ExamFinch.com My Study

Study guide

4.3 NTP, SNMP, and Syslog

Practice this exam

Cisco Certified Network Associate CCNA

Track your progress as you read

Finished sections get a check mark.

1 Introduction

About the CCNA 200-301 Exam Domains and Weights Study Strategies and Tips

2 Chapter 1: Network Fundamentals (20%)

1.1 Network Components 1.2 Network Topology Architectures 1.3 Physical Interfaces and Cabling 1.4 TCP vs. UDP 1.5 IPv4 Addressing and Subnetting 1.6 IPv6 Addressing and Prefix 1.7 Wireless Principles 1.8 Virtualization Fundamentals 1.9 Switching Concepts 1.10 OSI and TCP/IP Reference Models 1.11 Verifying IP Parameters on Client Operating Systems

3 Chapter 2: Network Access (20%)

2.1 VLANs — Configuration and Verification 2.2 Trunking and 802.1Q 2.3 Layer 2 Discovery Protocols (CDP and LLDP) 2.4 EtherChannel (Link Aggregation) 2.5 Spanning Tree Protocol (STP) and RSTP 2.6 Wireless Architectures and AP Modes 2.7 Network Access Troubleshooting 2.8 Inter-VLAN Routing — Deep Dive

4 Chapter 3: IP Connectivity (25%)

3.1 Routing Table Components 3.2 Router Forwarding Decisions 3.3 IPv4 and IPv6 Static Routing 3.4 Single-Area OSPFv2 — Concepts 3.5 Single-Area OSPFv2 — Configuration 3.6 First Hop Redundancy Protocols (FHRP) 3.7 Troubleshooting IP Connectivity 3.8 OSPF Troubleshooting Scenarios

5 Chapter 4: IP Services (10%)

4.1 NAT (Network Address Translation) 4.2 DHCP and DNS 4.3 NTP, SNMP, and Syslog 4.4 QoS Fundamentals 4.5 TFTP/FTP and Remote Access 4.6 IP Services — Comprehensive Review

6 Chapter 5: Security Fundamentals (15%)

5.1 Key Security Concepts 5.2 Device Access Control and Password Policies 5.3 VPN Fundamentals 5.4 Access Control Lists (ACLs) 5.5 Layer 2 Security Features 5.6 Network Security Best Practices and Hardening 5.7 Threat Mitigation and Incident Response

7 Chapter 6: Automation and Programmability (10%)

6.1 Impact of Automation on Network Management 6.2 Controller-Based and Software-Defined Architectures 6.3 AI and Machine Learning in Network Operations 6.4 REST-Based APIs 6.5 Configuration Management Tools 6.6 JSON-Encoded Data 6.7 Automation and Programmability — Comprehensive Review

4.3 NTP, SNMP, and Syslog

Key Takeaways Explain This Topic AI

NTP synchronizes device clocks so logs, certificates, and time-based auth stay consistent; it uses UDP 123.

Lower NTP stratum means a more accurate source; stratum 1 sits directly on a stratum 0 reference, 16 means unsynchronized.

SNMP monitors devices via GET/SET (manager to agent) and TRAP/INFORM (agent to manager); UDP 161 polls, UDP 162 traps.

Only SNMPv3 provides authentication and encryption — v1 and v2c send community strings in clear text.

Syslog severity runs 0 Emergency to 7 Debugging; configuring a level sends that level and everything more severe.

Last updated: June 2026

These three management services keep a network observable and time-consistent, and each carries a specific port number the exam will ask for.

NTP — Network Time Protocol

NTP synchronizes the system clocks of network devices over UDP 123 . Accurate, common time matters for:

Log correlation — matching an event across routers, switches, and firewalls.

Certificate validation — TLS certificates have not-before/not-after windows; a wrong clock breaks them.

Time-based authentication — Kerberos, RADIUS, and TACACS+ tolerate only small clock skew.

Audit/compliance — timestamps must be trustworthy for forensics.

Stratum

  • Stratum Meaning
  • 0 The reference clock itself (atomic clock, GPS) — not a network device
  • 1 A server directly attached to a stratum 0 source
  • 2 Synchronizes to a stratum 1 server
  • 15 Maximum usable distance
  • 16 Unsynchronized / invalid

Lower stratum = closer to the true source = more authoritative. A device picks the lowest reachable stratum. R1(config)# ntp server 10.0.0.1 ! use this upstream source

R1(config)# ntp master 3 ! act as a stratum-3 source if isolated

R1# show ntp status ! is the clock synchronized?

