How do devices on a network automatically get their addresses, share one public internet connection, and talk to the next generation of the internet without breaking everything? For the 300-410 ENARSI exam, you must understand DHCP (Dynamic Host Configuration Protocol), NAT (Network Address Translation), and IPv6 — three critical infrastructure services that keep modern networks running without manual configuration every time a device connects.
Jump to a section
A simple way to picture Infrastructure Services: DHCP, NAT, and IPv6
A large apartment building with 100 flats, each with a unique flat number but all sharing one main street address.
Every morning, the postal worker arrives with a stack of letters and parcels. There's no way she can personally knock on every door to deliver each item — that would take hours and residents might not be home. Instead, the building has a central mailroom with 100 numbered cubbyholes. The postal worker sorts all the mail by flat number and drops each piece into the correct cubbyhole. This is DHCP working inside your network: a central server (the mailroom) automatically assigns each device (each flat) a unique address (flat number) from a pool, so data packets (letters) know exactly where to go without any resident having to request a new address each morning.
Now imagine a resident has a delivery from a company that only ships to the building's main street address, not to individual flat numbers. The building's concierge takes the parcel addressed to the building's main address, checks a log book showing that Flat 42 is expecting that package, rewrites the label to include the flat number, and hands it to the resident. This is NAT: the concierge (the router) translates your private internal IP address (flat number) into the public IP address (main street address) that the internet recognises, and keeps track of which internal device made which request so the reply comes back to the right device.
IPv6 is like the building switching from four-digit flat numbers (limiting the total) to much longer flat numbers that include letters and extra digits. Now there are enough unique flat addresses for every imaginable extension, so the building rarely needs the concierge's re-addressing workarounds anymore.
Let's break down DHCP, NAT, and IPv6 from the ground up.
DHCP (Dynamic Host Configuration Protocol) Every device on an IP network — laptop, phone, printer, server — needs a unique IP address to send and receive data. An IP address is like a phone number for your device: it tells other devices where to find it. In the early days, network admins had to type an IP address manually into every single device. That's called static IP assignment. It works for a handful of devices, but imagine doing that for 500 computers in an office — a nightmare.
DHCP automates this. A DHCP server (a piece of software running on a router, switch, or dedicated server) holds a pool of available IP addresses. When a new device joins the network, it broadcasts a message saying "I need an IP address." The DHCP server hears this and leases an unused address to the device for a certain amount of time (the lease time). The device also receives other critical settings: the subnet mask (which defines the network's size), the default gateway (the router that connects to other networks), and the DNS server address (which translates website names like google.com into IP addresses).
The process has four steps, often remembered as DORA: Discover (device asks for an IP), Offer (server offers an address), Request (device says "I'll take that one"), Acknowledge (server confirms the lease). The device keeps the address for the lease duration, and when half the lease time passes, it tries to renew so it doesn't get cut off mid-session.
NAT (Network Address Translation) Every device connected directly to the internet needs a public IP address. Public IPv4 addresses are limited — there are only about 4.3 billion, and we've nearly run out. Meanwhile, homes and offices have many devices that all need internet access. NAT solves this by allowing many private IP addresses (like 192.168.1.x or 10.0.0.x) to share a single public IP address.
When your laptop sends a request to a web server, your router rewrites the source IP from your private address to the router's public address. It also changes the source port number to a unique high-numbered port, and stores that mapping in a NAT table. When the web server replies, it sends the data back to the router's public address. The router checks its NAT table, sees which internal device the reply belongs to, rewrites the destination IP back to the private address, and forwards the packet.
The three main types of NAT on the exam are: static NAT (one-to-one mapping of a private IP to a fixed public IP, often used for servers that must be reachable from the internet), dynamic NAT (a pool of public IPs is shared among private devices — when one device finishes its session, its public IP goes back into the pool), and PAT (Port Address Translation) — also called NAT overload — which is the most common type used in home routers, allowing many devices to share one public IP by using unique port numbers.
IPv6 IPv6 is the replacement for IPv4. It uses 128-bit addresses, providing about 340 undecillion addresses — enough for every grain of sand on Earth to have its own IP. IPv6 addresses look like long hexadecimal strings, e.g., 2001:0db8:85a3:0000:0000:8a2e:0370:7334. They are written in eight groups of four hex digits, separated by colons. Leading zeros in a group can be omitted, and one contiguous block of zero groups can be replaced with :: (but only once).
IPv6 eliminates the need for NAT in most cases because every device can have a globally unique public address. It also simplifies address assignment: devices can use SLAAC (Stateless Address Autoconfiguration) to generate their own address based on the network prefix advertised by the router, or use DHCPv6 for more controlled allocation. The exam tests your ability to configure IPv6 addressing on interfaces, enable IPv6 routing, and understand coexistence mechanisms like dual-stack (running both IPv4 and IPv6 on the same network), tunnelling (encapsulating IPv6 packets inside IPv4), and translation.
