Practice reading network diagrams for device roles, Layer 2 and Layer 3 boundaries, VLAN paths, gateways, redundant links, failure domains, and the dependencies that determine packet flow.
Independent AP Networking resource • Updated 2026-09-14 • Built for students and teachers
AP Networking Premium: Add guided practice, answer explanations, artifact work, and structured review to the free study system.
Do not start with icons—start with the packet's job
A strong network-diagram answer explains a path, a boundary, or a dependency. Before deciding which device is “the problem,” identify the source, destination, addressing context, Layer 2 domain, Layer 3 boundary, required services, and every shared component along the path.
Observed: PC-A reaches the VLAN 10 gateway. PC-B reaches the VLAN 20 gateway. Neither reaches the VLAN 30 server.
What this provesThe two clients can reach their respective local Layer 3 gateway interfaces, weakening two independent access-link failures.
What it does not proveThat VLAN 30's SVI, VLAN state, server gateway, inter-VLAN policy, or server itself is healthy.
Best next boundary: Inspect the shared Layer 3 path toward VLAN 30: VLAN 30 SVI/interface state, connected route, ACL/firewall policy, server VLAN membership, and server addressing.
Changed fact: If PC-A can reach the server but PC-B cannot, stop treating VLAN 30 as a universally failed destination. Compare VLAN 10 vs. VLAN 20 routing/policy instead.
Case 2 • Layer 2 redundancy
Parallel links can create a loop unless the design controls forwarding
+----------+ +----------+
| Switch A |==========| Switch B |
+----------+==========+----------+
two Layer 2 paths
Ethernet frames do not use an IP-style TTL to stop indefinite Layer 2 circulation. Uncontrolled redundant paths can allow broadcasts and unknown-unicast traffic to circulate and can destabilize MAC-address learning.
Spanning Tree approach
Maintain physical redundancy while placing a redundant Layer 2 path into a non-forwarding state until topology conditions require it.
Link aggregation approach
When correctly configured, multiple physical links can operate as one logical bundled connection rather than as uncontrolled independent paths.
Trap: “Two cables are always better than one” is false at Layer 2 unless the topology has a loop-control/aggregation design.
Case 3 • Hidden single point of failure
Two ISPs do not automatically mean end-to-end redundancy
The providers are redundant, but both terminate on the same edge router. The edge router remains a single point of failure. The core switch may be another one.
Component removed
What likely disappears
What this reveals
ISP-1
One provider path
ISP-2 may preserve WAN connectivity if failover is configured
Edge router
Both ISP paths
Provider diversity did not remove edge-device dependency
Core switch
User path to edge
Core is another shared dependency
One access switch
Its attached user block
Smaller failure domain
Swipe horizontally to inspect the failure-domain table.
Case 4 • Wireless + DHCP
Association success is not proof of complete network access
Laptop )))) AP ---- Access Switch ---- L3 Gateway ---- Internet
|
VLAN 40
|
DHCP server / relay path
Observed: The laptop associates to the AP but does not receive a DHCP lease.
Already partly provenWireless discovery/association is working sufficiently for the client to join the WLAN.
Still unprovenSSID-to-VLAN mapping, VLAN 40 switch path, DHCP scope, DHCP server/relay path, and policy.
Do not start at the Internet router. A local DHCP lease is required before normal Internet routing becomes the useful first branch.
Case 5 • Subnet labels
Diagram proximity does not determine whether two hosts are local
Host A: 10.5.8.20/26
Host B: 10.5.8.90/26
A /26 creates blocks of 64 addresses. Host A is in 10.5.8.0/26, while Host B is in 10.5.8.64/26. They require Layer 3 forwarding to communicate even though the first three octets look identical.
Changed fact: If both were /24 and in the same VLAN, they would share the 10.5.8.0/24 IPv4 network and would normally communicate locally at Layer 2 rather than sending the traffic to a gateway for inter-subnet routing.
A gateway is needed because the destination is off-subnet—not because “Internet means router”
PC 10.10.10.25/24
|
+---- Switch ---- Gateway 10.10.10.1 ---- Other networks
Destination A: 10.10.10.80/24
Destination B: 10.10.20.80/24
For Destination A, the PC can resolve a local Layer 2 destination and send within the subnet. For Destination B, the PC sends the frame toward its default gateway because the IP destination is outside 10.10.10.0/24.
Transfer rule: First decide local vs. remote using the prefix. Then decide whether the default gateway participates.
Case 7 • VLAN trunk
One trunk can be the shared dependency for several VLANs
If VLAN 10 works across the trunk but VLANs 20 and 30 fail, a complete trunk-link outage is a weak explanation. Inspect which VLANs are permitted/present, tagging expectations, and endpoint port assignments.
Useful controlVLAN 10 successfully crossing the same physical trunk.
