Overview
IP Services is 10% of the CCNA, nine objectives covering the network services that support connectivity. It covers configuring and verifying inside source NAT with static entries and pools; NTP in client and server mode for time synchronization; the role of DHCP and DNS; the function of SNMP in network operations; syslog features including facilities and severity levels; configuring DHCP client and relay; QoS per-hop behavior including classification, marking, queuing, congestion, policing and shaping; configuring SSH for secure remote access; and the capabilities of TFTP and FTP.
The questions here are broad but shallower than the routing domain. The exam rewards knowing exactly what each service does and how to verify it, without going down rabbit holes. Two memorization tables carry many points: the syslog severity levels and the QoS marking concepts. Knowing each service's purpose and configuration efficiently is the goal.
How it's tested
CCNA questions in this domain describe a service need and ask which service, configuration or value fits, sometimes as a simulation for NAT, NTP, DHCP or SSH. Check whether the item asks what a service does or how to verify it, since many answers hinge on the right show command or syslog severity value.
-
Which service
A support need is described, and you choose NAT, NTP, DHCP, DNS, SNMP or syslog.
-
Configure and verify
A configuration need is described, and you configure NAT, NTP, DHCP relay or SSH.
-
Values and behavior
A syslog or QoS need is described, and you identify the severity level or QoS mechanism.
Internal hosts with private addresses must access the internet, which does not route private addresses. Doing nothing leaves them unreachable externally. Configuring inside source NAT translates the private source addresses to a public address (or pool) as traffic leaves, allowing the hosts to communicate with the internet and return traffic to be translated back, which is the NAT service the exam expects for private-to-public access.
Domains 9
Official domains from the Cisco outline, in outline order.
4.1 Configure and verify inside source NAT using static and poolsStatic NAT and NAT pools.
- What it means
- This covers configuring and verifying inside source network address translation: static NAT mapping one private address to one public address, and dynamic NAT using a pool of public addresses, translating internal private addresses for external communication.
- What to understand
- Inside source NAT translates private internal addresses to public addresses as traffic leaves the network. Static NAT is a fixed one-to-one mapping, useful for servers, while a pool provides dynamic mappings. PAT (overload) maps many private addresses to one public address using ports. Configuring and verifying NAT is tested, sometimes as a simulation.
- How it shows up
- A private-to-public access need is described, and you must configure or verify the NAT type.
- Common confusion
- Confusing static NAT with a NAT pool, or either with PAT (overload).
4.2 Configure and verify NTP operating in client and server modeNetwork Time Protocol synchronization.
- What it means
- This covers configuring and verifying the Network Time Protocol in client and server mode, so devices synchronize their clocks, which is important for logging, certificates and troubleshooting.
- What to understand
- NTP keeps device clocks synchronized to a reliable time source, which matters because accurate timestamps are essential for correlating logs and for time-sensitive security functions. A device can act as an NTP client, server, or both. Configuring and verifying NTP is a straightforward, tested task.
- How it shows up
- A time-synchronization need is described, and you must configure or verify NTP.
- Common confusion
- Overlooking why accurate time matters, or confusing client and server roles.
4.3 Explain the role of DHCP and DNS within the networkAddress assignment and name resolution.
- What it means
- This covers the roles of DHCP, which automatically assigns IP addresses and options to hosts, and DNS, which resolves names to IP addresses, as two distinct, essential network services.
- What to understand
- DHCP automates address configuration, assigning addresses, masks, gateways and DNS servers to clients, while DNS translates human-readable names into IP addresses. They are separate services with different roles, and many connectivity problems trace to one or the other. Knowing each role is foundational.
- How it shows up
- An address-assignment or name-resolution need is described, and you must identify DHCP or DNS.
- Common confusion
- Confusing the roles of DHCP (address assignment) and DNS (name resolution).
4.4 Explain the function of SNMP in network operationsMonitoring and managing devices.
- What it means
- This covers the function of the Simple Network Management Protocol: polling and monitoring network devices, collecting metrics, and receiving traps for events, as part of network management.