Why does this matter on 300-410? You will see configuration commands for DHCP pools, NAT inside/outside interfaces, access lists to control NAT translations, and IPv6 address configuration. You need to know the exact syntax and ordering of commands, and you need to recognise common misconfigurations like incorrect ACL entries blocking NAT or DHCP relay not forwarding to the correct server.
Define the DHCP pool
Use the global config command `ip dhcp pool POOL_NAME` to enter DHCP pool configuration mode. This creates the container for IP settings that will be offered to clients. Without this step, no DHCP service exists on the router.
Specify the network and subnet
Inside the pool, `network 192.168.1.0 255.255.255.0` tells the DHCP server which range of IP addresses it can hand out. The mask defines the size of the subnet. A mismatch here causes clients to receive an incorrect subnet mask.
Set the default gateway and DNS server
Commands like `default-router 192.168.1.1` and `dns-server 8.8.8.8` provide clients with the gateway they need to reach other networks and the DNS server to resolve domain names. Missing these means clients get an IP but cannot reach the internet.
Exclude addresses from the pool
Use global command `ip dhcp excluded-address 192.168.1.1 192.168.1.10` to reserve addresses for static devices like servers or routers. If you skip this, DHCP might assign an address already used by a static device, causing an IP conflict.
Enable DHCP relay (if needed)
If the DHCP server is on a different subnet, apply `ip helper-address <server-ip>` on the incoming interface (the one facing clients). This makes the router forward DHCP broadcasts as unicast to the remote server. Forgetting this step means remote clients never get an IP.
Verify DHCP bindings
Use `show ip dhcp binding` to see which MAC addresses received which IPs and lease expiration times. This step confirms the DHCP server is working and helps troubleshoot if a specific device isn't getting an address.
Configure NAT inside and outside interfaces
On the LAN interface use `ip nat inside` and on the WAN interface use `ip nat outside`. This tells the router which side has private IPs and which side has public IPs. Swapping these breaks all NAT translations.
Create NAT rules (static or dynamic)
For PAT use `ip nat inside source list 1 interface GigabitEthernet0/1 overload`. This sets up the translation rule linking the ACL-permitted addresses to the outside interface with overload. For static NAT use the `static` variant without `overload`.
Enable IPv6 unicast routing
Use the global command `ipv6 unicast-routing`. Without this, the router will not forward IPv6 packets even if interfaces have IPv6 addresses configured. This is a common oversight in exam labs.
Assign IPv6 addresses and enable SLAAC
On each interface, configure `ipv6 address 2001:db8:1:1::1/64` and optionally `ipv6 address autoconfig` for SLAAC. The interface then sends Router Advertisements so clients can auto-generate their own IPv6 addresses.
An IT professional at a growing company with 200 employees needs to deploy a new branch office network. She has a single public IP address from the ISP, 200 devices (laptops, VoIP phones, printers), and an application server that must be reachable from the internet.
First, she configures a DHCP server on the branch router. She creates a DHCP pool called BRANCH_POOL, specifying the network 192.168.10.0/24 (a private IP range), the default gateway (192.168.10.1), the DNS server (8.8.8.8), and a lease duration of 8 hours. She excludes a few addresses from the pool for the server (192.168.10.10) and printers (192.168.10.50–192.168.10.60) using manual bindings. She then enables the DHCP service on the router interface that connects to the switch. Within minutes, every employee's laptop that connects to the network automatically receives an IP address, subnet mask, gateway, and DNS — no manual intervention.
Next, she configures NAT. She defines the inside interface as the LAN interface (GigabitEthernet0/0) and the outside interface as the WAN interface connecting to the ISP (GigabitEthernet0/1). She creates an access list that permits the private IP range 192.168.10.0 0.0.0.255 to be translated. Then she applies PAT: ip nat inside source list 1 interface GigabitEthernet0/1 overload. This single command causes all 200 devices to share the one public IP, using unique port numbers to keep conversations separate. For the application server that must be accessible from the internet, she configures a static NAT entry: ip nat inside source static 192.168.10.10 <public-ip>. Now external users can reach the server by the public IP.
Finally, she prepares for IPv6. The ISP has announced that they will support IPv6 in six months. She configures a global unicast IPv6 address on the WAN interface (2001:db8:1:1::1/64) and enables IPv6 routing. On the LAN interface, she enables SLAAC so devices can auto-configure their own IPv6 addresses using the advertised prefix. She also sets up a DHCPv6 server to provide DNS server addresses. The network now runs both IPv4 and IPv6 side by side (dual-stack). Users see no difference, but the network is future-proofed for the inevitable IPv6-only world.
The most common troubleshooting she performs: checking show ip nat translations to see if mappings are being created, verifying show ip dhcp binding to see which devices have leases, and using ping with IPv6 addresses to test reachability. She also regularly audits the NAT table for performance issues — if it fills up, new connections fail.
The 300-410 ENARSI exam tests DHCP, NAT, and IPv6 heavily in both multiple-choice and simulation (lab) questions. Here is exactly what you must know.
DHCP exam topics
- Know the four DORA steps in order: Discover, Offer, Request, Acknowledge.
