Sefism Network Engineering Roadmap

What this roadmap is

The network engineering roadmap is Sefism's path for students, IT graduates and support engineers who want to build and run networks. Tauseef Fayyaz wrote it so that you pass the CCNA with understanding rather than memory: every stage is built around a lab you configure from the command line, break on purpose and fix, with the configs saved in Git as a portfolio.

You choose a path at the start, and the roadmap adjusts:

• Enterprise (Cisco) (the default): routing and switching towards the CCNA.
• Cloud networking: VPCs, hybrid links and cloud routing. The cloud stage becomes the heart of the path, with private endpoints, cloud DNS and networks written as code, and the certification stage adds cloud networking certificates.
• Network security: firewalls, VPNs and secure design. The security stage becomes the heart of the path, with next-generation firewalls and IPS, segmentation and zero trust, and a firewall lab of your own, and the certification stage adds security certificates.

By the end you should be able to:

• Subnet any IPv4 block in your head, plan addresses with VLSM and explain how a packet crosses a network layer by layer.
• Build and troubleshoot a multi-VLAN, multi-router lab with trunks, spanning tree, OSPF, static routes and gateway redundancy from the Cisco command line.
• Secure a network with ACLs, NAT, hardened device access, Layer 2 protections, firewall zones and an IPsec VPN, and explain every rule you wrote.
• Automate backups, checks and simple changes with Python and Ansible, and read monitoring data from SNMP, syslog and flow logs.
• Pass the CCNA (and the next certificate for your path) with a lab portfolio to show for it, and handle NOC tickets, escalations and change windows in your first role.

Who it suits, and who should start elsewhere

It suits students in computer science, IT and telecoms, IT support and helpdesk staff who want to move up, and NOC engineers aiming for a network engineer title. It needs no programming at the start; Python arrives in the automation stage.

If you want to run cloud infrastructure broadly rather than networks specifically, the Cloud engineering roadmap fits better. If security in general (not only network security) is the goal, see Cybersecurity. And if you have never used a Linux terminal, a short detour through Linux, terminal and Git helps with the lab and automation stages.

Prerequisites and realistic time

A laptop that runs Cisco Packet Tracer, a free Networking Academy account, paper for subnetting practice, and later a cloud account with a billing alert for the cloud stage. The roadmap adds up to about 180 hours across 10 stages, including 40 hours for certification study:

• At about 5 hours a week (the default on the public page): roughly 39 weeks.
• At about 8 hours a week: roughly 26 weeks.
• At about 12 hours a week: roughly 19 weeks.

The first stage, how networks work and subnetting, is a foundation stage: skipped if you are comfortable with it, shortened if you know some of it.

A sample week for a student (10 to 12 hours). Ten subnetting questions every day on paper during the first stage, two evenings with the video course for the stage, and a weekend block building and breaking the stage's lab.

A sample week for someone working full time (5 hours). Fifteen minutes of subnetting or flashcards on weekdays, and a three-hour lab session at the weekend. If you already work in support or a NOC, read every ticket you can and connect it to the stage you are on.

Stage by stage

1. How networks work and subnetting (24 hours, foundation)

The OSI and TCP/IP models, TCP, UDP and port numbers, IPv4 addresses, masks and prefixes, subnetting without a calculator, VLSM and address plans, IPv6, ARP and the default gateway, and DHCP and DNS. Milestone: subnet any /20 to /30 in under a minute without a calculator, write a VLSM plan for a small office, and explain how a ping crosses a router. "Subnetting is the one skill you cannot skip or look up in the exam."

2. Switching and VLANs (16 hours)

How a switch learns and forwards, VLANs and access ports, trunks, 802.1Q and the native VLAN, routing between VLANs, spanning tree, PortFast, BPDU Guard and Root Guard, EtherChannel with LACP, and CDP and LLDP. Milestone: a lab with three switches, three VLANs across trunks, a chosen root, protected access ports, an LACP EtherChannel and working inter-VLAN routing. Type every command yourself and break the lab on purpose.

3. Routing: static, OSPF and BGP (20 hours)

Reading the routing table, longest prefix match and administrative distance, static, default and floating static routes, single-area OSPF, network types and the DR election, HSRP and VRRP, BGP basics and choosing a protocol. Milestone: four routers in single-area OSPF, a default route to an "ISP" router over eBGP, a floating static backup, HSRP on a user VLAN, and a test log showing failover working.

4. Your lab and the command line (10 hours)

Packet Tracer as a first lab, the IOS command line and saving configs, evidence first with show commands, ping, extended ping and traceroute, the GNS3 and Cisco Modeling Labs emulators, and packet captures. Milestone: Packet Tracer and one emulator working, every lab's configs in Git, and labelled captures of a TCP handshake, a DHCP lease and an OSPF hello.