- What to understand
- SNMP lets a management system poll devices for status and performance and receive trap notifications of events. It is central to monitoring device health. Understanding its role in operations, and the idea of managers, agents and traps, is the expected knowledge.
- How it shows up
- A monitoring need is described, and you must identify SNMP's function.
- Common confusion
- Confusing SNMP monitoring with syslog logging; SNMP polls status, while syslog records event messages.
4.5 Describe the use of syslog features including facilities and severity levelsSyslog facilities and the severity scale.
- What it means
- This covers syslog features: logging event messages from devices, the facilities that categorize messages, and the severity levels from 0 (emergency) to 7 (debug) that indicate importance.
- What to understand
- Syslog centralizes device log messages, each tagged with a severity from 0 (emergency) through 7 (debugging), so administrators can filter by importance. Knowing the severity scale, lower numbers are more severe, is a high-yield memorization point frequently tested.
- How it shows up
- A logging need or severity is described, and you must identify the syslog level or feature.
- Common confusion
- Misremembering the severity scale, where 0 is most severe and 7 is least.
4.6 Configure and verify DHCP client and relayDHCP client configuration and relay with ip helper-address.
- What it means
- This covers configuring and verifying a device as a DHCP client, and configuring DHCP relay so that DHCP requests are forwarded across subnets to a central DHCP server, typically using ip helper-address.
- What to understand
- A router interface can obtain its address as a DHCP client, and when clients are on a different subnet from the DHCP server, a relay (ip helper-address) forwards their broadcast requests to the server. Configuring relay correctly is a common, tested task because DHCP broadcasts do not cross routers by default.
- How it shows up
- A DHCP configuration need is described, and you must configure the client or relay.
- Common confusion
- Forgetting that DHCP broadcasts need a relay (ip helper-address) to cross subnets to a central server.
4.7 Explain the forwarding per-hop behavior for QoSClassification, marking, queuing, congestion, policing and shaping.
- What it means
- This covers quality of service per-hop behavior: classification and marking of traffic, queuing, congestion management and avoidance, and policing versus shaping, to prioritize important traffic.
- What to understand
- QoS prioritizes traffic so latency-sensitive flows like voice are served first. Traffic is classified and marked, queued by priority, and managed under congestion. Policing drops or remarks traffic exceeding a rate, while shaping buffers and delays it. Understanding these per-hop behaviors and the policing-versus-shaping distinction is the key knowledge.
- How it shows up
- A traffic-prioritization need is described, and you must identify the QoS mechanism.
- Common confusion
- Confusing policing (drops or remarks excess) with shaping (buffers and delays excess).
4.8 Configure network devices for remote access using SSHSecure remote management with SSH.
- What it means
- This covers configuring network devices for secure remote access using SSH, including generating keys, enabling SSH, and requiring it over insecure Telnet for management sessions.
- What to understand
- SSH encrypts remote management sessions, protecting credentials and commands, and should replace Telnet. Configuring SSH involves a hostname and domain name, generating RSA keys, creating local users, and restricting the VTY lines to SSH. This is a common, tested configuration task.
- How it shows up
- A secure remote-access need is described, and you must configure SSH.
- Common confusion
- Leaving Telnet enabled, or omitting a required step such as key generation when configuring SSH.
4.9 Describe the capabilities and functions of TFTP and FTPFile transfer protocols for network devices.
- What it means
- This covers the capabilities of TFTP and FTP in the network: transferring files such as device configurations and IOS images, with TFTP being simple and connectionless and FTP more capable with authentication.
- What to understand
- TFTP is a lightweight, connectionless file transfer protocol often used for backing up configurations and loading IOS images, while FTP is more full-featured with authentication and directory operations. Knowing their roles and differences for managing device files is the expected knowledge.
- How it shows up
- A file-transfer need is described, and you must choose TFTP or FTP.
- Common confusion
- Confusing TFTP (simple, connectionless) with FTP (authenticated, connection-oriented).
High-yield concepts
The terms, rules and formulas this domain turns into questions most often.
-
Inside source NAT
Translates private to public addresses.
