AP Networking Unit 3 Review: Managing Many Connections

What's This Unit All About?

• Networks in the real world rarely consist of a single flat group of devices; they are deliberately divided into segments so that performance, security, and management all improve.
• The focus here is on designing, building, securing, documenting, and repairing a segmented local area network (LAN) that serves many kinds of users and devices.
• Device selection comes first: matching endpoints (laptops, tablets, smartphones, desktops, gaming consoles, servers) to user roles, performance demands, and mobility needs.
• Segmentation is explored through three lenses: physical separation using dedicated hardware, logical separation using VLANs and subnets, and wireless separation using multiple SSIDs.
• IP addressing, subnet masks, and CIDR notation form the mathematical backbone, letting a technician decide whether two devices share a network or need a router to communicate.
• Security is treated as a design requirement, not an afterthought: wireless encryption, MAC filtering, firewall ACLs, guest network isolation, and least-privilege access controls all work together to block unauthorized access and lateral movement.
• Troubleshooting ties everything together, pairing documentation habits with diagnostic tools (ping, signal analyzers, power analyzers) to isolate root causes such as DHCP exhaustion, APIPA addresses, misconfigured gateways, firewall rule ordering, EMI, or unstable power.
• AI-generated network designs are treated critically: useful for brainstorming topologies and spotting gaps, but always requiring human verification against real requirements.
• Together, these skills prepare students to plan a small office or school LAN end to end, from choosing a laptop model to writing an ACL rule to fixing a flaky wireless segment.

Key Concepts and Terms

• Segmentation: Dividing a network into smaller groups of devices to improve performance, manageability, and security. Can be physical (separate hardware) or logical (VLANs, subnets).
• VLAN (Virtual LAN): A logical grouping of devices on a shared physical switch that keeps their traffic isolated from other VLANs without needing extra hardware.
• Subnet mask: A 32-bit value of leading 1s followed by 0s that marks which bits of an IPv4 address are network bits and which are host bits.
• CIDR notation: A shorthand like /24 that gives the count of 1 bits in a subnet mask (for example, /24 equals 255.255.255.0).
• Default gateway: The router interface a device sends traffic to when the destination lies outside its own network segment.
• Routing table: A list inside a router that maps destination networks to the interfaces or next hops used to reach them.
• SSID (Service Set Identifier): The name advertised by a wireless network that clients use to join it.
• WPA2 / WPA3: Current wireless encryption standards that protect data in transit; WEP is the outdated, insecure predecessor.
• DHCP (Dynamic Host Configuration Protocol): A service that hands out IP addresses, subnet masks, and gateway information automatically from a pool.
• APIPA address: A self-assigned address (169.254.x.x range) a device falls back to when DHCP fails; these addresses cannot communicate beyond the local link.
• ACL (Access Control List): An ordered list of firewall rules that permit or deny traffic based on direction, IP, port, service, or application; evaluated top-down with the first match executed.
• MAC filtering: A control that permits only approved MAC addresses on a switch port, blocking unknown devices and helping prevent MAC flooding attacks.
• MAC flooding: An attack that overflows a switch's CAM table with fake MAC addresses, potentially forcing the switch into a fail-open broadcast state.
• Star topology: A layout where every node connects to a central switch; easy to expand and troubleshoot but the switch is a single point of failure.
• Mesh topology: A layout where every node links directly to every other node, offering high fault tolerance at the cost of cabling and complexity.
• Principle of least privilege: Granting users and devices only the minimum access required to perform their work.
• ping: A command that sends ICMP packets to a target IP to verify reachability and basic connectivity.
• Captive portal: A sign-in page a guest network can require before granting internet access, often used to display terms of use.

Choosing Endpoints and Topologies

• Endpoint selection follows the user's role and performance demand, not a one-size-fits-all rule.
  • Laptops for workers juggling many browser tabs, documents, and applications.
  • Tablets and smartphones for mobile dashboards, inventory scans, or field forms.
  • Desktops or high-performance laptops with wired Ethernet for admin workstations and local servers.
  • Gaming consoles or high-spec desktops for esports, video editing, and large-data analysis where low latency and high frame rates matter.
• Most real networks mix several device types rather than standardizing on one.
• Wired topology choice balances reliability, cost, and maintainability.
  • Star: cheap, simple, central switch is the weak point.
  • Mesh: high fault tolerance through redundant paths, but expensive and cable-heavy.
  • Hybrid: common in large LANs, combining star simplicity with mesh resilience where it counts.
  • Bus and ring layouts are generally avoided in modern designs.

