Legacy Haven University

Switches, routers, and firewalls keep local traffic moving, move packets between networks, and block traffic that policy rejects. CompTIA A+ Core 1 (220-1201) objective 2.5 asks you to compare these devices by the problem each one solves, the address it reads, and the OSI layer where it makes its decision.

A technician who can name the box on a rack still fails scenario questions. The exam rewards the person who can follow a frame from a NIC, through a switch fabric, to a default gateway, and then through a firewall rule. That path is the architecture of almost every small office/home office (SOHO) network and every enterprise access layer.

How Traffic Crosses a Network

A host does not send “data” as a single blob. The operating system wraps application data in headers as the payload moves down the stack.

• Layer 4 adds a TCP or UDP header with source and destination ports.
• Layer 3 adds an IP header with source and destination IP addresses. That unit is a packet.
• Layer 2 adds an Ethernet header and trailer with source and destination MAC addresses. That unit is a frame.
• Layer 1 puts bits on copper, fiber, or radio.

A MAC address is a 48-bit hardware identifier burned into (or assigned to) a network interface card (NIC). CompTIA lists the physical MAC address under the NIC bullet in 2.5 because every switch decision starts there. An IP address is a logical identifier that belongs to a network, not to a wall jack. Switches read MACs. Routers read IPs. Firewalls read IPs, ports, protocol flags, and, on many appliances, application patterns.

Think of the LAN as a building and the internet as the street grid. The switch is the hallway system inside one building. The router is the door that opens onto a different street. The firewall is the guard at that door.

Switches: Forward Frames Inside One Network

A switch connects devices on the same local area network (LAN) and forwards Ethernet frames to the port that owns the destination MAC address. It operates at OSI Layer 2, the data link layer.

MAC Learning and the CAM Table

When a frame enters a switch port, the switch records the source MAC address and the ingress port in its MAC address table (also called a CAM table). The next time a frame targets that MAC, the switch sends it only out the matching port.

If the destination MAC is unknown, the switch floods the frame out every port in that VLAN except the port that received it. Flooding is not a design goal. It is the switch’s fallback while it learns. After the destination host replies, the switch stores that MAC and stops flooding for that address.

A hub copies every bit to every port. A switch does not. That single change cuts collisions, raises available bandwidth, and keeps most traffic off ports that do not need it. A+ still uses that contrast when a question asks why a modern LAN uses a switch instead of a shared medium.

Unmanaged vs. Managed Switches

Objective 2.5 splits switches into two exam categories.

An unmanaged switch ships with no configuration interface. Plug in power and Ethernet. It learns MAC addresses, forwards frames, and offers no VLANs, no port security, and no remote management. Home desks, a small printer closet, and a temporary lab often use unmanaged hardware because it needs zero setup.

A managed switch exposes a console, web GUI, or SSH session. An administrator assigns VLANs, sets speed and duplex, enables port security, collects SNMP data, and inspects the MAC table. Enterprise access layers use managed switches because they must segment traffic and prove what a port is doing.

VLAN (virtual LAN) configuration lives in objective 2.4, but it is the main reason managed switches exist. A VLAN groups switch ports into separate Layer 2 broadcast domains even when those ports sit in the same chassis. Sales and finance can share one switch and still cannot see each other’s broadcasts. Traffic between VLANs must leave Layer 2 and hit a router or a Layer 3 switch.

What a Switch Does Not Do

A basic Layer 2 switch does not read IP addresses to choose a path between networks. It does not NAT. It does not replace a firewall. Some hardware called a “Layer 3 switch” can route between VLANs, but A+ treats the default switch as a MAC-based LAN device. On the exam, “needs to talk to another subnet” points to a router, not to an unmanaged switch.

Port flapping, a dead link light, and one user who loses LAN access while everyone else stays online all point at switch ports, cables, or the NIC—not at the internet circuit. Domain 5 network troubleshooting uses those symptoms.

Routers: Move Packets Between Networks

A router connects two or more networks and forwards IP packets toward the destination network. It operates at OSI Layer 3, the network layer.

Each router interface belongs to a different IP network. One interface might sit on 192.168.1.0/24. Another might sit on a WAN subnet that the internet service provider assigns. Hosts on the LAN list the router’s LAN IP as their default gateway. Any packet whose destination is not local goes to that gateway first.

The Routing Table

The router strips the incoming Ethernet header, reads the destination IP, and searches its routing table for the longest matching prefix. A match names the next-hop IP and the outbound interface. The router then builds a new Layer 2 header for the next hop and sends the packet out.

The routing table holds:

• Directly connected networks (interfaces that are up)
• Static routes an administrator typed
• Dynamic routes learned from a routing protocol on larger networks
• A default route (0.0.0.0/0) that sends unknown destinations toward the ISP

Remove the default route and local file shares still work. Websites fail. That split—LAN alive, internet dead—is the classic router or gateway symptom.

SOHO Routers Combine Jobs

A consumer “Wi-Fi router” is several devices in one chassis: a router, a small switch, a wireless access point, a DHCP server, NAT, and often a basic firewall. CompTIA still wants the functions separated in your head.

