Network engineering from zero to senior.

341 short steps from zero. Real Cisco, Juniper and Arista routers run in a lab on your laptop.

Step 25. Network, broadcast and usable hosts

Change the address or the prefix. Network bits are orange, host bits are grey.

Network
192.168.10.64
Broadcast
192.168.10.127
First host
192.168.10.65
Last host
192.168.10.126
Usable hosts
62
Mask
255.255.255.192

The route, part by part

Each part leans on the one before it. Nothing jumps ahead: you meet a vendor CLI only after you understand packets, addresses and services.

  1. 1

    Foundations free 0-21

    Your lab bench, How data moves, IPv4 addressing, Transport and core services

    000-048 49 steps
  2. 2

    Switching and routing

    Network operating systems, Switching, Routing basics, OSPF, EIGRP and redistribution, IPv6, Multicast

    049-128 80 steps
  3. 3

    Internet edge, WAN and service provider

    BGP, WAN, VPN, SD-WAN and QoS, MPLS and segment routing

    129-174 46 steps
  4. 4

    Data center

    Data center fabrics, Servers, load balancers and the network

    175-202 28 steps
  5. 5

    Security

    Lab: Cisco IOL, Linux nftables, FreeRADIUS, Suricata, Batfish

    203-221 19 steps
  6. 6

    Campus and wireless

    Lab: design exercises, packet captures, calculators

    222-233 12 steps
  7. 7

    Cloud networking

    Lab: AWS free tier, Azure, Terraform, kind, Cilium

    234-251 18 steps
  8. 8

    Automation and NetDevOps

    Python for network engineers, Model-driven automation and NetDevOps

    252-281 30 steps
  9. 9

    Operations and observability

    Lab: SNMP, syslog, pmacct, gNMIc, Prometheus, Grafana

    282-299 18 steps
  10. 10

    Senior engineer

    Troubleshooting tickets, War room: real outages, Design and business, Capstone

    300-340 41 steps

What one step looks like

Every step takes 10 to 15 minutes and adds one idea. This is step 62, Trunks and 802.1Q tags.

  1. Goal

    One or two sentences: what you will have built by the end.

  2. Recall

    Two to four links back to the steps this one stands on.

  3. What's new

    The one new idea, every term explained the first time it appears.

  4. Lab

    Three to five tasks on the lab topology, each with the command and the output you should see.

  5. Break it

    You unplug the trunk or mistype a VLAN on purpose and watch what the failure looks like.

  6. Check

    ./check.sh logs into the switches and confirms the result. Green means the step is done.

labs/062_trunks_8021q/topo.clab.yml
name: trunks-8021q
topology:
  nodes:
    sw1:  { kind: cisco_iol, image: vrnetlab/cisco_iol:L2-17.12.01, type: L2 }
    sw2:  { kind: arista_ceos, image: ceos:4.33.1F }
    pc10: { kind: linux, image: wbitt/network-multitool }
    pc20: { kind: linux, image: wbitt/network-multitool }
  links:
    - endpoints: ["sw1:Ethernet0/1", "sw2:eth1"]   # the trunk
    - endpoints: ["sw1:Ethernet0/2", "pc10:eth1"]  # VLAN 10
    - endpoints: ["sw2:eth2", "pc20:eth1"]         # VLAN 20

What runs on your laptop

containerlab starts real network operating systems as containers and wires them together. A typical lab fits in 16 GB of RAM.

  • Linux hosts and FRR

    Blocks A to D, and most routing labs later

    free, public images

  • Cisco IOL and IOL-L2

    Switching, routing, security

    free CML account

  • Arista cEOS

    Switching and data center fabrics

    free arista.com account

  • Juniper cJunos and vJunos

    Junos syntax, BGP, MPLS

    free download, vJunos Labs

  • Nokia SR Linux

    EVPN and gNMI telemetry

    free, public image

  • Fortinet FortiGate

    Firewall policies, NAT and VPN

    free trial VM, FortiCare account

  • Batfish, NetBox, Grafana

    Automation and monitoring blocks

    free, open source

  • AWS and Azure

    Cloud block, built with Terraform

    free tier, destroyed after each step

The course never ships vendor images: their licenses forbid it. The first step of block E walks you through getting each one yourself.

