Cisco CCNA Preparation · lesson 24 of 36 · 25 min
SNMP — Simple Network Management Protocol
SNMP is used to monitor and manage network devices. It operates on UDP port 161 (agent) and 162 (trap receiver). Three versions matter for CCNA:
SNMPv1/v2c — use community strings (plaintext passwords). ro = read-only, rw = read-write. Insecure — avoid in production.
SNMPv3 — adds authentication (MD5/SHA) and encryption (AES/DES). Three security levels: noAuthNoPriv (no auth, no encryption), authNoPriv (auth only), authPriv (auth + encryption). Use authPriv in production.
Key components: Manager (NMS — polls devices), Agent (runs on device, responds to polls), MIB (Management Information Base — database of variables), Trap (unsolicited alert from agent to manager).
Syslog — System Logging
Syslog sends log messages from network devices to a central syslog server (UDP port 514). Messages have a severity level (0–7) — lower number = more severe.
Config: logging host 10.0.0.100 (send to syslog server), logging trap warnings (send level 4 and below), logging buffered 16384 (buffer locally). Verify: show logging.
Mnemonic for levels 0–7: “Every Awful Cisco Engineer Will Need Daily Inspiration” (Emergency, Alert, Critical, Error, Warning, Notice, Debug, Informational — note: swap Debug/Informational for the actual order).
QoS — Quality of Service
QoS manages bandwidth, delay, jitter, and packet loss to prioritize critical traffic (voice, video) over less important traffic (bulk file transfers).
Classification and Marking — identify traffic and mark it. DSCP (Differentiated Services Code Point) is a 6-bit field in the IP header. Key DSCP values: EF (46) = voice (Expedited Forwarding), AF41 (34) = video, CS0 (0) = best effort. CoS (Class of Service) is the Layer 2 equivalent (802.1p, 3 bits in 802.1Q header).
Queuing — CBWFQ (Class-Based Weighted Fair Queuing) guarantees bandwidth per class. LLQ (Low Latency Queuing) adds a strict priority queue for voice — packets in the priority queue are always sent first.
Policing vs Shaping — Policing drops or re-marks traffic that exceeds the rate limit (causes TCP retransmits). Shaping buffers excess traffic and sends it later (smoother but adds delay). Shaping is preferred for TCP; policing for UDP.
Congestion Avoidance — WRED (Weighted Random Early Detection) drops packets before queues fill completely, preventing global synchronization of TCP flows.
QoS Trust Boundary
Mark traffic as close to the source as possible (at the access switch). IP phones mark their own traffic; the switch should trust the phone’s DSCP marking. Untrusted endpoints (PCs) should have their markings re-classified at the switch.
SSH and File Transfer (FTP/TFTP)
SSH (Secure Shell) — encrypted remote management on TCP port 22. Replaces Telnet (port 23, plaintext). CCNA SSH config: ip domain-name example.com → crypto key generate rsa modulus 2048 → ip ssh version 2 → line vty 0 4 → transport input ssh → login local.
TFTP (Trivial FTP) — UDP port 69, no authentication, used for IOS image transfers and config backups in trusted networks. Simple but insecure.
FTP — TCP ports 20 (data) and 21 (control), supports authentication. Used for IOS upgrades: copy ftp: flash:.
Key Terms
Key Terms
Knowledge Check — 12 Questions
IP Services — SNMP, Syslog, QoS, SSH
Which SNMPv3 security level provides both authentication and encryption?
- noAuthNoPriv
- authNoPriv
- authPriv
- privAuth
Answer: authPriv
authPriv provides authentication (MD5/SHA) and encryption (AES/DES) — the most secure SNMPv3 level.
SNMP traps are sent from the agent to the manager on which UDP port?
- 161
- 162
- 514
- 69
Answer: 162
SNMP agents listen on UDP 161; traps are sent to the NMS on UDP 162.
Which syslog severity level indicates an error condition?
- 0
- 2
- 3
- 5
Answer: 3
Severity 3 = Error. Levels 0–2 are Emergency, Alert, Critical. Level 4 is Warning.
Which DSCP value is used for voice traffic (Expedited Forwarding)?
- 0
- 34
- 46
- 48
Answer: 46
DSCP EF (Expedited Forwarding) = 46, used for voice traffic requiring guaranteed low latency and jitter.
What is the difference between QoS policing and shaping?
- Policing buffers excess traffic; shaping drops it
- Policing drops/re-marks excess traffic; shaping buffers it
- They are identical
- Shaping only works on ingress
Answer: Policing drops/re-marks excess traffic; shaping buffers it
Policing enforces rate limits by dropping or re-marking; shaping smooths traffic by buffering excess.
Which queuing mechanism adds a strict priority queue for voice traffic?
- FIFO
- WFQ
- CBWFQ
- LLQ
Answer: LLQ
LLQ (Low Latency Queuing) adds a strict priority queue to CBWFQ, ensuring voice packets are always sent first.
SSH uses TCP port _____.
Answer: 22
SSH operates on TCP port 22. Telnet uses TCP port 23 but is unencrypted.
Which command enables SSH version 2 on a Cisco router?
- ip ssh version 2
- ssh version 2
- crypto ssh version 2
- transport ssh version 2
Answer: ip ssh version 2
ip ssh version 2 restricts SSH to version 2, which is more secure than version 1.
TFTP uses which transport protocol and port?
- TCP 21
- TCP 69
- UDP 69
- UDP 514
Answer: UDP 69
TFTP uses UDP port 69 — it is connectionless and has no authentication.
SNMPv2c community strings are transmitted in plaintext.
- True
- False
Answer: True
SNMPv1 and v2c use community strings that are sent in cleartext — a significant security weakness.
Which command sends syslog messages to a remote server at 10.1.1.50?
- logging trap 10.1.1.50
- logging host 10.1.1.50
- syslog server 10.1.1.50
- ip syslog 10.1.1.50
Answer: logging host 10.1.1.50
logging host specifies the IP address of the remote syslog server.
WRED is used to:
- Encrypt traffic
- Prioritize voice over video
- Drop packets before queues fill to prevent global TCP synchronization
- Mark traffic with DSCP values
- Answer: Drop packets before queues fill to prevent global TCP synchronization
WRED proactively drops packets based on DSCP markings before queues overflow, preventing all TCP flows from backing off simultaneously.
Previous lesson: NAT (static and pool), DHCP client/relay, DNS role, NTP client/server mode
Back to Cisco CCNA Preparation
Next lesson: PAT (NAT overload): configuration, verification, troubleshooting