  • R1# show ntp associations ! peers and their stratum/offset
  • SNMP — Simple Network Management Protocol

SNMP lets a central station poll and manage devices. Components: the manager (e.g., SolarWinds, PRTG), the agent running on each device, the Management Information Base (MIB) — a tree of manageable objects, and the Object Identifier (OID) that names each object.

Operations and direction

  • Operation Direction Purpose
  • GET / GET-NEXT Manager -> Agent Read one / next variable
  • GET-BULK Manager -> Agent Read many at once (v2c/v3)
  • SET Manager -> Agent Change a variable
  • TRAP Agent -> Manager Unsolicited alert, no ACK
  • INFORM Agent -> Manager Like TRAP, but acknowledged (v2c/v3)

Polls and SETs travel on UDP 161 ; traps and informs arrive on UDP 162 . The key direction fact: GET/SET start at the manager, while TRAP/INFORM are pushed by the agent.

Version security

  • Feature v1 v2c v3
  • Auth community string (clear) community string (clear) username + password (hashed)
  • Encryption none none DES/3DES/AES
  • GET-BULK / INFORM no yes yes
  • Verdict legacy common but insecure use this ! v2c (insecure, still common in labs)
  • R1(config)# snmp-server community READONLY ro
  • R1(config)# snmp-server host 10.0.0.100 version 2c READONLY
  • ! v3 (authenticated + encrypted)
  • R1(config)# snmp-server group GRP v3 priv
  • R1(config)# snmp-server user ADMIN GRP v3 auth sha MyAuthPass priv aes 128 MyPrivKey

The v3 keyword priv means authPriv (both authenticate and encrypt); auth means authNoPriv; noauth means neither.

Syslog

Syslog ships log messages to a central collector over UDP 514 . The severity scale runs 0 (worst) to 7 (most verbose).

  • Level Name Meaning Keyword
  • 0 Emergency System unusable emergencies
  • 1 Alert Act immediately alerts
  • 2 Critical Critical condition critical
  • 3 Error Error condition errors
  • 4 Warning Warning condition warnings
  • 5 Notification Normal but notable notifications
  • 6 Informational Informational informational
  • 7 Debugging Debug output debugging

Mnemonic: "Every Awesome Cisco Engineer Will Need Ice-cream Daily" -> Emergency, Alert, Critical, Error, Warning, Notification, Informational, Debugging. R1(config)# logging host 10.0.0.200

  • R1(config)# logging trap informational ! send levels 0-6 to the server
  • R1(config)# logging console warnings ! show 0-4 on the console
  • R1(config)# logging buffered 16384 debugging
  • R1(config)# service timestamps log datetime msec ! pair with NTP for usable times

The crucial rule: setting a level captures that level and everything more severe (lower-numbered) . logging trap informational (6) therefore forwards levels 0 through 6 but not debugging.

Reading a syslog message

A Cisco log line has a fixed shape: *Jun 14 10:32:01.123: %LINK-3-UPDOWN: Interface GigabitEthernet0/1, changed state to down . Decode it as timestamp , then %FACILITY-SEVERITY-MNEMONIC plus a description. The number in the middle (here 3 ) is the severity, so this is an Error-level event. Being able to extract severity from the %FACILITY-3-MNEMONIC format is a common exam micro-skill, and it is why service timestamps log datetime msec paired with NTP matters — without synchronized time the leading timestamp is useless for correlating across devices.

How These Three Work Together

These services reinforce one another in operations. NTP supplies the accurate clock; syslog stamps each event with that clock and ships it to a collector; SNMP polls health metrics and fires a trap the instant something crosses a threshold. During an outage you correlate the SNMP trap ("interface down at 10:32:01") with the matching syslog %LINK-3-UPDOWN on the neighbor, and because both clocks came from the same NTP source the timestamps line up to the millisecond. Break NTP and that whole workflow degrades into guesswork, which is exactly why the exam frames NTP as foundational rather than optional.

Security Notes

Management traffic is a juicy target, so the secure defaults matter. SNMPv2c community strings are the equivalent of a clear-text password that also doubles as the only access control, so a captured "public" or "private" string grants read or write to the device — always prefer SNMPv3 authPriv . NTP supports authentication keys ( ntp authenticate plus ntp trusted-key ) so a device only accepts time from a trusted source, preventing an attacker from skewing clocks to break certificates.

Syslog over plain UDP 514 is unauthenticated and can be spoofed, so high-security environments tunnel it or use TCP/TLS variants, though CCNA tests the classic UDP 514 fact.

On the exam: memorize the 0-7 scale, that v3 alone is secure, the GET/TRAP directions, the %FACILITY-SEVERITY-MNEMONIC log format, and the trio of ports — NTP 123, SNMP 161/162, Syslog 514.