The full syllabus

341 steps in 26 blocks. Steps 0 to 21 are free. Each block ends with a case that puts the whole block to work, and the senior part replays real outages from their published reports.

1 Foundations

A Your lab bench free 000-009 10 steps

Lab: Linux containers only

  1. 000 What a network engineer does all day
  2. 001 The terminal: 12 commands you need first
  3. 002 Files, editors and permissions in Linux
  4. 003 Install Docker and run your first container
  5. 004 Install containerlab
  6. 005 First lab: two hosts and one cable
  7. 006 Read a topology file line by line
  8. 007 Deploy, inspect, destroy, redeploy
  9. 008 Git for your lab files
  10. 009 How every step here is checked
B How data moves free 010-021 12 steps

Lab: Linux hosts, tcpdump, Wireshark

  1. 010 Bits, frames, packets, segments
  2. 011 The TCP/IP model and the OSI model
  3. 012 Encapsulation: one ping, four headers
  4. 013 Capture your first packet with tcpdump
  5. 014 Open a capture in Wireshark
  6. 015 Ethernet frames and MAC addresses
  7. 016 ARP: from IP address to MAC address
  8. 017 Cables, fiber and transceivers
  9. 018 Speed, duplex and autonegotiation
  10. 019 MTU and what happens to a big packet
  11. 020 Bandwidth, latency and jitter, measured
  12. 021 Case: the ping that worked and the page that did not
C IPv4 addressing 022-033 12 steps

Lab: Linux hosts

  1. 022 Binary in 10 minutes
  2. 023 Anatomy of an IPv4 address
  3. 024 Prefix length and subnet mask
  4. 025 Network, broadcast and usable hosts
  5. 026 Subnetting a /24 by hand
  6. 027 Subnetting drills: 20 fast rounds
  7. 028 Private ranges and special addresses
  8. 029 The default gateway
  9. 030 Addresses and routes on a Linux host
  10. 031 VLSM: subnets of different sizes
  11. 032 Route summarization
  12. 033 Case: an address plan for a 60-person office
D Transport and core services 034-048 15 steps

Lab: Linux hosts, dnsmasq, Kea, nftables

  1. 034 Ports and sockets
  2. 035 UDP: send and forget
  3. 036 TCP: the three-way handshake
  4. 037 TCP windows, retransmits and resets
  5. 038 ICMP, ping and traceroute
  6. 039 DNS: how a name becomes an address
  7. 040 DNS records you will touch every week
  8. 041 Run your own DNS server
  9. 042 DHCP: the four messages
  10. 043 Run a DHCP server and a relay
  11. 044 NTP: why clocks matter to networks
  12. 045 NAT and PAT
  13. 046 NAT on Linux with nftables
  14. 047 HTTP and TLS on the wire
  15. 048 Case: a home network, end to end

2 Switching and routing

E Network operating systems 049-058 10 steps

Lab: Cisco IOL, Arista cEOS, Juniper cJunosEvolved, FRR

  1. 049 Get the vendor images legally
  2. 050 Cisco IOS: CLI modes
  3. 051 Cisco IOS: show commands that answer questions
  4. 052 Cisco IOS: change, verify, save
  5. 053 Arista EOS: the same tasks
  6. 054 Junos: set, commit, rollback
  7. 055 FRR: a router inside Linux
  8. 056 One task in four syntaxes
  9. 057 Management access: SSH, users, banners
  10. 058 Backups and config diffs
F Switching 059-077 19 steps

Lab: Cisco IOL-L2, Arista cEOS

  1. 059 How a switch learns MAC addresses
  2. 060 VLANs: one switch, several networks
  3. 061 Access ports
  4. 062 Trunks and 802.1Q tags
  5. 063 The native VLAN and its traps
  6. 064 Routing between VLANs on a router
  7. 065 Routing between VLANs on a layer 3 switch
  8. 066 Why loops kill networks
  9. 067 STP: root bridge election
  10. 068 Rapid STP and port roles
  11. 069 MSTP: one tree per group of VLANs
  12. 070 PortFast and BPDU Guard
  13. 071 Link aggregation with LACP
  14. 072 LLDP and CDP: who is my neighbor
  15. 073 Port security
  16. 074 Private VLANs
  17. 075 DHCP snooping and Dynamic ARP Inspection
  18. 076 Switch stacks and chassis redundancy
  19. 077 Case: find the loop in a broken office
G Routing basics 078-088 11 steps

