Chapter 4: IP Services
Routers and switches forward packets, but a usable network needs more than forwarding. Somebody has to hand out IP addresses, turn names into addresses, share one public address among many private hosts, keep every clock in agreement, monitor device health, prioritize a voice call over a file download, and move IOS images around. Those jobs belong to the IP services: DHCP, DNS, NAT, NTP, SNMP, QoS, FTP, and TFTP. The 200-301 exam tests all of them, usually with scenario questions. This chapter teaches each service the way it behaves on a real network, with the CLI you will use on the job.
4.1 DHCP — Automatic Address Assignment
Hand-configuring addresses works for a dozen servers, not for a thousand laptops and phones that come and go. DHCP automates it: the client asks, the server answers, and the client receives an IP address, subnet mask, default gateway, DNS servers, and lease length in one exchange.
The DORA Process
A new client completes a four-message exchange with the server. Know each message's name, order, and direction:
- Discover — The client has no address, so it broadcasts from 0.0.0.0 to 255.255.255.255 (UDP: client port 68, server port 67). "Is there a DHCP server out there?"
- Offer — Each server that hears the Discover replies with an available address and lease terms.
- Request — The client picks one offer and announces its choice — as a broadcast, so the servers it did not pick can recycle their offered addresses.
- Acknowledge — The chosen server confirms the lease.
DORA = Discover, Offer, Request, Acknowledge. Discover and Request are broadcasts; Offer and Acknowledge are normally unicast. The exchange runs over UDP, ports 67 (server) and 68 (client).
Cisco loves asking why the Request is broadcast. Answer: so the servers whose offers were declined hear the decision and can put those addresses back in the pool.
Leases expire. The client tries to renew at 50% of the lease (T1 timer) by unicasting to the original server, and enters rebinding at 87.5% (T2), broadcasting to any server if the original never answered. Total silence means starting over at Discover.
DHCP Relay and the Helper Address
The Discover is a broadcast, and routers do not forward broadcasts — so how does a client reach a server three subnets away? The local router acts as a relay agent. Configure ip helper-address on the client-facing interface, pointing at the server's unicast address. The router converts the broadcast to unicast (stamping the client's subnet in the GIADDR field so the server picks the right pool) and relays the reply back.
Router(config)# interface GigabitEthernet0/0
Router(config-if)# ip helper-address 10.1.1.5Without ip helper-address, a DHCP broadcast dies at the router. One helper address also forwards other UDP broadcasts (TFTP, DNS, NTP) — a favorite exam detail.
Building a DHCP Pool on a Router
A Cisco router can be the server. Exclude addresses that must stay static (router interfaces, servers, printers), then define the pool:
Router(config)# ip dhcp excluded-address 192.168.10.1 192.168.10.10
Router(config)# ip dhcp pool OFFICE-LAN
Router(dhcp-config)# network 192.168.10.0 255.255.255.0
Router(dhcp-config)# default-router 192.168.10.1
Router(dhcp-config)# dns-server 8.8.8.8 8.8.4.4
Router(dhcp-config)# lease 7Verify with show ip dhcp binding and show ip dhcp pool.
DHCP pool sizing. A branch LAN uses 192.168.20.0/24. The router is .1, two servers use .2–.3, and printers keep .240–.249. How many addresses can DHCP hand out?
Step 1: A /24 holds 2^8 = 256 addresses. Step 2: Subtract network (.0) and broadcast (.255): 256 − 2 = 254 usable. Step 3: Subtract static addresses: .1 + .2–.3 + .240–.249 = 13. Step 4: 254 − 13 = 241.
Final answer: 241 addresses (exclude 192.168.20.1–192.168.20.3 and 192.168.20.240–192.168.20.249).
A workstation's lease shows 4 hours, but the pool is configured with lease 7. Give one likely reason.
Show solution
lease 7 means 7 days, not hours — the pool is fine. The 4-hour lease probably came from a different DHCP server (a rogue server, or a second pool the client reached first), or the lease length was changed after this client bound and it has not renewed yet. Remember: lease takes days, hours, minutes — lease 0 4 0 is 4 hours.
DHCP Snooping: Stopping Rogue Servers
Any device can claim to be a DHCP server — an attacker, or a misconfigured home router someone plugged in — and hand out a bogus gateway to redirect traffic. DHCP snooping is the Layer 2 defense. The switch marks each port trusted (facing the real server) or untrusted (facing users; the default). DHCP server messages (Offer, Acknowledge) arriving on an untrusted port are dropped.
