters (or Cat6 for 55 meters). For building-to-building links exceeding copper distances, fiber standards apply: 1000BASE-SX uses multimode fiber for 550 meters; 1000BASE-LX uses single-mode fiber for 5 kilometers. PoE (IEEE 802.3af/at/bt) delivers both data and DC electrical power over standard Cat cabling, eliminating the need for a separate power outlet near each IP phone, wireless access point, or IP camera.

Wireless standards are identified by IEEE 802.11 designations. The progression is 802.11b/g (2.4 GHz, up to 54 Mbps), 802.11n — Wi-Fi 4 (dual-band, 600 Mbps with MIMO), 802.11ac — Wi-Fi 5 (5 GHz only, multi-gigabit), and 802.11ax — Wi-Fi 6 (dual-band, introduces OFDMA for high-density efficiency). Wi-Fi 6 is the current generation and the standard to know for Network+. For security, WPA3 uses SAE (Simultaneous Authentication of Equals) to replace WPA2's PSK handshake, which was vulnerable to offline dictionary attacks. WEP and original WPA are deprecated and should never be used.

VLANs logically segment a physical switched network into multiple broadcast domains without requiring separate hardware. A managed switch assigns ports to VLANs; traffic stays within a VLAN by default. IEEE 802.1Q tagging is applied on trunk ports that carry multiple VLANs between switches. To route traffic between VLANs — for example, to allow the IT VLAN to print to a printer on the Sales VLAN — a Layer 3 switch or router is required.

NAT (Network Address Translation) is how the world's billions of private IP devices share the limited pool of public IPv4 addresses. When a device on 192.168.1.x sends traffic to the internet, the router replaces the private source address and port with its own public IP and a unique port number. The router keeps a translation table so return traffic can be forwarded back to the correct internal device. This PAT (Port Address Translation) model is how virtually every home and office router works.

Security at Layer 2 and Layer 3 uses STP and ACLs. STP prevents broadcast storms and infinite loops in redundant switch topologies by placing redundant ports in a blocking state. ACLs on routers and firewalls enforce traffic policies: each rule specifies a source, destination, port, and permit or deny action. Rules are evaluated top to bottom; the first match wins. A DMZ places public-facing servers on a segment exposed to the internet while a firewall prevents direct access from the DMZ into the internal LAN.

Worked examples

Example 1: Selecting the correct Ethernet standard: A school needs to connect a new server room to the main distribution switch 80 meters away. The school wants 10 Gbps. Evaluate options: 10GBASE-T over Cat6A supports 10 Gbps for 100 meters — 80 meters is within spec. 10GBASE-SR over multimode fiber also supports 10 Gbps for 300 meters and is valid but costs more. 1000BASE-T is only 1 Gbps — insufficient. Recommendation: 10GBASE-T over Cat6A if existing conduit supports copper; 10GBASE-SR fiber if the conduit already carries fiber or future upgrades beyond 100 meters are planned.

Example 2: Inter-VLAN routing in Packet Tracer: A student has VLAN 10 (192.168.10.0/24) and VLAN 20 (192.168.20.0/24) on a managed switch. A host on VLAN 10 cannot ping a host on VLAN 20. Step 1 — verify VLAN assignment: confirm both hosts are on the correct VLANs using 'show vlan brief' on the switch. Step 2 — note that switches do not route between VLANs by default. Step 3 — connect the switch trunk port to a router (or use a Layer 3 switch). Step 4 — on the router, create sub-interfaces (Router-on-a-Stick): interface g0/0.10 with IP 192.168.10.1/24 and encapsulation dot1q 10; interface g0/0.20 with IP 192.168.20.1/24 and encapsulation dot1q 20. Step 5 — set each host's default gateway to the corresponding sub-interface IP. Step 6 — ping succeeds across VLANs.

Common mistakes

Confusing 802.11ac with Wi-Fi 6. 802.11ac is Wi-Fi 5 (5 GHz only). 802.11ax is Wi-Fi 6 (dual-band, OFDMA). On Network+ questions, the Wi-Fi generation number and the IEEE standard number are both tested — know both mappings.
Assuming VLANs provide routing. VLANs isolate broadcast domains on a switch — they do not route between themselves. A Layer 3 device is always required to move traffic between VLANs. Creating a VLAN does not automatically create a route.
Confusing STP and LACP. STP prevents loops by blocking redundant paths (one active path at a time). LACP aggregates multiple links into one bundle (all links active simultaneously). They solve different problems at Layer 2.
Thinking WPA2 is acceptable for new installations. WPA2's PSK 4-way handshake is vulnerable to offline PMKID and dictionary attacks. For any new deployment, WPA3 with SAE is required. WPA2 remains in use on legacy devices but should not be chosen for new network designs.
Forgetting that PoE operates only over copper Cat cable. PoE cannot deliver power over fiber. If a device needs PoE, the connection from the PoE switch must be copper Cat cable, not fiber — even if the rest of the infrastructure uses fiber.

Self-check

Try each question before reading the answer. Answers at the bottom of this page.

1. Which IEEE standard is Wi-Fi 6?

802.11n
802.11ac
802.11ax
802.11g

2. Traffic between VLAN 10 and VLAN 20 on the same switch requires:

A longer trunk cable
A Layer 3 switch or router
An additional managed switch
A DHCP server

3. NAT translates a private source IP to the router's public IP when traffic leaves the network. What additional value is tracked to distinguish multiple simultaneous sessions?

MAC address
VLAN tag
Port number
TTL value

4. WPA3 improves on WPA2 by replacing its PSK handshake with:

WEP encryption
RC4 cipher
SAE (Simultaneous Authentication of Equals)
TKIP

5. Which protocol prevents a Layer 2 broadcast storm by blocking redundant switch paths?

LACP
NAT
STP
ACL

Self-check answers

1. C — 802.11ax is Wi-Fi 6. It introduced OFDMA and improved MU-MIMO for high-density environments and operates on both 2.4 GHz and 5 GHz bands.
2. B — VLANs create separate broadcast domains. Routing between them requires a Layer 3 device — either a separate router (Router-on-a-Stick) or a Layer 3 switch.
3. C — PAT (Port Address Translation) tracks unique source port numbers alongside the public IP, allowing hundreds of internal devices to share one public IP and receive correct return traffic.
4. C — WPA3 uses SAE (also called the Dragonfly handshake), which requires interactive proof of knowledge and prevents the offline dictionary attacks that were possible against WPA2 PSK.
5. C — STP (Spanning Tree Protocol) detects redundant paths in a switched network and places all but one path in a blocking state, preventing frames from looping endlessly.

Canvas is the official record. This companion enhances the PGCC curriculum; it does not replace it. Last name and class year only. Students with a 504 plan or IEP: your accommodations apply.

↑ Back to top