Management services: NTP, SNMP, syslog and TFTP

NTP: the right time everywhere

NTP (Network Time Protocol) synchronises clocks over the network using UDP port 123. Correct time sounds boring until it is wrong: log messages from ten devices cannot be put in order if each clock says something different; certificates appear "not yet valid" or "expired", so HTTPS and VPNs fail; and logins with Kerberos or one-time codes fail when clocks drift by a few minutes.

NTP is arranged in strata (levels). Stratum 0 is a reference clock such as GPS or an atomic clock. A stratum 1 server is directly connected to one. A server that learns time from stratum 1 is stratum 2, and so on. Lower numbers are closer to the source. Stratum 16 means "not synchronised". In India, official time (IST) is maintained by the CSIR National Physical Laboratory in New Delhi.

R1(config)# ntp server 192.0.2.123
R1(config)# clock timezone IST 5 30
R1(config)# service timestamps log datetime msec localtime

R1# show ntp status
Clock is synchronized, stratum 3, reference is 192.0.2.123
R1# show ntp associations
R1# show clock

In a lab with no internet, ntp master 3 makes a router act as an authoritative time source at stratum 3 for the others.

SNMP: monitoring devices

SNMP (Simple Network Management Protocol) lets a monitoring system, the manager or NMS (network management station), talk to an agent running on each router, switch, firewall or printer. The agent keeps values such as interface traffic, CPU load and uptime in a structure called the MIB (management information base). Each value has an OID (object identifier), a dotted number such as 1.3.6.1.2.1.1.5.0, which is the device's name (sysName).

The agent listens on UDP port 161 for Get and Set requests; the manager listens on UDP port 162 for traps and informs. SNMPv2c protects access only with a community string, a shared word sent in clear text, so anyone capturing packets can read it. SNMPv3 adds users with authentication (proving who sent the message) and encryption (hiding its contents). Use v3 with the authPriv level wherever possible.

! SNMPv2c, read-only (simple, but the community travels in clear text)
R1(config)# snmp-server community NOC-view RO
R1(config)# snmp-server host 10.0.0.20 version 2c NOC-view
R1(config)# snmp-server enable traps
! SNMPv3 with authentication and encryption
R1(config)# snmp-server group NOCGROUP v3 priv
R1(config)# snmp-server user nocadmin NOCGROUP v3 auth sha <auth-password> priv aes 128 <priv-password>

Syslog: the device's diary

Devices write log messages about events: an interface going down, a neighbour lost, a login, a config change. By default they appear on the console. Syslog sends them to a central server over UDP port 514, so you can search the logs of every device in one place and keep them after a reboot. Each Cisco message has the form %FACILITY-SEVERITY-MNEMONIC: description.

*Oct 19 10:15:02.123: %LINK-3-UPDOWN: Interface GigabitEthernet0/1, changed state to down
*Oct 19 10:15:03.130: %LINEPROTO-5-UPDOWN: Line protocol on Interface GigabitEthernet0/1, changed state to down
*Oct 19 10:20:41.002: %SYS-5-CONFIG_I: Configured from console by admin on vty0 (10.0.0.50)

R1(config)# logging host 10.0.0.30
R1(config)# logging trap warnings
R1(config)# logging buffered 16384 informational
R1(config)# line console 0
R1(config-line)# logging synchronous
R1# show logging
R1# terminal monitor

Choosing a level means "this level and everything more serious". logging trap warnings sends 0, 1, 2, 3 and 4, but not notifications such as interface line protocol changes (level 5).

TFTP and FTP: moving files

TFTP (Trivial File Transfer Protocol, UDP port 69) is a very simple way to copy files with no login and no encryption. Network teams use it in labs and closed management networks to back up configurations and to load IOS images. FTP (TCP ports 20 and 21) adds a username and password, still unencrypted. SCP over SSH (TCP 22) is the safer choice on production networks.

R1# copy running-config tftp:
Address or name of remote host []? 10.0.0.30
Destination filename [r1-confg]? R1-2026-10-19.cfg
R1# copy tftp: flash:
R1# show flash: