IP Services
DHCP and DNS
DORA: Discover (broadcast), Offer, Request (broadcast), Acknowledge. When the server sits on another subnet, the client-facing interface needs ip helper-address, which converts the broadcast into unicast to the server. Trap: the helper goes on the router or SVI nearest the client, not on the server's side.
NAT
Static NAT is 1:1, dynamic NAT uses a pool, PAT (overload) is many-to-one using ports. Inside local is the real internal address before translation; inside global is what the outside world sees. Most failures trace to a missing ip nat inside/outside on an interface or an ACL that does not match.
NTP, syslog, SNMP
NTP stratum 1–15 is valid; 16 means unsynchronized, which is the Cisco default until a server answers. Syslog severity descends in number as it rises in urgency: 0 emergencies, 1 alerts, 2 critical, 3 errors, 4 warnings, 5 notifications, 6 informational, 7 debugging. logging trap 6 sends levels 0–6, not level 6 alone. SNMPv3 adds authentication and encryption; traps are unacknowledged, informs get a reply.
QoS and management access
Know marking (DSCP at Layer 3, CoS at Layer 2), queuing (priority, weighted fair), and the difference between shaping (buffer) and policing (drop). SSH requires a hostname, domain name, and generated RSA keys before it works - a favourite "first missing step" question. TFTP is UDP 69 with no authentication.
Rule of thumb
For NAT troubleshooting, verify in order: inside/outside roles, ACL match, then show ip nat translations. For SSH, verify hostname, domain name, crypto key, then vty transport input ssh.