4.3 NTP, SNMP, and Syslog
Key Takeaways
- NTP synchronizes clocks across network devices — critical for log correlation, certificates, and troubleshooting.
- SNMP monitors and manages network devices using GET, SET, and TRAP operations.
- Syslog centralizes log messages from network devices with severity levels 0 (Emergency) to 7 (Debugging).
- SNMPv3 adds authentication and encryption — always use v3 for security.
- NTP uses UDP port 123; SNMP uses UDP 161/162; Syslog uses UDP 514.
NTP, SNMP, and Syslog
These three services are essential for network operations, monitoring, and troubleshooting.
NTP (Network Time Protocol)
NTP synchronizes the system clocks of network devices. Accurate time is critical for:
- Log correlation — matching events across devices during troubleshooting
- Certificate validation — TLS/SSL certificates have validity periods
- Authentication protocols — Kerberos, TACACS+, RADIUS depend on synchronized time
- Legal compliance — accurate timestamps for audit trails
NTP Concepts
| Term | Description |
|---|---|
| Stratum | Distance from the authoritative time source (stratum 0 = atomic clock) |
| Stratum 0 | Atomic clocks, GPS receivers |
| Stratum 1 | Servers directly connected to stratum 0 |
| Stratum 2 | Servers synchronized with stratum 1 |
| Stratum 15 | Maximum (stratum 16 = unsynchronized) |
Lower stratum = more accurate time source. NTP always synchronizes with the lowest available stratum.
NTP Configuration
Router(config)# ntp server 10.0.0.1 ! Point to NTP server
Router(config)# ntp server 10.0.0.2 ! Backup NTP server
Router(config)# ntp master 3 ! Configure this router as stratum 3 NTP server
Router# show ntp status ! Verify NTP synchronization
Router# show ntp associations ! Show NTP server relationships
Router# show clock ! Show current time
NTP uses UDP port 123.
SNMP (Simple Network Management Protocol)
SNMP enables centralized monitoring and management of network devices.
SNMP Components
| Component | Role |
|---|---|
| SNMP Manager | Central server that collects data (e.g., SolarWinds, PRTG, Nagios) |
| SNMP Agent | Software on each managed device that responds to queries |
| MIB | Management Information Base — database of manageable objects on the device |
| OID | Object Identifier — unique identifier for each managed variable |
SNMP Operations
| Operation | Direction | Description |
|---|---|---|
| GET | Manager → Agent | Read a specific MIB variable |
| GET-NEXT | Manager → Agent | Read the next variable in the MIB tree |
| GET-BULK | Manager → Agent | Read many variables at once (v2c/v3) |
| SET | Manager → Agent | Change a variable on the device |
| TRAP | Agent → Manager | Unsolicited alert from device (e.g., link down) |
| INFORM | Agent → Manager | Like TRAP but with acknowledgment (v2c/v3) |
SNMP Versions
| Feature | SNMPv1 | SNMPv2c | SNMPv3 |
|---|---|---|---|
| Authentication | Community string (plain text) | Community string (plain text) | Username/password (encrypted) |
| Encryption | None | None | DES, 3DES, AES |
| GET-BULK | No | Yes | Yes |
| INFORM | No | Yes | Yes |
| Security | Weak | Weak | Strong — always use v3 |
! SNMPv2c configuration
Router(config)# snmp-server community PUBLIC ro ! Read-only community string
Router(config)# snmp-server community PRIVATE rw ! Read-write community string
Router(config)# snmp-server host 10.0.0.100 PUBLIC ! Send traps to NMS
! SNMPv3 configuration
Router(config)# snmp-server group MYGROUP v3 priv
Router(config)# snmp-server user ADMIN MYGROUP v3 auth sha MyPass priv aes 128 MyKey
SNMP uses UDP port 161 (queries) and UDP port 162 (traps).
Syslog
Syslog is a standard protocol for sending log messages from network devices to a centralized log server.
Syslog Severity Levels
| Level | Name | Description | Keyword |
|---|---|---|---|
| 0 | Emergency | System is unusable | emergencies |
| 1 | Alert | Immediate action needed | alerts |
| 2 | Critical | Critical conditions | critical |
| 3 | Error | Error conditions | errors |
| 4 | Warning | Warning conditions | warnings |
| 5 | Notification | Normal but significant | notifications |
| 6 | Informational | Informational messages | informational |
| 7 | Debugging | Debug-level messages | debugging |
Memory trick: "Every Awesome Cisco Engineer Will Need Ice-cream Daily" → Emergency, Alert, Critical, Error, Warning, Notification, Informational, Debugging (0-7).
Syslog Configuration
Router(config)# logging host 10.0.0.200 ! Send logs to syslog server
Router(config)# logging trap informational ! Send levels 0-6 to server
Router(config)# logging console warnings ! Show levels 0-4 on console
Router(config)# logging buffered 16384 debugging ! Buffer levels 0-7 locally
Router(config)# service timestamps log datetime msec ! Add timestamps to logs
Syslog uses UDP port 514.
On the Exam: Memorize the syslog severity levels (0-7). A common question: "Which logging level should you set to see errors and all more critical messages?" Answer: Level 3 (error) — this captures levels 0 through 3.
What is the syslog severity level for "Warning" messages?
Which SNMP version provides authentication and encryption?
Which UDP port does NTP use?
An SNMP TRAP message is sent in which direction?
What NTP stratum level indicates the device is directly connected to an authoritative time source like an atomic clock?