Network Management Services: SNMP, Syslog, TFTP/FTP, QoS

A central NMS (the manager) talks to an agent running on each device. Traffic flows both ways, and the distinction matters more than the details.

• Manager to agent — a get reads a value (interface counters, CPU, uptime), identified by an OID within the device's MIB, the structured catalogue of readable objects. A set writes a value, which is rarer and more dangerous.
• Agent to manager — a trap or inform is an unsolicited alert the agent raises when something happens, so the manager learns immediately rather than waiting for the next poll.

Every Syslog message carries a facility (the subsystem that generated it), a severity level, and a mnemonic (a short name for the event). Read %LINK-3-UPDOWN: Interface Gi0/1, changed state to down as facility LINK, severity 3, mnemonic UPDOWN.

Messages can go to several destinations at once: the console, the local logging buffer in RAM (read with show logging), a monitored VTY session via terminal monitor, or a central Syslog server for retention and correlation. That last one is exactly where NTP pays off — without synchronised clocks, timestamps from different devices cannot be lined up into a single story.

Both are driven from IOS with copy: copy running-config tftp backs the live config up to a server, and copy tftp flash pulls a new IOS image onto the device. TFTP's simplicity is also its weakness — no authentication, and UDP with no built-in reliability — so FTP, or secure SCP, is preferred wherever security or size matters.

QoS applies per-hop behaviour: how each device treats a packet as it passes through. When a link is congested, QoS decides whose traffic wins. The pipeline has four stages.

1. Classify — identify traffic, by ACL, by an incoming marking, or by NBAR application recognition.
2. Mark — stamp a value the rest of the path trusts: CoS (3 bits) in an 802.1Q tag at Layer 2, or DSCP (6 bits) in the IP header at Layer 3. Voice payload is marked EF (DSCP 46); voice signalling is CS3 (DSCP 24). Mark as close to the source as possible.
3. Queue — during congestion, scheduling picks the dequeue order. LLQ (Low Latency Queuing) gives voice a strict priority queue and is the CCNA gold standard for real-time traffic.
4. Police or shape — enforce a rate. Policing drops or re-marks the excess and is typically applied inbound; shaping buffers and delays the excess to smooth bursts and is typically applied outbound.

Two of the four services get a short, exam-relevant configuration. TFTP and FTP are a copy command, and QoS per-hop behaviour is describe-only at CCNA level.

! --- Syslog: timestamp messages and send Warning-and-worse to a server ---
R1(config)# service timestamps log datetime msec
R1(config)# logging host 10.10.20.15
R1(config)# logging trap warning

! --- SNMP: read-only monitoring for the NMS ---
R1(config)# snmp-server community CCNA-RO ro
R1(config)# snmp-server host 10.10.20.15 version 2c CCNA-RO

! --- Verify local logging ---
R1# show logging
Syslog logging: enabled
    Trap logging: level warnings, 42 message lines logged
    Logging to 10.10.20.15  (udp port 514, audit disabled)

! --- Back up the config off-box ---
R1# copy running-config tftp

• service timestamps log datetime msec puts a real date and time on each message so server-side correlation across devices works — this is where the NTP lesson pays off.
• logging trap warning sets the threshold to level 4, so levels 0 through 4 are sent and levels 5 through 7 are held back.
• snmp-server community CCNA-RO ro defines a read-only community: the NMS can poll but change nothing. In production you would prefer SNMPv3 for authenticated, encrypted access rather than a plaintext community.
• show logging confirms the destination and the threshold; Syslog rides UDP 514.

• SNMP is manager/agent: get polls, trap and inform alert; v2c is a plaintext community, v3 adds authentication and encryption.
• Syslog severity 0 to 7 with 0 Emergency most severe; each message carries a facility, severity, and mnemonic; a threshold sends that level and all lower numbers.
• TFTP is UDP 69 with no authentication; FTP is TCP 20/21 and authenticated; both move images and configs with copy.
• QoS per-hop behaviour: classify, mark (EF 46 voice, CS3 24 signalling), queue (LLQ for voice), then police (drop) or shape (buffer).
• QoS reallocates bandwidth; it never adds any.
• Config: logging host plus logging trap, service timestamps, and snmp-server community NAME ro.