Snooping also builds a binding table — MAC, IP, lease time, VLAN, interface per client — which Dynamic ARP Inspection and IP Source Guard reuse to catch spoofing.
Switch(config)# ip dhcp snooping
Switch(config)# ip dhcp snooping vlan 10
Switch(config)# interface GigabitEthernet0/1
Switch(config-if)# ip dhcp snooping trustClients get nothing after snooping is enabled? The classic cause is forgetting to mark the uplink toward the DHCP server as trusted. Untrusted is the default on every port.
4.2 DNS — Names Into Addresses
DNS translates human names into IP addresses through a distributed hierarchy. Your PC sends a recursive query to its resolver ("do the work, bring me the answer"); the resolver walks the tree iteratively: root servers → TLD servers → the domain's authoritative server. Every level caches, so the second lookup is instant. DNS normally uses UDP port 53, switching to TCP 53 for zone transfers and oversized responses.
Record Types You Must Know
| Record | Purpose |
|---|---|
| A | Hostname → IPv4 address |
| AAAA | Hostname → IPv6 address |
| CNAME | Alias: one name → another name |
| MX | Mail exchanger for a domain |
| PTR | Reverse lookup: IP → hostname |
| NS / SOA | Name servers and zone authority |
A = IPv4, AAAA = IPv6, CNAME = alias, MX = mail, PTR = reverse. A question about email delivery points at MX almost every time.
Enterprises run internal DNS for private names and forward internet queries upstream. Cisco devices use DNS too: ip name-server 8.8.8.8 lets you ping hostnames from the CLI (lookup is on by default via ip domain-lookup). If the router hangs "resolving" every typo, break out with Ctrl+Shift+6 — or disable lookup in the lab with no ip domain-lookup.
A spam filter rejects incoming mail, logging "no PTR record for sender." The mail admin insists the MX record is correct. Who is right?
Show solution
Both, about different things. The MX record routes mail to the domain — it can be perfect. The PTR record is the reverse lookup (IP → hostname) of the sending server's IP, which receivers check to fight spam. The fix belongs to whoever owns the sending IP block: create the PTR record there. Lesson: MX is forward mail routing; PTR is reverse identity.
4.3 NAT — Stretching IPv4
Public IPv4 addresses ran out years ago. NAT lets a whole private network share one (or a few) public addresses. Private ranges — 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16 — are not routable on the internet, so the edge router rewrites addresses at the boundary.
The Four NAT Terms
| Term | Meaning |
|---|---|
| Inside local | Private address as the internal host knows itself (192.168.1.10) |
| Inside global | Public address representing that host to the outside (203.0.113.5) |
| Outside local | External host's address as seen from inside (usually its real address) |
| Outside global | External host's real public address (198.51.100.77) |
"Inside/outside" = which side of your router the host sits on. "Local/global" = whether you view the address from inside your network or from the internet. Inside local is the only private one in a basic setup.
Static NAT, Dynamic NAT, and PAT
| Type | Mapping | Use case |
|---|---|---|
| Static NAT | One private ↔ one public, permanent, bidirectional | A web server outsiders must reach at a fixed public IP |
| Dynamic NAT | Private ↔ a pool of public addresses, one-to-one but temporary | Several public IPs shared by fewer simultaneous users |
| PAT (overload) | Many private → one public address, separated by port numbers | A branch router sharing a single ISP address |
PAT is the home-router trick: TCP/UDP conversations are unique by port, so the router multiplexes hundreds of inside hosts onto one public IP. Hosts 192.168.1.10:53421 and 192.168.1.11:53421 both leave as 203.0.113.5, rewritten to 203.0.113.5:1024 and 203.0.113.5:1025. Return traffic is demultiplexed by port.
PAT walkthrough. A branch router's outside address is 203.0.113.9. Three inside hosts open web sessions at once. Build the table:
Step 1: Host A (10.1.1.5:49152) → router picks unused global port 1024: 10.1.1.5:49152 → 203.0.113.9:1024.
Step 2: Host B (10.1.1.6:49152) → must differ: port 1025: 10.1.1.6:49152 → 203.0.113.9:1025.
Step 3: Host B opens a second tab (10.1.1.6:49153) → port 1026: 10.1.1.6:49153 → 203.0.113.9:1026.
