Cisco 200-301: Ethernet Switching and Layer 2 Forwarding — Study Guide

By Laurynas Brazys · 14 August 2026 · #cisco #200-301 #certification #exam-prep #study-guide

Part of the Cisco CCNA 200-301 — Study Guide. Practice with verified answers in the Cisco exam hub, or take timed practice tests on ExamRoll.io.

Overview

Ethernet switches forward Layer 2 frames within a broadcast domain by learning and consulting a MAC address table (also called the CAM table). Switches make per-frame decisions based on destination MAC, VLAN, and the state of the egress interface. Correct behavior relies on accurate MAC learning, stable link parameters, and protections against loops and Layer 2 abuse. This section explains operational logic, design trade-offs, failure modes, and verification methods relevant to production switching.

MAC Learning, Forwarding, Filtering, and Flooding

Switches learn source MAC addresses by inspecting the source MAC and VLAN on ingress and associating that tuple with the receiving interface. Entries are dynamic by default and age out after an idle timer (commonly 300 seconds on Cisco campus switches). Aging removes unused entries, freeing space and helping mobility; too-short timers increase unknown-unicast flooding, while too-long timers risk stale forwarding and larger tables.

Forwarding logic per frame:

• Unicast with known destination MAC in VLAN: forward out the single associated port (unless that port is the same as ingress, in which case the switch filters/drops to prevent reflection).
• Unicast with unknown destination MAC in VLAN: flood out all other active ports in that VLAN (unknown-unicast flooding).
• Broadcast (ff:ff:ff:ff:ff:ff): flood to all other ports in the VLAN. Broadcasts are necessary for protocols like ARP and some discovery protocols.
• Multicast: without snooping, many switches treat multicast like broadcast and flood within the VLAN. With IGMP snooping (IPv4) or MLD snooping (IPv6), switches constrain multicast to ports with interested receivers, reducing unnecessary traffic.

Static MAC entries can be configured for deterministic forwarding or to pin devices in high-security contexts. Overuse of static entries complicates operations; prefer dynamic learning with controls.

Common failure modes:

• MAC flapping: the same MAC appears on multiple interfaces in quick succession, often from loops or asymmetric paths. Symptoms include log messages and incessant CAM updates.
• CAM exhaustion: table fills due to scale or attack, causing elevated unknown-unicast flooding and potential data leakage across access ports.

Useful commands:

• show mac address-table dynamic
• show mac address-table count
• show mac address-table aging-time
• clear mac address-table dynamic
• mac address-table static MAC vlan VLAN interface INTERFACE

Access Ports, Operational States, and Port Security

Access ports carry a single VLAN and connect to endpoints. Configure them explicitly to remove ambiguity and reduce trunk-related risk.

Examples: interface range gigabitEthernet1/0/1-24 switchport mode access switchport access vlan 10 spanning-tree portfast spanning-tree bpduguard enable

Operational link states reported by the switch:

• connected/up: link and line protocol up; frames will forward if not administratively blocked.
• notconnect/down: no physical link detected.
• administratively down: shutdown configured.
• err-disabled: interface disabled by protection features (such as port security violations, loop detection, or storm control actions).

Port security limits how many MAC addresses can appear on an access port and what to do on violation. This mitigates MAC-flooding, unauthorized hubs, and casual device moves.

Example with sticky learning: interface gigabitEthernet1/0/10 switchport mode access switchport access vlan 10 switchport port-security switchport port-security maximum 2 switchport port-security mac-address sticky switchport port-security violation restrict

Sticky MACs learned become secure MAC entries written to the running configuration; save the configuration to persist across reloads. You can also configure static secure MACs.

Violation modes:

• protect: drop frames with unknown/violating MACs silently. No SNMP trap or syslog; least disruptive, least visible.
• restrict: drop violating frames, increment violation counter, and generate syslog/SNMP trap; preferred for visibility without link drop.
• shutdown (default): place the port into err-disabled, requiring manual shutdown/no shutdown or timed auto-recovery.