- Remember
- Static, pool, or overload (PAT).
- Tested as
- NAT questions.
- Trap
- Confusing the NAT types.
-
PAT (overload)
Many private addresses to one public via ports.
- Remember
- Conserves public addresses.
- Tested as
- NAT questions.
- Trap
- Confusing with static NAT.
-
NTP
Synchronizes device clocks.
- Remember
- Accurate time aids logging and security.
- Tested as
- NTP questions.
- Trap
- Overlooking why time matters.
-
DHCP vs. DNS
Address assignment versus name resolution.
- Remember
- Distinct services.
- Tested as
- Service questions.
- Trap
- Confusing the roles.
-
DHCP relay
Forwards DHCP across subnets.
- Remember
- Uses ip helper-address.
- Tested as
- DHCP questions.
- Trap
- Forgetting the relay.
-
SNMP
Polls and monitors devices.
- Remember
- Managers, agents and traps.
- Tested as
- Monitoring questions.
- Trap
- Confusing with syslog.
-
Syslog severity levels
0 emergency to 7 debug.
- Remember
- Lower is more severe.
- Tested as
- Syslog questions.
- Trap
- Misremembering the scale.
-
QoS classification and marking
Identify and tag traffic by priority.
- Remember
- Foundation of QoS.
- Tested as
- QoS questions.
- Trap
- Skipping classification.
-
Policing vs. shaping
Drop or remark versus buffer and delay.
- Remember
- Shaping smooths, policing enforces.
- Tested as
- QoS questions.
- Trap
- Confusing the two.
-
SSH
Encrypted remote management.
- Remember
- Replaces insecure Telnet.
- Tested as
- Access questions.
- Trap
- Leaving Telnet enabled.
-
TFTP vs. FTP
Simple connectionless versus authenticated.
- Remember
- For device file transfers.
- Tested as
- File transfer questions.
- Trap
- Confusing the two.
Side by side
Concepts candidates mix up, compared on the point that decides the answer.
Static NAT vs. pool vs. PAT
| Concept | Meaning | Key difference | Common trap |
|---|---|---|---|
| Static NAT | One-to-one fixed mapping | For servers | Confusing with a pool |
| NAT pool | Dynamic from a range | Many internal hosts | Confusing with PAT |
| PAT (overload) | Many to one via ports | Conserves addresses | Confusing with static |
SNMP vs. syslog
| Concept | Meaning | Key difference | Common trap |
|---|---|---|---|
| SNMP | Polls status and metrics | Device monitoring | Confusing with syslog |
| Syslog | Records event messages | Logging with severity | Confusing with SNMP |
Policing vs. shaping
| Concept | Meaning | Key difference | Common trap |
|---|---|---|---|
| Policing | Drops or remarks excess | Enforces a rate | Confusing with shaping |
| Shaping | Buffers and delays excess | Smooths traffic | Confusing with policing |
Exam traps
Each trap is an answer that looks right. Learn the clue that should change your mind.
-
Private address reaches internet
- What candidates pick
- Expect internal private-addressed hosts to reach the internet without translation.
- Why it looks right
- They have valid addresses.
- Why it's wrong
- Private addresses are not internet-routable; inside source NAT translates them to a public address.
Clue to watch for Internal hosts must access the public internet.
-
DHCP crosses routers
- What candidates pick
- Expect DHCP broadcasts to reach a server on another subnet without a relay.
- Why it looks right
- DHCP assigns addresses network-wide.
- Why it's wrong
- DHCP requests are broadcasts that do not cross routers; a DHCP relay (ip helper-address) forwards them to the server.
Clue to watch for Clients and the DHCP server are on different subnets.
-
SNMP for event logs
- What candidates pick
- Use SNMP to collect detailed event log messages from devices.
- Why it looks right
- Both are management tools.
- Why it's wrong
- SNMP polls status and metrics; syslog records event log messages with severity levels.
Clue to watch for The need is event messages versus polled status.
-
Severity 7 is most severe
- What candidates pick
- Treat syslog severity level 7 as the most critical.
- Why it looks right
- Higher numbers seem more important.