Step 4: Return traffic to 203.0.113.9:1025 is rewritten to 10.1.1.6:49152 via the table in reverse.
Final answer: three conversations share 203.0.113.9, kept distinct by global ports 1024–1026. Port-multiplexing is the entire trick of PAT.
NAT Order of Operations
Inside-to-outside: NAT first, then route — the source must become the inside global address before the forwarding decision. Outside-to-inside: route first, then NAT — the router forwards on the public destination, then rewrites it to the inside local address. Cisco asks "which happens first" about NAT more than anything else in this topic.
Configuring NAT and PAT
Mark each interface's role, then define the rule:
Router(config)# interface GigabitEthernet0/0
Router(config-if)# ip nat inside
Router(config-if)# interface GigabitEthernet0/1
Router(config-if)# ip nat outside
Router(config)# access-list 1 permit 192.168.1.0 0.0.0.255
Router(config)# ip nat inside source list 1 interface GigabitEthernet0/1 overloadThat last line is the workhorse: everything matching ACL 1 is PAT-translated to the outside interface's address. For a pool, add ip nat pool PUBLIC 203.0.113.10 203.0.113.20 netmask 255.255.255.0 and reference it (with overload for PAT, without for dynamic NAT). Static NAT is one line: ip nat inside source static 192.168.1.10 203.0.113.5. Verify with show ip nat translations and show ip nat statistics.
show ip nat translations shows tcp 203.0.113.5:80 192.168.1.10:80 and tcp 203.0.113.5:443 192.168.1.11:443. Static, dynamic, or PAT — and how do you know?
Show solution
Static NAT. PAT multiplexes many hosts onto one address with ephemeral, varying ports; dynamic NAT draws from a pool. Here one public IP maps fixed service ports (80, 443) to fixed inside servers — a permanent one-to-one service mapping, i.e., static NAT port-forwarding to publish internal servers.
4.4 NTP — One Clock for the Whole Network
Reconstructing an incident from five devices' logs is fiction if their clocks disagree. NTP synchronizes clocks network-wide over UDP port 123. Time sources form strata: stratum 0 is the reference clock itself (atomic clock, GPS — never on the network); stratum 1 syncs directly to it, stratum 2 to stratum 1, down to 15. Stratum 16 means unsynchronized. Clients always sync to a lower (more authoritative) stratum number.
Router(config)# ntp server 10.1.1.1
Router(config)# ntp master 3The first line points at a server; the second makes this router a server advertising stratum 3. Check with show ntp status and show ntp associations.
Beyond logging, drifting clocks silently break certificate validation, Kerberos logins, and scheduled jobs. "Nobody can log in and nothing changed" is a time problem more often than beginners expect.
4.5 SNMP — Monitoring the Network
SNMP lets one station watch hundreds of devices. Three roles: the manager (NMS) polls and receives alerts; the agent (software on each device) answers; the MIB (Management Information Base) is the agent's database of manageable objects — interface counters, CPU, temperature — each addressed by an OID. Routine polling uses UDP 161; urgent agent-initiated alerts (traps) go to the manager on UDP 162.
SNMP Versions
| v1 | v2c | v3 | |
|---|---|---|---|
| Authentication | Community string, plaintext | Community string, plaintext | Username + auth (MD5/SHA) |
| Encryption | None | None | Privacy (DES/AES) |
| Bulk retrieval | No | Yes (GetBulk) | Yes |
| Security levels | — | — | noAuthNoPriv / authNoPriv / authPriv |
The exam contrast is always the same: v1/v2c use community strings ("public"/"private") in cleartext; v3 adds real authentication and encryption, and authPriv is the only acceptable "secure" answer. Acknowledged notifications are informs (v2c/v3), not traps.
Router(config)# snmp-server group NETADMIN v3 priv
Router(config)# snmp-server user monitor1 NETADMIN v3 auth sha AuthPass!23 priv aes 128 PrivPass!23
Router(config)# snmp-server host 192.168.100.50 version 3 priv monitor1
Router(config)# snmp-server enable traps
4.6 QoS Concepts — Treating Traffic Unequally (On Purpose)
Best-effort delivery treats every packet alike — fine for email, fatal for voice, where 200 ms of extra delay, variation in delay (jitter), or dropped packets (loss) ruins a call. QoS prioritizes traffic that cannot wait.
