Students should produce evidence, not just complete steps
A strong networking lesson does more than ask students to configure a device or memorize a command. It makes the network's state visible, asks students to predict what should happen, exposes a result that can support or falsify their reasoning, and ends with reproducible verification.
Six complete AP Networking lesson plans
These are professionally formatted PDF lesson plans with objectives, timing, artifacts, student prompts, misconceptions, expected reasoning, verification, and exit tickets.
Subnet Boundaries: Local vs. Remote
Teach /27 and /26 boundaries, usable ranges, local-vs-remote decisions, and forwarding consequences.
Download Lesson PlanDHCP vs. DNS Dependency Chain
Compare APIPA, valid addressing with DNS failure, and successful DNS with failed HTTPS.
Download Lesson PlanMAC Learning and Switch Forwarding
Students predict source learning, unknown-unicast flooding, reply learning, and VLAN scope.
Download Lesson PlanVLAN Trunk Failure
Use a healthy VLAN as a control to isolate an allowed-list/tagging failure without blaming the physical link.
Download Lesson PlanLongest Prefix and Next-Hop Reachability
Separate route selection from actual forwarding and add a return-path failure for deeper reasoning.
Download Lesson PlanFirewall Rule Order and Least Privilege
Diagnose rule shadowing, build a narrow exception, and verify both positive and negative security tests.
Download Lesson Plan/downloads/ folder on your site using the filenames shown in the links above.Subnet boundaries: make the math change a packet decision
Students should not stop after calculating network and broadcast addresses. Require them to explain the forwarding consequence: local destinations are resolved on the local link; remote destinations are sent toward a gateway.
DHCP versus DNS: locate the first failed dependency
| Case | Artifact | First supported boundary | Wrong shortcut |
|---|---|---|---|
| A | 169.254.x.x, no expected gateway | Address configuration / DHCP path | Start changing DNS |
| B | Valid IP, gateway works, remote numeric IP works, DNS times out | Name-resolution path | Reconfigure the gateway |
| C | DNS returns expected IP, TCP/443 times out | Transport/policy/service boundary | Change DNS despite successful answer |
Swipe horizontally to compare dependency cases.
MAC learning: predict before showing the table
Start with an empty switch MAC table. Have PC-A send to PC-B. Students predict the learned source and the switch's unknown-unicast behavior. Then let PC-B reply and inspect the table again.
VLAN trunk failure: use the healthy VLAN as your control
The working VLAN proves the shared physical uplink is not completely down. The failure is specific to VLAN 20 carriage across the link. Students inspect trunk/allowed-VLAN state, correct only the missing VLAN, and verify VLAN 10 still works.
Route selection: distinguish “route wins” from “route works”
After students master longest-prefix matching, make next hop 192.168.10.4 unreachable. The route still wins the lookup, but forwarding fails. Add a missing return route for a second layer of analysis.
Firewall order: teach least-privilege verification
Students identify rule shadowing, create the narrow authorized exception in the correct order, and then run two acceptance tests: required TCP/8443 succeeds and a prohibited neighboring flow still fails.
Guest isolation: convert a written requirement into testable policy
Requirement: guests need Internet access and approved DNS but may not reach Staff systems. Students must write the allowed dependencies, prohibited internal boundary, and positive/negative tests before seeing any firewall configuration.
Positive tests
Guest DNS works. Guest Internet HTTPS works.
Negative tests
Guest cannot reach Staff management interfaces or internal services outside the requirement.
Wireless evidence: stop calling every symptom “bad Wi-Fi”
| Symptom | Useful evidence | Possible boundary |
|---|---|---|
| Weak signal at distance | RSSI/signal level by location | Coverage |
| Strong signal, poor throughput at busy time | Channel utilization/contention | Capacity/contention |
| Association succeeds, no IP configuration | DHCP state | Addressing dependency |
| Authentication fails | Authentication logs/credentials | Access control |
| Wi-Fi healthy, upstream path fails | Gateway/routing tests | Beyond wireless link |
Swipe horizontally to compare wireless failure signatures.
Performance diagnosis: congestion and corruption are not the same
High utilization + queue drops
Supports congestion/queuing pressure. Ask whether demand, capacity, or traffic policy is creating sustained contention.
Low utilization + CRC errors
Supports a physical/link-integrity boundary rather than simple congestion.
Have students propose the next artifact that would distinguish the two before making a configuration change.
CLI selection: grade the question answered, not the command memorized
| Question | Likely tool/artifact category | Student must explain |
|---|---|---|
| What DNS answer is returned? | nslookup/dig or resolver evidence | What the returned address proves |
| Which route wins? | Routing table | Longest-prefix decision |
| Where does visible path behavior change? | traceroute/tracert | What a hop does and does not prove |
| Is a local service listening? | ss/netstat/listener evidence | Why local listener ≠ remote reachability |
Swipe horizontally to compare CLI evidence tasks.
Mixed incident: preserve every checkpoint that already succeeded
The student should not restart at DHCP, DNS, or firewall configuration. The first demonstrated failure is at the service listener. This lesson trains students to move through a dependency chain without discarding successful evidence.
Security verification: write acceptance tests before configuration
Give students a least-privilege requirement and make them write both required-success and required-failure tests before they see the implementation. Those same tests become the post-change acceptance criteria.
Use the same structure for 45-minute, block, or simulator classes
One artifact, one decision
Warm-up, teacher model, one student artifact, one correction, one exit ticket.
Add a second fault
Require a control, a changed-fact variant, and written verification another team can reproduce.
Preserve the reasoning
Even if hardware is virtual, keep prediction, artifact analysis, controlled correction, and verification.
Score the reasoning, not only the working configuration
| Category | Strong evidence | Weak evidence |
|---|---|---|
| Prediction | States expected artifact and mechanism | Guesses “it should work” |
| Artifact interpretation | Explains what output proves and does not prove | Copies values without interpretation |
| Decision | Changes only what evidence supports | Changes several unrelated settings |
| Verification | Repeats original test plus control/negative test | Stops after one successful result |
| Explanation | Connects mechanism → evidence → result | Reports only the final configuration |
Swipe horizontally to use the classroom rubric.
24 lesson-plan concept flashcards
Teachers can use these as bell ringers, retrieval practice, or lesson exit questions. Students can filter by topic and work through the deck independently.