Addressing, Subnetting, and How Traffic Moves

• An IPv4 address is 32 bits written as four dotted-decimal octets (0 to 255 each), split by the subnet mask into network bits and host bits.
  • /24 corresponds to 255.255.255.0, leaving 8 host bits and 254 usable addresses.
  • /26 corresponds to 255.255.255.192, leaving 6 host bits and 62 usable addresses.
• Two devices share a network only when their network portions match under the same mask.
  • 192.168.1.10 and 192.168.1.20 under /24 share a network.
  • 192.168.2.30 under /24 does not.
• When the destination is on the same segment, a switch delivers the frame directly to the destination MAC.
• When the destination is on a different segment, the host sends the packet to the default gateway, which consults its routing table and forwards it toward the correct network.
• Subnetting carves one network into smaller pieces by reassigning host bits as network bits.
  • Usable hosts per subnet equal 2^n minus 2, where n is the number of host bits.
  • A subnet of 27 hosts needs at least 32 addresses, so 5 host bits.
  • The first address is the network ID and the last is the broadcast address; neither can be assigned to a device.
• Subnets map cleanly onto VLANs or segments and should use nonoverlapping address ranges.

Building and Securing a Segmented LAN

• Physical LAN setup requires planning first, then cabling, connectors (such as RJ45), crimpers, labeling tools, and PPE.
• Switches are configured via CLI through a console cable or through a GUI management console, setting password, IP address, and subnet mask.
• Routers must be given an IP and subnet mask to serve as the default gateway for their segment.
• Wireless access points need an SSID, IP address, subnet mask, and security settings (WPA2 or WPA3, WPS disabled).
• Endpoints receive IP configuration either statically or through DHCP, and connectivity is verified with ping.
• Segmentation strategies are chosen by sensitivity, access needs, and traffic patterns.
  • User workstations, internal services, IoT devices, and guest access each belong in separate segments.
  • Physical segmentation for maximum isolation (restricted labs, sensitive departments).
  • VLANs for flexible separation on shared switch hardware.
  • Subnetting for firewalling IP groups and controlling broadcast scope.
  • Multiple SSIDs to split wireless users (for example, staff vs. guests), often mapped to distinct VLANs.
• Guest wireless networks should be built after the internal network is confirmed working, with their own SSID, strong password, WPA2/WPA3 encryption, optional device limits, time restrictions, blocked access to internal resources, and a captive portal.
• AI tools can suggest topologies and segment layouts, but prompts must specify traffic flow, security policies, redundancy, and physical constraints, and every output must be reviewed before deployment.

Threats, Controls, and Firewall Rules

• Common impacts on a segmented LAN include unauthorized access, rogue device connections, and data exposure, all of which threaten confidentiality, integrity, and availability.
• Weak wireless security (simple passwords, WEP, no encryption) opens sensitive resources to outsiders.
• Misconfigured firewall rules enable lateral movement from one compromised segment to others.
• Controls apply the principle of least privilege.
  • Isolated guest wireless kept off the internal network.
  • Distinct IP ranges or DHCP pools per device group.
  • MAC address filtering to allow only approved devices on a port.
  • Disabling unused switch ports.
  • DHCP reservations for known devices.
  • Deny-by-default firewall policies between subnets, permitting only essential cross-segment services (for example, a shared print service).
• MAC filtering also defends against MAC flooding, which can overflow a switch's CAM table and push it into fail-open broadcast mode.
• Firewall ACLs are ordered lists evaluated top-down; only the first matching rule fires.
  • Each entry specifies direction (inbound/outbound), criterion (IP, port, service, application), and action (permit/deny).
  • Permit HTTPS (443), DNS (53), SSH (22), SFTP (22) as needed.
  • Block or avoid HTTP (80), Telnet (23), FTP (21) because they transmit without encryption.
  • Specific rules must come before broad deny rules, or legitimate traffic gets blocked (for example, swapping an SSH-allow and a deny-all reverses the intent).
• After configuration, administrators verify with ping that intended access works and unauthorized access is blocked.

Documentation and Troubleshooting

• Good network documentation is complete, clear, distributed to all users, and updated with every change.
  • Visual topology diagrams label devices, show wired and wireless links, and depict both physical and logical segmentation.
  • IP addressing schemes are recorded, with static assignments flagged.
  • Segments with special firewall rules or access controls are noted so the right security is applied.
• Troubleshooting begins with standard remedies: reboot the AP, switch, or router; reboot affected devices; disconnect and reconnect; verify SSID and password.
• Diagnostic clues point to specific root causes.
  • APIPA address indicates DHCP server failure or exhausted pool.
  • Missing or wrong subnet mask or gateway blocks network access; check configuration against documented settings.
  • ping failures to internal or external targets suggest firewall or ACL issues.
  • Signal below 70 dBm suggests the AP is too far or obstructed; heavy noise suggests EMI from Bluetooth, microwaves, or similar sources.
  • Power irregularities (under 110V or over 125V in a 120V system, dropouts under 5 seconds) can reboot devices and corrupt routing tables or DHCP leases.
• Fixes are matched to the diagnosed cause.
  • Reboot the DHCP server, widen its pool, or shorten lease times.
  • Correct gateway and mask settings, or fix DHCP scope options.
  • Reorder ACLs so allow rules precede broad denies, and audit deny rules for unintended blocks.
  • Reposition the access point, remove obstructions, or move it away from EMI sources.
  • Swap circuits or install a UPS for power problems.
• Verification closes the loop: confirm devices maintain a stable connection and can reach the internal and external resources they need.