CCNA Network Services: NTP, SNMP, Syslog, QoS

NTP and Time Synchronisation

Logs, certificates, scheduled jobs and troubleshooting all depend on clocks agreeing, which is what NTP provides. NTP organises time sources into strata: stratum 0 is the reference clock itself (atomic clock, GPS), stratum 1 servers sync directly to it, stratum 2 syncs to stratum 1, and so on — each level adds 1. A device always prefers the lowest stratum number (closest to the source), and stratum 16 means unsynchronised.

Client configuration is minimal: ntp server 192.0.2.1 (or a public pool). Harden it with authentication so a rogue server can't feed you false time: define ntp authentication-key 1 md5 <key>, mark it ntp trusted-key 1, and enable ntp authenticate — the server needs the matching key. A router can serve time downstream with ntp master 3 (claiming stratum 3).

Verify with show ntp status (look for "Clock is synchronized" and the stratum) and show ntp associations (the * marks the chosen peer). If sync never happens, check reachability (UDP 123 both ways — ACLs blocking it are a classic), wildly wrong local time (NTP won't slew huge offsets; set the clock close first), and mismatched authentication keys.

SNMP and Syslog

SNMP is how management stations monitor devices: the manager polls agents on the devices, and agents send unsolicited traps (fire-and-forget UDP) or informs (acknowledged) when something happens. Version choice matters for the exam: SNMPv2c uses community strings sent in clear text (essentially a password anyone sniffing can read) — snmp-server community <string> RO. SNMPv3 adds real security with authentication (auth) and encryption (priv) — always the right answer when a question asks for the secure option. Ports: agent on UDP 161, traps to UDP 162.

Syslog is the device's diary — every interesting event gets a severity-stamped message. Memorise the scale, because lower is worse: 0 Emergency, 1 Alert, 2 Critical, 3 Error, 4 Warning, 5 Notice, 6 Informational, 7 Debug. A favourite mnemonic runs E-A-C-E-W-N-I-D ("every actor chews every wafer nightly in December" is overkill — just drill 0–7). Setting logging trap warnings sends severity 0–4 to the syslog server; the default trap level is informational (6).

Direct logs with logging host 192.0.2.10 and check what's happening locally with show logging. Each message carries a sequence number, timestamp, facility-severity mnemonic and description — timestamps are only useful if NTP is working, which ties the topics together. When a question asks which severity includes errors but not debugging, count carefully: 0–3 covers emergency through error.

QoS Fundamentals

QoS (Quality of Service) doesn't create bandwidth — it decides who suffers when bandwidth runs out. The pipeline is: classify traffic (what is this?), mark it (stamp a priority value near the source), then queue and schedule it on congested links according to policy. Marking happens once, at the trust boundary (usually the access switch); downstream devices trust the marking instead of re-classifying.

Marking values to know: CoS (Class of Service, 3 bits in the 802.1Q tag — Layer 2 only) and DSCP (Differentiated Services Code Point, 6 bits in the IP header — end-to-end). Voice is the textbook example: marked EF (Expedited Forwarding, DSCP 46) and given strict priority queuing with low latency, because humans notice 150 ms of delay on a call but not on an email.

Congestion management uses queuing (priority queuing for voice, weighted fair queuing for the rest), while policing drops excess traffic and shaping buffers and delays it — remember "police drops, shape waits". The CCNA tests concepts, not MQC configuration: know the pipeline order, the trust boundary, EF for voice, and policing vs shaping. Congestion avoidance (WRED, dropping TCP early to prevent tail-drop synchronisation) is worth recognising by name.

Related CCNA study guides

• CCNA Automation and Programmability
• CCNA DHCP and DNS
• CCNA Routing Fundamentals
• CCNA OSPF Explained

Frequently asked questions