NAT Types: Static, Dynamic and Port Address Translation
Network Address Translation rewrites addresses in the IP header as packets cross a boundary, most often so that private RFC 1918 addresses can reach the public internet. Static NAT maps one inside local address to one inside global address permanently, which is what you use to publish an internal server. Dynamic NAT draws from a pool of public addresses on demand, so translations exist only while there is traffic and the pool can be exhausted. Port Address Translation, also called NAT overload, is the form nearly every network actually runs: many inside hosts share a single public address, and the router keeps them apart by rewriting the source port number as well as the address. Cisco's terminology matters as much as the mechanism: inside local is the private address as seen inside, inside global is the translated public address, outside global is the real address of the internet host, and outside local is how that host appears inside.
Exam tip. Translation only happens if the interfaces are tagged inside and outside and traffic matches the ACL. If show ip nat translations is empty while hosts complain, check the interface tagging first.
DHCP: The Lease Process, Server and Relay
DHCP gives a client its IP address, subnet mask, default gateway, DNS servers and other options automatically. The exchange is four messages known as DORA: the client broadcasts a Discover, a server replies with an Offer, the client broadcasts a Request for the offered address, and the server confirms with an Acknowledgement. Clients use UDP port 68 and servers UDP port 67. Because Discover is a broadcast, it does not cross a router, so a remote subnet needs a relay agent: the ip helper-address command on the client-facing interface converts the broadcast into a unicast towards the real server and inserts the subnet information the server needs to pick the right pool. A Cisco router can also be the server itself using ip dhcp pool, and you must exclude the static addresses such as the gateway with ip dhcp excluded-address before defining the pool. A client that fails to get a lease falls back to a 169.254.x.x APIPA address, which is the visible symptom of a DHCP failure.
Exam tip. If hosts on the local subnet get addresses but a remote subnet does not, the missing piece is almost always ip helper-address on the router interface serving that remote subnet.
DNS Fundamentals for Network Engineers
DNS turns names into addresses so users and applications never have to know an IP address. A resolver queries recursively through the hierarchy of root, top level domain and authoritative servers, caching each answer for the time to live the record specifies. DNS runs on port 53, using UDP for ordinary queries because they are short and a retry is cheap, and falling back to TCP for zone transfers and any response too large for a single datagram. The records you must recognise are A for IPv4, AAAA for IPv6, CNAME for an alias, MX for mail exchangers, NS for name servers, PTR for reverse lookups and TXT for arbitrary text such as mail authentication policies. On a Cisco device, ip name-server sets the resolver, ip domain-lookup enables resolution, and ip host creates a static entry; you will often see no ip domain-lookup configured so mistyped commands do not trigger a slow lookup attempt.
Exam tip. The classic exam symptom is 'ping by IP works, ping by name does not'. That is always DNS, so look at the resolver configuration rather than routing.
NTP and Time Synchronisation
Accurate, consistent time is a prerequisite for correlating logs across devices, validating digital certificates, applying time-based access lists and producing usable forensic evidence. Network Time Protocol runs over UDP port 123 and organises sources into strata: stratum 0 is the reference clock itself such as a GPS or atomic source, stratum 1 is a server directly attached to it, and each hop away adds one to the stratum number, up to a maximum of 15. A Cisco device becomes a client with ntp server <address>, and can serve time to others as well; ntp master makes it an authoritative source at a chosen stratum, which is sometimes used on an isolated network. NTP supports authentication so a device only accepts time from a trusted server, which matters because a forged time source can invalidate certificates or hide the timeline of an attack. Always set the correct time zone and, if applicable, summer time, so timestamps read sensibly.
Exam tip. Remember NTP uses UDP 123 and that a lower stratum number is a better source. show ntp status telling you the clock is unsynchronised is the direct evidence that NTP is not working.
SNMP Versions, Components and Operations
Simple Network Management Protocol lets a management station read and sometimes change values on network devices. The manager polls agents on UDP port 161 and agents send unsolicited notifications called traps to the manager on UDP port 162. Every readable value is an object identified by an OID within a management information base, which is the structured catalogue of what a device exposes. Version 1 and version 2c authenticate only with a community string sent in clear text, so read-only communities are the safest thing you can do with them; version 2c adds bulk retrieval and inform messages, which are traps that must be acknowledged. Version 3 is the one to deploy because it adds real security through the three levels noAuthNoPriv, authNoPriv and authPriv, the last of which authenticates the message and encrypts the payload. On the exam, know which SNMP operation does what: get, getnext, getbulk, set, trap and inform.
Exam tip. If a question asks for secure device monitoring, the answer is SNMPv3 with authPriv. Also remember only informs are acknowledged; a lost trap is simply lost.
Syslog Severity Levels and Logging Destinations
Syslog is how a device tells you what just happened, and it grades every message with a severity from 0 to 7 where lower is more serious. Level 0 is emergency, 1 alert, 2 critical, 3 error, 4 warning, 5 notification, 6 informational and 7 debugging. When you configure a logging level you get that level and everything more severe, so logging trap 4 sends levels 0 through 4. Messages can go to the console, to a virtual terminal session, to a memory buffer on the device or to a remote syslog server over UDP port 514, and only the remote server survives a reboot, which is why it is the destination that matters for real operations. A typical message reads as a sequence number, timestamp, facility, severity and mnemonic, for example a line reporting that a line protocol changed state. Enable service timestamps and NTP so those timestamps can be correlated across devices.
Exam tip. Learn the severity list in order and remember the direction: a lower number is more serious, and setting a level captures everything at or below that number.
QoS: Classification, Marking, Queuing and Shaping
Quality of service exists because congestion is inevitable and not all traffic suffers equally when it occurs. Voice needs low latency, low jitter and low loss, video tolerates a little more, and bulk data mostly just needs throughput. QoS starts with classification, deciding which packets belong to which class, and marking, writing that decision into the packet so later devices can trust it: DSCP occupies six bits in the IPv4 header's DS field, and class of service occupies three bits inside the 802.1Q tag, so CoS only survives on a trunk while DSCP survives end to end. Queuing then decides what leaves an interface first, with low latency queuing giving voice a strict priority queue while class-based weighted fair queuing shares the rest. Policing and shaping both enforce a rate, but policing drops or re-marks the excess immediately while shaping buffers it and sends it later, which is why shaping suits an outbound WAN link and policing suits an ingress boundary.
Exam tip. Know that voice is marked EF (DSCP 46), that CoS lives only in the 802.1Q tag, and that shaping buffers while policing drops. These three facts answer most QoS questions on this exam.
SSH, Telnet, FTP and TFTP for Device Management
Managing a device means both logging into it and moving files such as images and configurations on and off it. Telnet on TCP port 23 sends everything including credentials in clear text and should never be used across an untrusted network; SSH on TCP port 22 provides the same interactive access with authentication and encryption and is the only acceptable option in practice. Enabling SSH on IOS requires a hostname, a domain name, a locally generated RSA key pair of at least 1024 bits, a local user account or AAA, and the vty lines set to transport input ssh with login local. For file transfer, TFTP on UDP port 69 is trivially simple with no authentication and no encryption, useful on a trusted management segment for pushing an image, while FTP on TCP ports 20 and 21 authenticates but is still unencrypted. SCP runs file copy over the SSH session and is therefore the secure choice, and the copy command is the common front end to all of them.
Exam tip. SSH will not enable without a hostname, a domain name and generated crypto keys. Expect a question where the missing step is one of those three, and remember transport input ssh is what actually stops Telnet.