Lab: Cisco IOL, FRR, Juniper

  1. 078 Read a routing table
  2. 079 Connected routes
  3. 080 Static routes
  4. 081 The default route
  5. 082 Longest prefix match
  6. 083 Administrative distance and metrics
  7. 084 Floating static routes for backup
  8. 085 ECMP: several equal paths
  9. 086 First-hop redundancy: VRRP and HSRP
  10. 087 Policy-based routing
  11. 088 Troubleshoot a route that is missing
H OSPF 089-101 13 steps

Lab: FRR, Cisco IOL, Arista cEOS, Juniper

  1. 089 Why dynamic routing
  2. 090 Link-state routing in one picture
  3. 091 First OSPF neighbors
  4. 092 Neighbor states and why they get stuck
  5. 093 DR and BDR on shared segments
  6. 094 Cost and path choice
  7. 095 Passive interfaces and the default route
  8. 096 Multi-area OSPF
  9. 097 LSA types you actually meet
  10. 098 Summarization and stub areas
  11. 099 OSPF authentication
  12. 100 One OSPF domain across three vendors
  13. 101 Case: OSPF that flaps every 40 seconds
I EIGRP and redistribution 102-110 9 steps

Lab: Cisco IOL, FRR, Arista cEOS

  1. 102 EIGRP: neighbors and the topology table
  2. 103 EIGRP metrics and feasible successors
  3. 104 EIGRP summarization and stub routers
  4. 105 Why one network runs several routing protocols
  5. 106 Redistribute static and connected routes
  6. 107 Redistribution between OSPF and BGP
  7. 108 Route tags: stop redistribution loops
  8. 109 Filter routes at the redistribution point
  9. 110 Case: two merged companies, one routing domain
J IPv6 111-121 11 steps

Lab: FRR, Cisco IOL, Linux

  1. 111 Why IPv6 and why now
  2. 112 Writing and shortening IPv6 addresses
  3. 113 Link-local, global and unique local
  4. 114 Neighbor Discovery replaces ARP
  5. 115 SLAAC and DHCPv6
  6. 116 Static IPv6 routing
  7. 117 OSPFv3
  8. 118 Dual stack on one network
  9. 119 IPv6 first-hop security: RA Guard
  10. 120 NAT64 and DNS64
  11. 121 Case: an IPv6 address plan for a company
K Multicast 122-128 7 steps

Lab: FRR, Cisco IOL, Linux senders and receivers

  1. 122 Multicast: one sender, many receivers
  2. 123 Multicast addresses and MAC mapping
  3. 124 IGMP and IGMP snooping
  4. 125 PIM sparse mode and the rendezvous point
  5. 126 Source-specific multicast
  6. 127 Troubleshoot a stream that does not arrive
  7. 128 Case: a market data feed for a trading floor

3 Internet edge, WAN and service provider

L BGP 129-148 20 steps

Lab: FRR, Arista cEOS, Juniper, Routinator

  1. 129 Autonomous systems and why BGP exists
  2. 130 First eBGP session
  3. 131 Advertise your prefixes
  4. 132 iBGP and next-hop-self
  5. 133 Path attributes
  6. 134 Best path selection, in order
  7. 135 Local preference: choose your exit
  8. 136 AS-path prepending: influence the way in
  9. 137 MED
  10. 138 Communities
  11. 139 Prefix lists, route maps and Junos policies
  12. 140 Multihoming to two providers
  13. 141 Filter what you accept: bogons and max-prefix
  14. 142 RPKI and route origin validation
  15. 143 Route reflectors
  16. 144 BFD: detect failure in milliseconds
  17. 145 Graceful restart and nonstop forwarding
  18. 146 Troubleshoot a BGP session that will not come up
  19. 147 War room: Pakistan Telecom hijacks YouTube (2008) war room
  20. 148 War room: Facebook withdraws itself (2021) war room
M WAN, VPN, SD-WAN and QoS 149-163 15 steps