Recovery and visibility:

• show port-security interface INTERFACE
• clear port-security sticky interface INTERFACE
• errdisable recovery cause psecure-violation
• errdisable recovery interval 300

Trade-offs: protect/restrict maintain link but may mask issues; shutdown is noisy but unmistakably enforces policy and stops all traffic from the compromised segment.

Forwarding Decisions, Counters, Duplex/Speed, and Troubleshooting

Forwarding correctness begins with accurate learning. When traffic is not delivered, verify whether the destination MAC actually exists in the table, matches the correct port and VLAN, and that the ingress and egress ports are operational.

Core troubleshooting steps:

• Confirm VLAN membership and port mode: show interfaces switchport
• Check MAC learning: show mac address-table dynamic address H.H.H
• Look for MAC flapping events in the log: show logging
• Verify interface state and errors: show interfaces INTERFACE
• Validate CDP/LLDP neighbors and cabling: show cdp neighbors detail, show lldp neighbors detail

Interface counters and what they indicate:

• input errors: aggregate of receive-side issues, including CRC, runts, giants. When a frame fails FCS, both input errors and CRC counters increase.
• CRC: frames received with FCS errors; commonly cabling issues, electrical interference, or duplex mismatch.
• runts: frames smaller than 64 bytes, often collision-related on half-duplex.
• giants: frames larger than the MTU without truncation; may be tagging or misconfigured MTU.
• late collisions: collisions detected after the first 64 bytes; typically occur due to half-duplex links or excessive cable length beyond Ethernet standards.
• output errors: transmit failures; could be congestion or hardware issues.

Duplex and speed negotiation:

• Autonegotiation is required for 1000BASE-T and faster copper links; forcing speeds on one side and auto on the other can cause duplex mismatch (one end full, the other half). Symptoms include CRC errors, late collisions, and poor throughput.
• Best practice is auto speed and auto duplex end-to-end on modern switches, with Auto-MDIX enabled, unless connected to legacy or non-negotiating devices where forced, matching settings are necessary.
• Verify with show interfaces status and show interfaces INTERFACE | include Duplex|Speed.

CDP and LLDP neighbor discovery help identify what is connected, the remote port, VLANs, and sometimes IP addressing. Use them during turn-up and troubleshooting, and disable where security policy forbids device discovery leakage.

Examples:

• Enable/disable globally: no cdp run lldp run
• At interface: no cdp enable lldp transmit lldp receive
• Verification: show cdp neighbors detail show lldp neighbors detail

Layer 2 Attack Awareness, Storm Control, and Loop Symptoms

Basic Layer 2 threats and mitigations:

• MAC address flooding (CAM overflow): attacker sends frames with many spoofed source MACs to exhaust the table, causing unknown-unicast flooding and possible sniffing. Mitigate with port security (limit MAC count, sticky/static), disable unused ports, and monitor CAM utilization.
• Gratuitous discovery leakage: CDP/LLDP can reveal platform and VLANs; disable on untrusted access ports.
• Rogue switches or loops: connecting unmanaged switches can form loops, producing broadcast storms and MAC flapping. Use PortFast, BPDU Guard, and loop detection tools.

Storm control limits broadcast, multicast, and unknown-unicast rates to cap storms while preserving normal traffic.

Example: interface gigabitEthernet1/0/20 storm-control broadcast level 1.00 0.50 storm-control multicast level 1.00 0.50 storm-control action shutdown

Levels are expressed as a percentage of link bandwidth or in pps, depending on platform. Configure a recovery plan if using shutdown as the action:

• show storm-control
• errdisable recovery cause storm-control
• errdisable recovery interval 300

Loop symptoms and indicators:

• Sudden, sustained spike in broadcast, multicast, and unknown-unicast counters on many ports.
• CPU utilization on switches rises sharply; control plane instability.
• MAC flapping logs showing the same MAC moving rapidly between ports.
• ARP timeouts and intermittent application failures across the VLAN.

