Cisco Certified Network Associate (CCNA) 200-301 · Free study guide

IP services: the dependencies behind reachability

An interface can route packets correctly while users still report that “the network is down.” Supporting services assign addresses, resolve names, align clocks, translate address space, collect evidence, prioritize congestion, secure management, and move files. Troubleshooting improves when each dependency has a distinct job and test.

Translate addresses deliberately

Inside-source NAT describes translation of a source that originates on the inside. Its inside-local address is meaningful in the internal network; an inside-global address represents it externally. Static NAT provides a stable one-to-one mapping. Dynamic NAT selects an available address from a configured pool. Neither is the same as port overload unless PAT is explicitly used.

Mark inside and outside interfaces, define the eligible inside addresses, and create the mapping or pool. Verify actual translations and counters after generating permitted traffic. A correct rule with reversed interface roles or an ACL that matches the wrong source will not produce the intended entry.

Make time a shared dependency

NTP lets devices synchronize toward a reference through a stratum hierarchy. A configured server statement is intent; synchronized association is evidence. Accurate time makes logs, certificates, authentication, incident timelines, and distributed troubleshooting far more reliable.

A network device can consume time as a client and provide time downstream as a server. Avoid loops and untrusted sources, understand which clock is authoritative, and verify offset and state. “The clock looks close” is not a synchronization test.

Separate DHCP from DNS

DHCP supplies configuration such as an address, prefix or mask, default gateway, DNS server, and lease lifetime. DNS maps names to data such as IP addresses. DHCP can tell a client which DNS resolver to use, but it does not itself resolve the application name. A client can have a valid lease and broken DNS, or working DNS and an invalid gateway.

DHCP discovery begins as a local broadcast because a new client lacks normal IP context. A router does not forward that broadcast by default. A relay receives it on the client subnet and sends it toward a server, supplying context that allows the server to choose the correct scope. Check the client VLAN, relay interface, helper target, server scope, and return route.

Monitor with SNMP and syslog

SNMP managers query agents for managed objects identified through MIB structure and object identifiers. Agents can also send notifications such as traps or informs. Polling captures periodic state; notifications call attention to events. Secure credentials, restrict sources, and choose a protected SNMP version where supported. Monitoring access can expose or even modify operational state.

Syslog messages include severity and a facility or generating context. Severity zero is the most urgent and seven the most detailed. A numeric threshold must be interpreted in that direction. Central collection preserves evidence beyond a device's local buffer, but useful correlation also requires synchronized time, consistent identity, and an intentional retention policy.

Understand QoS as per-hop treatment

QoS cannot create bandwidth. Classification identifies traffic, marking carries a treatment signal, queues hold packets, and scheduling decides service when an interface is congested. Policing enforces a rate by dropping or remarking excess traffic. Shaping buffers excess traffic to smooth transmission toward a target rate. The right choice depends on where congestion occurs and whether delay or loss is preferable.

Policies act per hop. An upstream marking has value only if downstream devices trust or reclassify it consistently. Measure queue behavior and drops under load; an attached policy with no traffic match proves little.

Build SSH from prerequisites

Secure Shell needs device identity, cryptographic keys, an authentication source, and VTY transport policy. A common workflow sets a hostname and domain, generates supported RSA keys, creates a local user or AAA method, selects an SSH version, and restricts VTY input to SSH. Then test from an allowed management source and confirm Telnet is rejected.

SSH protects transport but does not automatically limit who may reach the port, what commands an administrator may execute, or whether activity is recorded. Layer management ACLs, AAA authorization, and accounting around it.

Choose file transfer with eyes open

TFTP is a small UDP-based transfer mechanism with no native user authentication or confidentiality. FTP uses authenticated control and separate data connections but also lacks confidentiality in its ordinary form. Both can move configuration or software files in controlled legacy workflows; neither should be described as secure merely because it succeeded.

Use isolated management paths and integrity verification, and prefer protected alternatives when requirements allow. Account for firewall and NAT behavior, especially FTP's separate data sessions.

Diagnose the service chain

Begin with a literal symptom. If an IP connection works but a name does not, test DNS rather than routing at random. If leases fail only on remote VLANs, inspect relay. If logs disagree about sequence, inspect NTP. If internal traffic works but translated traffic does not, inspect NAT roles, matches, and entries.

Each service has intent, state, and traffic evidence. Collect all three, and do not let a configuration line substitute for observed operation.