IP Services
IP Services
This domain covers the supporting services that make a network usable: NAT, DHCP, DNS, NTP, SNMP, syslog, QoS, and file transfer. The exam favors operational details such as port numbers, translation behavior, and severity levels.
Core rules
- NAT uses inside/outside interfaces. Static NAT maps one-to-one; dynamic NAT uses a pool; PAT overloads many inside addresses onto one public address. NAT is applied as traffic crosses the inside/outside boundary; verify translations and ACL order because a deny can prevent translation.
- DHCP uses DORA: Discover (client broadcast), Offer, Request, Acknowledge. Servers listen on UDP 67, clients on UDP 68. A router relays with
ip helper-address, which forwards broadcasts to a DHCP server on another subnet. - DNS uses UDP/TCP 53; NTP uses UDP 123 and is hierarchical by stratum (stratum 0 reference, stratum 1 directly attached). SNMP uses UDP 161 for polling and 162 for traps; SNMPv3 adds authentication and privacy. Syslog uses UDP 514.
- Syslog severities run 0 (emergencies) to 7 (debugging); lower is more severe. QoS classifies and marks traffic, often with DSCP (6 bits). EF is DSCP 46 for voice; AF classes provide assured forwarding.
- SSH uses TCP 22 and should replace Telnet (TCP 23). TFTP uses UDP 69; FTP uses TCP 20/21.
Worked example
A branch has 192.168.50.0/24 inside and one public address on G0/1. Configure PAT: interface G0/0 then ip nat inside; interface G0/1 then ip nat outside; access-list 1 permit 192.168.50.0 0.0.0.255; ip nat inside source list 1 interface G0/1 overload. The wildcard matches the /24, and overload enables port address translation. Verify with show ip nat translations.
Traps
- Configuring NAT without marking the correct inside and outside interfaces, so no translation occurs.
- Using a subnet mask in an ACL instead of a wildcard mask.
- Reversing syslog severity: 0 is most severe, 7 least.
- Assuming DHCP relay works for the local subnet only; it is needed when the client and server are separated by a router.