4.3 NTP, SNMP, and Syslog

These three management services keep a network observable and time-consistent, and each carries a specific port number the exam will ask for.

NTP — Network Time Protocol

NTP synchronizes the system clocks of network devices over UDP 123. Accurate, common time matters for:

• Log correlation — matching an event across routers, switches, and firewalls.
• Certificate validation — TLS certificates have not-before/not-after windows; a wrong clock breaks them.
• Time-based authentication — Kerberos, RADIUS, and TACACS+ tolerate only small clock skew.
• Audit/compliance — timestamps must be trustworthy for forensics.

Stratum

Lower stratum = closer to the true source = more authoritative. A device picks the lowest reachable stratum.

R1(config)# ntp server 10.0.0.1          ! use this upstream source
R1(config)# ntp master 3                  ! act as a stratum-3 source if isolated
R1# show ntp status                       ! is the clock synchronized?
R1# show ntp associations                 ! peers and their stratum/offset

SNMP — Simple Network Management Protocol

SNMP lets a central station poll and manage devices. Components: the manager (e.g., SolarWinds, PRTG), the agent running on each device, the Management Information Base (MIB) — a tree of manageable objects, and the Object Identifier (OID) that names each object.

Operations and direction

Polls and SETs travel on UDP 161; traps and informs arrive on UDP 162. The key direction fact: GET/SET start at the manager, while TRAP/INFORM are pushed by the agent.

Version security

! v2c (insecure, still common in labs)
R1(config)# snmp-server community READONLY ro
R1(config)# snmp-server host 10.0.0.100 version 2c READONLY
! v3 (authenticated + encrypted)
R1(config)# snmp-server group GRP v3 priv
R1(config)# snmp-server user ADMIN GRP v3 auth sha MyAuthPass priv aes 128 MyPrivKey

The v3 keyword priv means authPriv (both authenticate and encrypt); auth means authNoPriv; noauth means neither.

Syslog

Syslog ships log messages to a central collector over UDP 514. The severity scale runs 0 (worst) to 7 (most verbose).

Mnemonic: "Every Awesome Cisco Engineer Will Need Ice-cream Daily" -> Emergency, Alert, Critical, Error, Warning, Notification, Informational, Debugging.

R1(config)# logging host 10.0.0.200
R1(config)# logging trap informational     ! send levels 0-6 to the server
R1(config)# logging console warnings       ! show 0-4 on the console
R1(config)# logging buffered 16384 debugging
R1(config)# service timestamps log datetime msec   ! pair with NTP for usable times

The crucial rule: setting a level captures that level and everything more severe (lower-numbered). logging trap informational (6) therefore forwards levels 0 through 6 but not debugging.

Reading a syslog message

A Cisco log line has a fixed shape: *Jun 14 10:32:01.123: %LINK-3-UPDOWN: Interface GigabitEthernet0/1, changed state to down. Decode it as timestamp, then %FACILITY-SEVERITY-MNEMONIC plus a description. The number in the middle (here 3) is the severity, so this is an Error-level event. Being able to extract severity from the %FACILITY-3-MNEMONIC format is a common exam micro-skill, and it is why service timestamps log datetime msec paired with NTP matters — without synchronized time the leading timestamp is useless for correlating across devices.

How These Three Work Together

These services reinforce one another in operations. NTP supplies the accurate clock; syslog stamps each event with that clock and ships it to a collector; SNMP polls health metrics and fires a trap the instant something crosses a threshold. During an outage you correlate the SNMP trap ("interface down at 10:32:01") with the matching syslog %LINK-3-UPDOWN on the neighbor, and because both clocks came from the same NTP source the timestamps line up to the millisecond. Break NTP and that whole workflow degrades into guesswork, which is exactly why the exam frames NTP as foundational rather than optional.

Security Notes

Management traffic is a juicy target, so the secure defaults matter. SNMPv2c community strings are the equivalent of a clear-text password that also doubles as the only access control, so a captured "public" or "private" string grants read or write to the device — always prefer SNMPv3 authPriv. NTP supports authentication keys (ntp authenticate plus ntp trusted-key) so a device only accepts time from a trusted source, preventing an attacker from skewing clocks to break certificates.

Syslog over plain UDP 514 is unauthenticated and can be spoofed, so high-security environments tunnel it or use TCP/TLS variants, though CCNA tests the classic UDP 514 fact.

On the exam: memorize the 0-7 scale, that v3 alone is secure, the GET/TRAP directions, the %FACILITY-SEVERITY-MNEMONIC log format, and the trio of ports — NTP 123, SNMP 161/162, Syslog 514.