Inference limitThe physical trunk works for at least one VLAN; it does not prove every VLAN is correctly carried.
Case 8 • Firewall placement
A diagram can reveal where policy must be evaluated
Student VLAN ---- L3 Core ---- Firewall ---- Server VLAN
| |
10.20.0.0/16 policy point
If routing reaches the firewall but HTTPS to the server is denied while another permitted service succeeds, inspect the service-specific rule rather than rewriting the entire routing design.
★ Exam Review • Network Diagram Practice for AP Networking
A five-minute warm-up for Network Diagram Practice for AP Networking
Tomorrow’s opening question can pick up where this page leaves off: ask students to explain the idea in their own words and apply it to a real network. The 300 Bell Ringers give you short questions and teacher answers you can use without preparing a new starter each morning.
Evidence principle: A successful control that traverses the same upstream path but differs at the policy/service dimension helps isolate the failure.
Case 9 • DNS dependency
A path diagram is incomplete if it ignores required services
Client ---- Gateway ---- Network ---- Web Server
|
+---- DNS Resolver
A user may say “the website is down” when the actual failure is name resolution. If the client reaches the server by numeric IP but not hostname, the web path is partly proven while DNS becomes a stronger branch.
What numeric-IP success supportsSome route/service reachability to that IP.
What it does not proveThat DNS can map the intended hostname correctly.
Case 10 • Asymmetric thinking
Forward-path visibility does not guarantee a usable return path
Client ---- Router A ---- Server
\ /
\---- Router B -------/
Possible policy/routing:
Forward path → Router A
Return path → Router B
IP communication is bidirectional. A diagram that shows a plausible forward route is not enough if stateful policy, NAT, or routing expectations depend on the return direction. When a session begins but never completes, ask whether both directions are viable.
Applied Exam Practice • 120 Missions
Let students try Network Diagram Practice for AP Networking for themselves
Reading the explanation is a start. In the browser simulator, students work through a broken network, choose what to test and see whether their fix worked. It gives them another chance to use what they learned about Network Diagram Practice for AP Networking.
Broadcast-dependent services change behavior across routers
Client VLAN 10 ---- L3 Gateway ---- Server VLAN
| |
DHCP broadcast relay/helper
|
DHCP Server
A new DHCP client cannot simply rely on its local broadcast crossing a router like ordinary routed unicast. A relay/helper can receive the local request and forward it toward the remote DHCP server.
Changed fact: If DHCP works when the server is local to VLAN 10 but fails after the server is moved to another subnet, the routed relay dependency becomes highly relevant.
Case 12 • Failure-domain comparison
Use “remove one component” as a mental simulation
Removed component
Likely scope
Reasoning value
One client cable
One endpoint
Very narrow failure domain
Access switch
Attached access block
Multiple endpoints share it
Core/L3 switch
Many VLANs/paths
Large shared dependency
DNS resolver
Name-based access for clients depending on it
IP connectivity may remain
DHCP server/relay
New/renewing clients in affected scopes
Existing configured clients may behave differently
Swipe horizontally to compare failure domains.
Complete Exam Preparation • Network Diagram Practice
Check whether Network Diagram Practice for AP Networking has really stuck
Once students have worked through this topic, give them questions mixed in with the rest of the course. The Exam Prep Vault includes practice exams, multiple-choice questions and artifact labs so they cannot rely on a chapter heading to tell them what to do.
Combine a diagram with observations instead of diagnosing from topology alone
PC-A VLAN10 ----+
+---- L3 Core ---- Firewall ---- App Server
PC-B VLAN20 ----+
Tests:
PC-A → own gateway SUCCESS
PC-B → own gateway SUCCESS
PC-A → App Server 443 TIMEOUT
PC-B → App Server 443 TIMEOUT
PC-A → Internet 443 SUCCESS
PC-B → Internet 443 SUCCESS
What is the strongest shared boundary?
Both VLANs have working local gateway reachability and working secure-web access toward the Internet, but both fail toward the same application destination/service. Focus on the shared App Server path: destination-side route/VLAN, firewall policy for that destination, server listener, or return path.
Premium Artifact Reasoning
Spend less time marking explanations about Network Diagram Practice for AP Networking
When students explain their answer, it takes more than a right-or-wrong check to see what they understand. The Grading Copilot helps you review how they used the clues, where their explanation falls short and what feedback to give next. You make the final grading decision.
What would falsify “the firewall blocks all HTTPS”?
The successful Internet TCP/443 control already weakens that broad claim. A more precise hypothesis would concern policy toward the App Server or destination network.
NEW • COMPLETE 180-DAY TEACHER CURRICULUM
Teach Network Diagram Practice for AP Networking as part of a planned school year
This page gives you one topic. The 180-Day Teacher Curriculum puts it into a full course plan, with daily teaching notes, student activities and checks for understanding. Use it when you need to know what comes before this lesson and what to teach next.