- Why it's wrong
- Syslog severity 0 (emergency) is most severe and 7 (debug) is least; lower numbers are more severe.
Clue to watch for The question asks about the most or least severe level.
-
Shaping drops excess
- What candidates pick
- Describe traffic shaping as dropping packets that exceed the rate.
- Why it looks right
- Both limit traffic.
- Why it's wrong
- Shaping buffers and delays excess traffic to smooth it; policing drops or remarks excess.
Clue to watch for The mechanism buffers versus drops excess traffic.
Answer framework
For any Domain 4 scenario, use these steps to find the answer CCNA expects.
- Identify which service the need calls for: NAT, NTP, DHCP, DNS, SNMP, syslog, QoS, SSH or file transfer.
- For private-to-public access, configure inside source NAT, choosing static, a pool, or overload (PAT) to fit.
- Keep service roles distinct: DHCP assigns addresses (with a relay across subnets), DNS resolves names, SNMP polls status, and syslog logs events by severity.
- For QoS, classify and mark traffic and apply the right per-hop behavior, distinguishing policing from shaping.
- Secure management with SSH over Telnet, synchronize time with NTP, and use TFTP or FTP appropriately for device files. Where two services seem to fit, pick the one whose function matches the symptom, such as DNS for name failures and DHCP for missing addresses.
Practice question
Want more like this? The CCNA practice test has questions for every domain.
Checklist
0 of 10
Tick each one you can do without notes. Your ticks stay in this browser.
Study strategy
Approach this domain as broad but shallow: know exactly what each service does and how to verify it, without over-investing. Start with the configure-and-verify services that can appear as simulations: inside source NAT (and the static, pool and PAT distinction), NTP, DHCP client and relay, and SSH. Practice these hands-on.
Then learn the descriptive and memorization content efficiently: the DHCP-versus-DNS and SNMP-versus-syslog role distinctions, and the two high-yield memorization tables, the syslog severity levels (0 emergency to 7 debug) and the QoS mechanisms, keeping policing (drops or remarks) distinct from shaping (buffers and delays). Finally, know the TFTP-versus-FTP difference.
Because this domain is only 10% and much is recall, spaced repetition works better than marathon labs, though the configure-and-verify items still reward hands-on practice. Memorize the eight syslog severity levels, from 0 emergency to 7 debugging, and practice reading show ip nat translations and show ntp status output. Afterwards, move to Domain 5, Security Fundamentals.
FAQ
How much of the CCNA is Domain 4?
IP Services is 10% of the exam, covering the supporting network services, broad but shallower than the routing domain.
What is the difference between static NAT, a NAT pool and PAT?
Static NAT is a fixed one-to-one mapping, useful for servers. A NAT pool dynamically maps internal hosts to a range of public addresses. PAT (overload) maps many internal hosts to a single public address using port numbers.
Why do DHCP clients need a relay across subnets?
DHCP discovery messages are broadcasts, which routers do not forward by default. A DHCP relay, configured with ip helper-address, forwards these requests to a DHCP server on another subnet.
What is the difference between SNMP and syslog?
SNMP polls devices for status and performance metrics and receives traps. Syslog records event log messages from devices, each tagged with a severity level, for later review.
How does the syslog severity scale work?
Severity levels run from 0, emergency, the most severe, to 7, debugging, the least severe. Lower numbers indicate more critical events, which is a common exam point.
What is the difference between QoS policing and shaping?
Policing drops or remarks traffic that exceeds a configured rate, enforcing it strictly. Shaping buffers and delays excess traffic to smooth it to the rate rather than dropping it.
How does Domain 4 connect to the rest of the exam?
These services support the connectivity built in Domains 1 to 3, SSH secures the management from Domain 2, and the services run on the routed network from Domain 3.
Other Networking certifications
Where the same subject shows up in other exams. Cards marked "Same subject" open the matching domain.
Test your Domain 4 knowledge
You have covered NAT, NTP, DHCP, DNS, SNMP, syslog, QoS and SSH. Test whether you can choose and configure the right service under exam conditions.