Lab: FRR, strongSwan, WireGuard, Linux tc, Juniper

  1. 149 WAN options: MPLS, internet, LTE
  2. 150 GRE tunnels
  3. 151 IPsec and IKEv2 concepts
  4. 152 Certificates and PKI for network engineers
  5. 153 Site-to-site IPsec
  6. 154 Route-based VPN with BGP over IPsec
  7. 155 WireGuard
  8. 156 Remote access VPN for employees
  9. 157 Hub-and-spoke and DMVPN
  10. 158 SD-WAN: controllers, overlay, policies
  11. 159 Build a mini SD-WAN: probe paths, steer apps
  12. 160 SASE and SSE
  13. 161 QoS: classify and mark with DSCP
  14. 162 QoS: queues, policing, shaping
  15. 163 Case: voice breaks every afternoon
N MPLS and segment routing 164-174 11 steps

Lab: FRR, Juniper vJunos-router, Nokia SR Linux

  1. 164 IS-IS basics
  2. 165 Label switching
  3. 166 LDP
  4. 167 VRF-lite: several routing tables on one box
  5. 168 MPLS L3VPN with MP-BGP
  6. 169 L2VPN and EVPN for providers
  7. 170 Segment routing with MPLS
  8. 171 TI-LFA fast reroute
  9. 172 SRv6 in one lab
  10. 173 Traffic engineering
  11. 174 Case: a small provider for three customers

4 Data center

O Data center fabrics 175-194 20 steps

Lab: Arista cEOS, Nokia SR Linux, Juniper, FRR

  1. 175 Three-tier and spine-leaf designs
  2. 176 Clos math and oversubscription
  3. 177 MLAG
  4. 178 eBGP underlay
  5. 179 BGP unnumbered
  6. 180 VXLAN: layer 2 over layer 3
  7. 181 EVPN: the control plane for VXLAN
  8. 182 Layer 2 VNI
  9. 183 Layer 3 VNI and symmetric IRB
  10. 184 Anycast gateway
  11. 185 EVPN multihoming with ESI
  12. 186 Tenants and VRFs in the fabric
  13. 187 Border leaf: the fabric meets the WAN
  14. 188 Interconnect two data centers
  15. 189 Lossless Ethernet for storage and AI traffic
  16. 190 PFC and ECN
  17. 191 RoCEv2 on a GPU fabric
  18. 192 Rail-optimized design for AI clusters
  19. 193 Troubleshoot EVPN route by route
  20. 194 Case: build a 2-spine, 4-leaf fabric on two vendors
P Servers, load balancers and the network 195-202 8 steps

Lab: Linux, HAProxy, FRR

  1. 195 Linux bridges, VLAN interfaces and bonds
  2. 196 Network namespaces and veth pairs
  3. 197 Layer 4 and layer 7 load balancing
  4. 198 HAProxy with health checks
  5. 199 Anycast services with BGP
  6. 200 ECMP to servers and hashing
  7. 201 Global server load balancing with DNS
  8. 202 Case: zero-downtime web tier

5 Security

Q Network security 203-221 19 steps

Lab: Cisco IOL, Linux nftables, FreeRADIUS, Suricata, Batfish

  1. 203 A threat model for a network
  2. 204 Standard and extended ACLs
  3. 205 Stateful firewalls
  4. 206 Zones and zone-based policy
  5. 207 What a next-generation firewall adds
  6. 208 FortiGate: first policy and NAT
  7. 209 FortiGate: VPN and security profiles
  8. 210 Review and clean up a firewall rule base
  9. 211 Segmentation and microsegmentation
  10. 212 802.1X and RADIUS
  11. 213 802.1X with certificates: EAP-TLS
  12. 214 TACACS+ for device logins
  13. 215 Protect the control plane: CoPP
  14. 216 uRPF and anti-spoofing
  15. 217 DDoS basics: RTBH and Flowspec
  16. 218 Intrusion detection with Suricata
  17. 219 Zero trust and ZTNA
  18. 220 Audit configs with Batfish
  19. 221 Case: harden a branch office

6 Campus and wireless

R Campus, wireless and the physical world 222-233 12 steps

Lab: design exercises, packet captures, calculators

  1. 222 Structured cabling and the wiring closet
  2. 223 PoE and the power budget
  3. 224 Campus design: access, distribution, core
  4. 225 Radio basics for Wi-Fi
  5. 226 802.11 standards from Wi-Fi 4 to Wi-Fi 7
  6. 227 Channels, interference and channel plans
  7. 228 Controllers and cloud-managed Wi-Fi
  8. 229 WPA3 and enterprise Wi-Fi with 802.1X
  9. 230 Roaming
  10. 231 Site surveys and heatmaps
  11. 232 Troubleshoot slow Wi-Fi from a capture
  12. 233 Case: Wi-Fi for a 3-floor office

