Services: QoS, multicast, NAT, and subscriber edge
What this domain tests
Services covers QoS, multicast, NAT, and subscriber-edge functions such as PPPoE and DHCP. Questions test where to mark traffic, how PIM builds trees, how NAT translates addresses, and how subscriber sessions are established.
Core rules
- QoS: classify and mark close to the source, trust DSCP at the provider boundary, and queue during congestion. Policing drops or remarks excess; shaping buffers and delays. WRED drops selectively before a queue is full.
- Multicast: PIM-SM uses an RP and a shared tree (*,G), then can switch to a shortest-path tree (S,G). The RPF check uses the unicast route to the source, not the route to the RP. SSM uses 232/8 and does not need an RP. IGMP snooping limits multicast flooding on switches.
- NAT: inside and outside interfaces, static and dynamic translation, and PAT overload. Return traffic must match translation state; routing and translation order matter when troubleshooting.
- Subscriber edge: PPPoE uses discovery and session stages; RADIUS provides authorization and accounting; DHCP relay and IPoE serve other access models.
Worked example
A receiver joins 239.1.1.1. The last-hop router builds a shared tree toward the RP, and the source registers with the RP. The router can then switch to the shortest-path tree for (S,G). The RPF check for (S,G) uses the unicast route to source 10.1.1.1, not the route to the RP. If the source is reachable through a different interface than the one receiving multicast, the packet fails RPF and is dropped. The fix is to correct the unicast route or add a static mroute, not to change the RP address. Always verify the RPF interface before blaming PIM.
Traps that cost marks
- Assuming PIM-SM needs no RP; sparse mode needs one unless SSM is used.
- Running the RPF check against the RP instead of the source.
- Marking QoS at the core instead of the trust boundary.
- Confusing policing with shaping; policing drops or remarks, shaping delays.
- Forgetting that NAT overload uses source ports to multiplex translations.