• The switch ports forward local frames by MAC.
• The WAN port and routing engine move packets to other networks.
• Network Address Translation (NAT) rewrites private inside addresses to the public WAN address so many hosts share one ISP IP.
• The built-in firewall applies allow/deny rules on traffic that crosses the boundary.

Enterprise designs split those jobs. A dedicated router or Layer 3 switch handles routing. A dedicated firewall sits at the perimeter. Access points hang off PoE switch ports. The exam uses that clean split when a scenario names “the device that connects the LAN to the internet” versus “the device that segments the office floor.”

What a Router Does Not Do

A router is a poor LAN switch. Sending every workstation through a router for local traffic adds delay and burns CPU. Hosts on the same subnet should stay on the switch. The router only needs the traffic that must leave the subnet.

Firewalls: Enforce Policy on Traffic

A firewall inspects traffic and allows or denies it according to a rule set. Hardware firewalls are appliances with their own interfaces, CPU, and rule engine. Software firewalls run on a host operating system. SOHO routers include a software firewall. Objective 2.5 lists firewall as a networking hardware device, so the exam focuses on the appliance that sits in the packet path.

Packet Filters and Stateful Inspection

A basic packet-filtering firewall reads Layer 3 and Layer 4 fields: source IP, destination IP, protocol (TCP, UDP, ICMP), and port numbers. An access control list (ACL) lists those matches and an action—permit or deny. The firewall applies the first matching rule and stops.

Stateful inspection tracks conversations. When an inside host starts a TCP session to a web server on port 443, the firewall records that handshake. Return packets that belong to the same session pass. Unsolicited inbound SYNs to random high ports die at the policy. That state table is why a home firewall can allow outbound browsing without opening inbound ports for every reply.

Next-generation firewalls also inspect application payloads, block known threat signatures, and enforce user identity. A+ does not require vendor feature matrices. It does require this idea: a firewall decides whether traffic may pass; a router decides where allowed traffic goes.

Placement and Implicit Deny

Place a network firewall at a trust boundary:

• Between the LAN and the internet
• Between a guest wireless VLAN and corporate servers
• In front of a screened subnet that hosts public services

Most firewalls end the rule set with implicit deny. Traffic that matches no permit rule is dropped. A technician who adds a new application and forgets a permit rule sees “the network is down” when the path is alive and the policy is the block.

Host firewalls still matter. A network firewall cannot see encrypted east-west traffic between two PCs on the same VLAN as clearly as the endpoint can. Defense uses both.

Firewall vs. Router vs. Switch

A router ACL can filter packets. That does not turn every router into the exam’s “firewall.” When the question stresses security policy, inspection, or blocking unauthorized access, choose firewall. When the question stresses different subnets, the internet, or a default gateway, choose router. When the question stresses local printers, workstations, and MAC forwarding, choose switch.

One Packet Through All Three Devices

A user on 192.168.10.50 opens https://example.com.

1. The PC builds a TCP segment to destination port 443 and an IP packet to the website’s public address. The destination is not local, so the PC ARPs for the default gateway’s MAC and builds an Ethernet frame to the router.
2. The access switch reads the destination MAC, finds the gateway’s port in the MAC table, and forwards the frame. No other workstation receives a copy.
3. The router accepts the frame, checks that the packet is not local, matches a default route toward the ISP, applies NAT if this is a SOHO edge, and sends the packet out the WAN interface.
4. The firewall—standalone or built into the edge device—matches the outbound HTTPS flow against policy, records state, and permits it. Later return packets match that state and pass. A scan from the internet that has no matching state hits implicit deny.

Break any step and the symptom changes. A bad switch port kills only that user. A missing default route kills internet access for the subnet. A firewall rule that forgot port 443 kills websites while ping to the router still works.

Exam Traps and Field Habits

CompTIA mixes 2.5 with 2.4 (VLAN, VPN), 2.6 (SOHO addressing and gateways), and 5.7 (network symptoms). These habits prevent the common misses:

• Do not call a four-port SOHO box “just a router.” Name the function the scenario needs.
• Do not assign VLANs to an unmanaged switch. No management plane means no VLAN config.
• Do not expect a Layer 2 switch to separate two IP subnets. Different subnets need a router hop.
• Do not confuse a patch panel with a switch. A patch panel only terminates cable. It does not learn MACs or forward frames.
• Do not open inbound ports to “fix” an application before you confirm the firewall is the block. Check the default gateway and DNS first.

Managed switches, edge routers, and hardware firewalls all need a secure management channel, current firmware, and a documented rule or VLAN map. A device that works and cannot be explained is a ticket waiting to happen.

Candidates who map each device to a layer, an address type, and a failure symptom handle 2.5 items quickly and free time for ports, wireless, and performance-based SOHO labs. A complete Core 1 plan that sequences those objectives sits at https://legacyhaven.university/how-to-pass-comptia-a-core-1-220-1201/.