7 Cloud networking

S Cloud networking 234-251 18 steps

Lab: AWS free tier, Azure, Terraform, kind, Cilium

  1. 234 How cloud networks differ from yours
  2. 235 AWS VPC, subnets and route tables
  3. 236 Internet and NAT gateways
  4. 237 Security groups and network ACLs
  5. 238 VPC peering
  6. 239 Transit Gateway
  7. 240 Site-to-site VPN from your lab to AWS with BGP
  8. 241 Direct Connect and private links
  9. 242 PrivateLink and endpoints
  10. 243 Hybrid DNS with Route 53 Resolver
  11. 244 Azure VNet and Virtual WAN
  12. 245 Google Cloud VPC
  13. 246 What egress costs and how to cut it
  14. 247 The whole network in Terraform
  15. 248 Kubernetes networking: pods, services, CNI
  16. 249 Cilium and eBPF
  17. 250 Ingress and gateway API
  18. 251 Case: connect an office, a data center and two clouds

8 Automation and NetDevOps

T Python for network engineers 252-263 12 steps

Lab: Python 3, Netmiko, NAPALM, Nornir, Jinja2

  1. 252 Python setup and your first script
  2. 253 Variables, lists and dictionaries
  3. 254 Loops and conditions over devices
  4. 255 Functions and modules
  5. 256 Files, JSON and YAML
  6. 257 The ipaddress module
  7. 258 SSH to a device with Netmiko
  8. 259 Parse show output with TextFSM
  9. 260 Templates with Jinja2
  10. 261 NAPALM: one API, many vendors
  11. 262 Nornir: run tasks on 50 devices at once
  12. 263 Case: a backup and diff tool for the whole lab
U Model-driven automation and NetDevOps 264-281 18 steps

Lab: NETCONF, RESTCONF, gNMI, Ansible, NetBox, GitHub Actions

  1. 264 YANG models
  2. 265 NETCONF with ncclient
  3. 266 RESTCONF
  4. 267 gNMI and OpenConfig
  5. 268 Ansible for network devices
  6. 269 Ansible roles and inventories
  7. 270 NetBox as the source of truth
  8. 271 Generate configs from NetBox
  9. 272 Standards and golden configs
  10. 273 Network changes through Git and pull requests
  11. 274 CI for configs: lint, Batfish, lab test
  12. 275 Pre- and post-change tests with pyATS
  13. 276 Detect config drift
  14. 277 Terraform for network devices
  15. 278 Controller APIs: Meraki and Catalyst Center
  16. 279 Event-driven automation
  17. 280 AI assistants in network operations, with guardrails
  18. 281 Case: a full CI/CD pipeline for the fabric

9 Operations and observability

V Monitoring and operations 282-299 18 steps

Lab: SNMP, syslog, pmacct, gNMIc, Prometheus, Grafana

  1. 282 SNMP v2c and v3
  2. 283 Syslog that you can search
  3. 284 NetFlow, IPFIX and sFlow
  4. 285 Streaming telemetry into Prometheus
  5. 286 Grafana dashboards for a network
  6. 287 Alerts that wake you for real problems
  7. 288 Synthetic monitoring
  8. 289 A troubleshooting method that works
  9. 290 MTU black holes and path MTU discovery
  10. 291 Slow transfers: TCP on long links
  11. 292 Bufferbloat
  12. 293 Changes, maintenance windows and rollback plans
  13. 294 Upgrade a router without downtime
  14. 295 Run a major incident as incident commander
  15. 296 Capacity planning
  16. 297 Network documentation and diagrams
  17. 298 SLOs for a network
  18. 299 Case: an on-call night, three incidents

