IP Services: DHCP, DNS, NAT, SNMP and NTP

What it is

IP services are supporting protocols that give hosts addresses, names, translation, monitoring and the correct time.

Each one solves a different problem. DHCP hands out addresses, DNS finds addresses from names, NAT shares public addresses, SNMP monitors devices and NTP keeps clocks in step.

Applications rely on all five, so a fault in one often looks like an application fault.

How it works

Each service has its own message flow and port number.

DHCP

DHCP, the Dynamic Host Configuration Protocol, gives a host an IP address and other settings automatically. It uses UDP, with port 67 on the server and port 68 on the client.

The exchange has four steps, often called DORA:

1. Discover. The client broadcasts a request for a server.
2. Offer. A server offers an address.
3. Request. The client asks to use the offered address.
4. Acknowledge. The server confirms, and the client has a lease.

The lease also carries the subnet mask, default gateway and DNS servers. A client renews it before it expires. A relay agent, set with ip helper-address on a router interface, forwards broadcasts to a server on another network.

R1(config)# ip dhcp excluded-address 192.168.10.1 192.168.10.10
R1(config)# ip dhcp pool LAN10
R1(dhcp-config)# network 192.168.10.0 255.255.255.0
R1(dhcp-config)# default-router 192.168.10.1
R1(dhcp-config)# dns-server 192.0.2.53

DNS

DNS translates names into IP addresses. It uses UDP port 53, and TCP port 53 for large replies and zone transfers.

A host asks a resolver, which searches the DNS hierarchy and returns the answer. Records include A for IPv4, AAAA for IPv6, CNAME for an alias and MX for mail.

$ nslookup app.example
$ dig app.example

If a name will not resolve, nothing else works by name. Check DNS first when an IP address works but its name does not.

NAT

NAT, or Network Address Translation, rewrites IP addresses as packets cross a router. It lets many private hosts share a few public addresses.

PAT is the most common form. The router tracks each connection by address and port, and it uses the table to send replies back to the right host.

R1(config)# access-list 1 permit 192.168.10.0 0.0.0.255
R1(config)# ip nat inside source list 1 interface GigabitEthernet0/1 overload
R1(config)# interface GigabitEthernet0/0
R1(config-if)# ip nat inside
R1(config-if)# interface GigabitEthernet0/1
R1(config-if)# ip nat outside
R1# show ip nat translations

NAT hides private addresses, but it is not a firewall. It can also break protocols that carry addresses inside their data, and it stops outside hosts from starting connections to private hosts unless you add a static mapping.

SNMP

SNMP, the Simple Network Management Protocol, lets a management system monitor and manage devices. It uses UDP port 161 for requests and port 162 for traps.

• The manager is the management system.
• The agent runs on the device.
• The MIB is the database of values, each named by an object identifier, or OID.
• Operations include get, set and the trap, which is an unprompted alert from the agent.

Versions 1 and 2c use a community string, which works like a password sent in clear text. Version 3 adds authentication and encryption.

R1(config)# snmp-server community READONLYSTRING ro
R1(config)# snmp-server host 192.0.2.50 version 2c READONLYSTRING

Prefer SNMPv3 where it is supported.

NTP

NTP, the Network Time Protocol, synchronises device clocks. It uses UDP port 123.

Accurate time matters because logs from different devices must line up, certificates are valid only for a time period, and tokens and authentication often depend on time. NTP servers are arranged in strata, where stratum 0 is a reference clock and each step down adds one.

R1(config)# ntp server 192.0.2.123
R1# show ntp status
R1# show ntp associations

Summary