Prevent loops with a resilient design (no unmanaged L2 interconnections), spanning tree features (PortFast on access, BPDU Guard to shut down ports receiving BPDUs), and technologies like UDLD on fiber to detect unidirectional failures. Verification commands:

• show spanning-tree vlan X
• show spanning-tree interface INTERFACE detail
• show processes cpu sorted

Switch Verification and Troubleshooting Commands

Operational visibility is critical for Layer 2 health. Commonly used commands:

• Interface and counters: show interfaces, show interfaces counters errors, show interfaces status
• MAC table: show mac address-table [dynamic|static], clear mac address-table dynamic
• VLAN and port mode: show vlan brief, show interfaces switchport
• Port security: show port-security, show port-security interface INTERFACE, show errdisable recovery
• Discovery: show cdp neighbors detail, show lldp neighbors detail
• Traffic storms and loops: show storm-control, show spanning-tree, show logging
• System health: show processes cpu history, show platform hardware capacity (model-dependent)

When a frame forwarding issue is suspected, reproduce the traffic and observe counters in real time with terminal monitor and successive show commands to pinpoint the fault domain (endpoint, cable, interface, VLAN, switch fabric).

Practical Problem Scenario

Contoso Health Labs experiences intermittent voice call drops and poor desktop performance on VLAN 20 after adding several IP phones and small unmanaged switches in cubicle areas.

Approach:

1. Baseline and isolate the impact.

• Rationale: Use show interfaces counters errors and show processes cpu sorted to detect whether the problem is localized or systemic. High CPU and rising broadcast/unknown-unicast counters across many ports suggest a Layer 2 storm or loop.

2. Validate duplex/speed and cabling.

• Rationale: On key access ports, run show interfaces status and show interfaces INTERFACE to confirm a-full and matching speeds. Late collisions and CRC spikes indicate duplex mismatch or cable issues; correct by setting both ends to auto or matching forced values, and replace suspect cables.

3. Identify and contain loops.

• Rationale: Check logs for MAC flapping. Enable PortFast and BPDU Guard on all access ports to automatically err-disable ports that receive BPDUs from rogue or unmanaged switches. This halts loops formed by daisy-chained mini-switches. Configuration: interface range g1/0/1-48 spanning-tree portfast spanning-tree bpduguard enable

4. Implement storm control on access ports.

• Rationale: Limit broadcast, multicast, and unknown-unicast to keep storms from overwhelming the VLAN and CPU, preserving VoIP traffic during faults. Configuration: interface range g1/0/1-48 storm-control broadcast level 0.50 0.25 storm-control multicast level 0.50 0.25 storm-control action shutdown errdisable recovery cause storm-control errdisable recovery interval 300

5. Enforce port security with sticky MACs on user-facing ports.

• Rationale: Prevent MAC flooding and unauthorized hubs by limiting MAC count per port to the phone plus one PC. Use restrict to keep links up while logging violations. Configuration: interface range g1/0/1-48 switchport mode access switchport access vlan 20 switchport port-security switchport port-security maximum 2 switchport port-security mac-address sticky switchport port-security violation restrict

6. Constrain multicast flooding with IGMP snooping.

• Rationale: If IP phones use multicast services, enable IGMP snooping and ensure a querier exists to build accurate multicast forwarding states, reducing unnecessary flooding on VLAN 20.

7. Verify neighbor topology and clean up discovery exposure.

• Rationale: Use show cdp neighbors detail and show lldp neighbors detail to validate switch-to-phone-to-PC wiring order. Disable CDP/LLDP on ports where policy disallows information leakage to unmanaged devices.

8. Monitor and validate stability.

• Rationale: After changes, track error counters, storm-control statistics, and CAM stability with show mac address-table count. Ensure no recurring err-disable events and confirm call quality via user feedback and QoS metrics. This closes the loop between configuration and measurable service quality.

← Network Fundamentals and Physical Infrastructure · All domains · VLANs →

Practice these questions → · Timed practice on ExamRoll.io →