10 Senior engineer

W Troubleshooting tickets 300-312 13 steps

Lab: broken labs, one fault each, no hint which block it belongs to

  1. 300 How to work a ticket: scope, evidence, fix, note
  2. 301 Ticket: a new VLAN cannot reach the internet
  3. 302 Ticket: one branch is slow only on video calls
  4. 303 Ticket: OSPF neighbors are up, routes are missing
  5. 304 Ticket: a BGP session flaps every 3 minutes
  6. 305 Ticket: the VPN is up, no traffic passes
  7. 306 Ticket: DHCP works on one floor only
  8. 307 Ticket: an EVPN host answers from one leaf only
  9. 308 Ticket: file transfers stall halfway
  10. 309 Ticket: a duplicate IP after a change
  11. 310 Ticket: the cloud cannot resolve office names
  12. 311 Ticket: monitoring is green, users say it is broken
  13. 312 Shift: 10 mixed tickets against the clock
X War room: real outages 313-319 7 steps

Lab: outages reproduced in containerlab

  1. 313 How to read a post-incident report
  2. 314 War room: AS7007 leaks the internet (1997) war room
  3. 315 War room: a route leak through a small ISP (2019) war room
  4. 316 War room: a backbone config change takes a CDN down (2020) war room
  5. 317 War room: a national carrier goes dark (Rogers, 2022) war room
  6. 318 War room: a cloud region's internal network congests (2021) war room
  7. 319 Write your own post-incident report
Y Design and business 320-331 12 steps

Lab: design documents, cost models

  1. 320 Inherit an undocumented network: discovery
  2. 321 Clean up a brownfield network without outages
  3. 322 Gather requirements from people who are not engineers
  4. 323 Write a network design document
  5. 324 Choose a vendor with a decision matrix
  6. 325 Total cost of ownership
  7. 326 Find what to automate and count the hours saved
  8. 327 Propose an optimization to management
  9. 328 Plan a migration with no downtime
  10. 329 Lead a change review
  11. 330 The network design interview
  12. 331 The troubleshooting interview
Z Capstone 332-340 9 steps

Lab: everything above, in one lab

  1. 332 Capstone brief: a company with HQ, 3 branches, a DC and AWS
  2. 333 Capstone: addressing, sites and the WAN
  3. 334 Capstone: data center fabric
  4. 335 Capstone: internet edge and cloud
  5. 336 Capstone: security
  6. 337 Capstone: automation and CI
  7. 338 Capstone: monitoring and runbooks
  8. 339 Capstone: break it and fix it
  9. 340 Capstone: the design review

How it maps to certifications

The course teaches the job and does not drill exam questions. These blocks cover the objectives of each exam.

ABCDEFGHIJKLMNOPQRSTUVWXYZ
CCNA (200-301) How data moves IPv4 addressing Transport and core services Network operating systems Switching Routing basics OSPF IPv6 Network security Campus, wireless and the physical world Python for network engineers
CCNP ENCOR (350-401) Switching Routing basics OSPF EIGRP and redistribution IPv6 Multicast BGP WAN, VPN, SD-WAN and QoS Network security Campus, wireless and the physical world Model-driven automation and NetDevOps Monitoring and operations
JNCIA-Junos (JN0-105) IPv4 addressing Network operating systems Routing basics OSPF BGP
AWS Advanced Networking Specialty BGP WAN, VPN, SD-WAN and QoS Cloud networking

Questions

I have never worked in IT. Can I start?

Yes. Block A starts with the terminal and Docker. You meet the first router in block E, after 49 steps on packets, addresses and services.

What computer do I need?

16 GB of RAM and an x86 machine: Linux, or Windows with WSL2. Most vendor images do not run on Apple Silicon Macs, so block A shows how to rent a cloud VM by the hour instead.

Do I have to buy Cisco or Juniper licenses?

No. Cisco IOL comes with a free CML account, Arista cEOS with a free arista.com account, and Juniper offers vJunos for free download. Linux, FRR and SR Linux are open.

How long does the course take?

Each step takes 10 to 15 minutes, so the whole course takes 57 to 85 hours. At 3 steps a day that is about 4 months.

Will it get me through CCNA?

It covers the CCNA topics shown in the map above, through labs. It has no practice exams, so add a question bank in the last 2 weeks before a test.

How do you teach Wi-Fi without radios?

Wi-Fi cannot be emulated in containerlab. The Wi-Fi block uses real packet captures, channel plans and a design task for a 3-floor office.

Get the first blocks when they open

Leave your email. You will hear from us once, when steps 0 to 21 are ready.

Start learning soon