Classification and Marking
First recognize traffic classes (classification), then label packets so downstream devices honor the decision without re-classifying (marking):
- DSCP (6 bits in the IP ToS byte): EF (46) = voice, AFxy = tiered business data, CS = backward-compatible with old IP Precedence.
- CoS (3 bits in the 802.1Q tag): Layer 2 only — lost when the frame leaves the VLAN.
Marking happens at the trust boundary — typically the access switch, which trusts an IP phone's markings but re-marks anything from a PC port.
Classification = identifying traffic. Marking = labeling it (DSCP at Layer 3, CoS at Layer 2). The exam swaps these two words to see if you notice.
Congestion Management vs. Avoidance
| Mechanism | Job | Examples |
|---|---|---|
| Congestion management (queuing) | Which packet goes next when the link is full | FIFO, Priority Queuing, WFQ, CBWFQ, LLQ |
| Congestion avoidance | Drops packets early so TCP senders slow down before the queue overflows | RED, WRED |
LLQ is the voice answer: a strict-priority queue for EF-marked voice on top of CBWFQ — voice jumps the line without starving everything else. WRED drops lower-priority TCP packets randomly before the queue fills; the randomness prevents global synchronization, where all TCP flows back off and surge in lockstep.
Policing vs. Shaping
| Policing | Shaping | |
|---|---|---|
| Excess traffic | Dropped (or remarked down) | Buffered and delayed |
| Extra memory needed | No | Yes |
| Adds delay | No | Yes |
One-word discriminator: policing drops, shaping delays. A buffer holding packets for later = shaping. Packets disappearing or marked down = policing.
Voice stutters on a 10 Mbps branch link whenever a file transfer starts. The engineer guarantees voice transmits first and caps the transfer at 6 Mbps by discarding anything above it. Name the mechanisms.
Show solution
LLQ (priority queue for EF-marked voice) plus policing on the file-transfer class — the excess is discarded, and discarding is policing's signature; shaping would have queued it. DSCP classification underpins both.
4.7 FTP and TFTP — Moving Files Around
Engineers constantly move IOS images and config files. Two protocols do the hauling:
- FTP: TCP 20 (data) / 21 (control), username/password required, directory listings. Use it when reliability and authentication matter.
- TFTP: UDP 69, no authentication, no listings, tiny footprint. Simple enough to live in a bootloader — which is why devices use it for IOS upgrades, config backups (
copy running-config tftp:), and PXE booting.
No OS loaded yet (bootloader, PXE)? The answer is TFTP — FTP's login cannot work there. Credentials or large reliable transfers? FTP.
End-of-Chapter Test
- A. Discover, because the client still has no IP address
- B. Request, broadcast so the servers whose offers were declined can recycle their addresses
- C. Acknowledge, broadcast to confirm the lease to all servers
- D. Request, broadcast because routers cannot forward DHCP unicasts
- A.
ip dhcp poolwith network 10.10.10.0 - B.
ip helper-address 10.10.10.10 - C.
ip dhcp excluded-address 10.10.10.10 - D.
ip dhcp snooping trust
- A. The DHCP pool is exhausted
- B. The uplink toward the DHCP server was not marked trusted
- C. All clients' T1 timers expired simultaneously
- D. Option 82 stripped the GIADDR field
- A. A
- B. PTR
- C. CNAME
- D. MX
tcp 203.0.113.8:23110 10.4.4.4:443 and tcp 203.0.113.8:23111 10.4.4.9:443. Which is true?
- A. Static NAT, because the inside addresses are fixed
- B. PAT, because multiple inside hosts share one global address on different ports
- C. Dynamic NAT, because the ports increment
- D. 203.0.113.8 is the inside local address
- A. Route first, then translate the source
- B. Translate the source first, then route
- C. They happen simultaneously in one lookup
- D. Translate the destination first, then route
show ntp status reports stratum 16. What does it mean?
- A. The client is 16 hops from the reference clock
- B. An access list is blocking NTP packets
- C. The clock is unsynchronized
- D. The server is a stratum 0 atomic clock
- A. SNMPv2c with community "private"
- B. SNMPv3 with authPriv
- C. SNMPv1 with GetBulk
- D. SNMPv2c with informs instead of traps
- A. Policing
- B. Shaping
- C. WRED
- D. Priority queuing
- A. FTP on TCP 21, using the enable secret
- B. TFTP on UDP 69, because it needs no authentication
- C. SNMP on UDP 161, via MIB transfer
- D. NTP on UDP 123, during the window
---