5. Your certification plan (40 hours)

Which certification first, the CCNA and its upcoming refresh, turning the blueprint into a plan, a schedule you can keep, practice exams and weak areas, and booking the exam, with cloud networking or network security certifications on those paths. Milestone: a marked-up blueprint, a dated schedule with the exam booked, a daily flashcard deck, and two timed practice exams above your target. The advice: pass the certificate, but do not let it replace the labs.

6. Network security: ACLs, firewalls and VPNs (18 hours)

Access control lists, NAT and PAT, securing device access, Layer 2 attacks and switch protections, stateful firewalls and zones, and IPsec site-to-site and remote access VPNs. Milestone: extended ACLs, PAT and a static NAT, SSH-only device access, port security with DHCP snooping and DAI, and a working site-to-site VPN, with a note explaining every rule. On the security path the milestone grows into an OPNsense or similar firewall lab with inside, outside and DMZ zones and IDS alerts reviewed.

7. Wireless networking (8 hours)

Wi-Fi standards, bands, channels and SSIDs, access points and controllers, WPA2, WPA3 and 802.1X, and troubleshooting Wi-Fi. Milestone: a Packet Tracer lab with a controller, two access points, a staff network and a separate guest VLAN, plus a channel plan for a small office. Small in the exam, but a large share of real tickets.

8. Network automation and monitoring (18 hours)

Python for network engineers, JSON and YAML, scripts with Netmiko, REST APIs, RESTCONF and NETCONF, Ansible playbooks, SNMP and syslog, configuration backups and drift, and an optional look at AI assistants in network operations. Milestone: a Python backup and error report across your lab, an idempotent Ansible VLAN playbook, and SNMPv3, syslog and NTP configured. Automate reading before writing.

9. Cloud networking (16 hours)

VPCs, VNets and address plans, public and private subnets and route tables, security groups and network ACLs, internet and NAT gateways, peering and transit hubs, hybrid links to the office, and flow logs and path analysis. Milestone: a cloud network across two zones with least-privilege security groups and flow logs showing an accepted and a rejected connection. On the cloud path the milestone is the same network written as code, with private endpoints and a VPN to your lab, destroyed and recreated identically.

10. Your first network role (10 hours)

What NOC work looks like, writing tickets people trust, a troubleshooting method, change windows, documentation, runbooks and escalation, and finding and winning your first role. Milestone: a public portfolio of three documented labs, one automation script, a sample ticket update and change plan, and ten applications sent. "Take the NOC or support job if it is the one on offer."

Projects to build alongside

• Network Configuration Backup and Drift Detection for University Campus Networks
• Network Monitoring and Outage Alerting Dashboard for Small ISPs
• Firewall Rule Audit Tool for Small Business Firewalls
• Honeypot Network with Attack Telemetry Dashboard, on the network security path.
• Three-Tier Web App on AWS with Infrastructure as Code, on the cloud networking path.

How it works on Sefism

Everything on Sefism is free to learn from. The public roadmap page lists all ten stages with their summaries and length and opens the first two in full. Adding the roadmap to your dashboard opens every stage, tracks your progress and gives you the companion cheat sheet. Your first roadmap is free to add; after that, adding a roadmap uses credits, and new members get starting credits when they join.

Each topic in the dashboard has an explanation, a check question and an AI prompt that quizzes you, and each stage has Tauseef's advice, a checklist and curated resources. You can ask Tauseef a question about any stage.

The companion cheat sheet

The Network engineering cheat sheet revises every stage with the Cisco IOS commands you will type in labs, and AWS CLI commands on the cloud edition.

Related on Sefism

• Is the CCNA still worth it for a fresh graduate?
• How to move from NOC to network engineer
• Where to start in cybersecurity or IT operations
• Jeremy's IT Lab: CCNA 200-301 Complete Course, Cisco Packet Tracer and Netmiko, from the stage resources.

What you can do afterwards

Apply for NOC, network support and junior network engineer roles with a CCNA and a lab portfolio you can walk someone through. The roadmap's view is that two years in a NOC or support role, reading every ticket and automating your own checks, opens most network engineering doors.

FAQ

How long does it take to become a network engineer? The roadmap estimates about 180 hours, including certification study: roughly 19 weeks at 12 hours a week or 39 weeks at 5 hours a week.

Is the CCNA still worth it? The roadmap treats it as the first certificate for the enterprise path, but warns that employers ask CCNA holders to explain what they built. Plan your exam version around your test date, since the certification stage covers a refresh.

Can I learn networking without real equipment? Yes. Packet Tracer is enough for most of the CCNA, and GNS3 or Cisco Modeling Labs Free cover BGP, firewalls and automation.

Do network engineers need to code? Python and Ansible get their own stage. Start by automating backups and health reports, which are safe and useful from day one.

Should I choose cloud networking or enterprise networking? All three paths share routing, switching and security. Choose cloud networking if your target jobs mention VPCs and hybrid links, and enterprise if they ask for Cisco and the CCNA.