- Be able to configure a DHCP pool with the global config command: ip dhcp pool POOL_NAME, then network 192.168.1.0 255.255.255.0, default-router 192.168.1.1, dns-server 8.8.8.8.
- Understand how to exclude addresses: ip dhcp excluded-address 192.168.1.1 192.168.1.10.
- Know DHCP relay: when the DHCP server is on a different subnet, you use ip helper-address <server-ip> on the router interface facing the clients. The exam loves to test that the helper address command goes on the inside interface, not the outside.
- Be ready to interpret show ip dhcp binding, show ip dhcp server statistics, and debug ip dhcp server events.
NAT exam topics
- The command ip nat inside and ip nat outside on interfaces is mandatory — missing these is a classic trap.
- Static NAT: ip nat inside source static <private-ip> <public-ip>.
- Dynamic NAT: ip nat pool POOL_NAME <start> <end> netmask <mask> followed by ip nat inside source list <acl> pool POOL_NAME.
- PAT (overload): the same as dynamic NAT but with the keyword overload at the end, OR using the interface: ip nat inside source list <acl> interface <int> overload.
- The access list in NAT must permit the private addresses that should be translated. An incorrectly ordered or missing ACL is a common error.
- You will be asked to read show ip nat translations and identify if translations are present, what type they are, and if the inside/outside mapping is correct.
- Traps: placing ip nat inside on the wrong interface, forgetting the overload keyword for PAT, using a pool that is too small for dynamic NAT, and confusing inside/outside concepts.
IPv6 exam topics
- IPv6 address format: colon-hexadecimal, 8 groups, leading zeros can be omitted, double colon :: can be used once.
- Address types: Global Unicast (starts with 2000::/3), Unique Local (fc00::/7), Link-Local (fe80::/10), Multicast (ff00::/8).
- Configuring an IPv6 address on an interface: ipv6 address 2001:db8:1:1::1/64.
- Enabling IPv6 routing globally: ipv6 unicast-routing.
- SLAAC vs DHCPv6: SLAAC uses Router Advertisement messages; DHCPv6 can be stateful (like DHCPv4) or stateless (providing only additional info like DNS).
- Dual-stack configuration: both IPv4 and IPv6 configured on the same interface — no translation needed.
- Common traps: forgetting to enable ipv6 unicast-routing, configuring an IPv4 helper address thinking it helps IPv6, and confusing link-local addresses with global addresses.
DHCP automates IP address assignment using the four-step DORA process: Discover, Offer, Request, Acknowledge.
NAT translates private IP addresses to a public IP using either static mapping, dynamic pools, or PAT (overload) which uses unique port numbers.
IPv6 eliminates the need for NAT by providing enough globally unique addresses for every device to have its own public IP.
The `ip helper-address` command must be configured on the router interface facing the DHCP clients, not on the interface toward the DHCP server.
When configuring NAT, ensure the correct interfaces are marked with `ip nat inside` and `ip nat outside` or translation will fail.
SLAAC allows IPv6 devices to auto-configure their addresses using router advertisements without any DHCP server.
Dual-stack is the most common IPv6 coexistence strategy, where both IPv4 and IPv6 run on the same network interfaces simultaneously.
These come up on the exam all the time. Here's how to tell them apart.
Static NAT
One-to-one fixed mapping between a private IP and a public IP
Requires manual configuration of each mapping
Used for servers that must always be reachable from outside
Dynamic NAT
Maps private IPs to an available public IP from a pool
Mapping changes when lease expires or session ends
Used for general outbound internet access with scarce public IPs
DHCP Server
Assigns IP addresses from a pool of addresses
Typically located on the same subnet as clients or reachable via relay
Provides other settings like gateway and DNS
DHCP Relay Agent
Forwards DHCP broadcast messages to a remote server
Configured on routers with ip helper-address command
Does not assign IP addresses itself
IPv6 SLAAC
Device generates its own IP address using router-advertised prefix
No central server needed
Cannot provide additional configuration like DNS servers without extra options
DHCPv6
Central server assigns IPv6 addresses or additional options
Requires a DHCPv6 server to be configured and reachable
Can provide DNS server addresses and other parameters
Public IP Address
Globally unique and routable on the internet
Assigned by ISP and costs money in blocks
Used on WAN interfaces of routers
Private IP Address
Not routable on the public internet
Free to use within an organisation (RFC 1918 ranges)
Used on LAN interfaces and internal devices
Mistake
DHCP servers will assign the same IP address to every device that connects.
Correct
DHCP assigns unique IP addresses from a pool, tracking which addresses are currently in use via lease records. It will not give an address that is already leased to another active device.
People misunderstand 'dynamic' as meaning 'random' but DHCP is designed to avoid conflicts by maintaining a binding table of MAC addresses and their current leases.
Mistake
NAT is a security feature that protects networks from hackers.
Correct
NAT is not a security mechanism; it is an address conservation technique. While it can obscure internal IP addresses, it provides no encryption and can be bypassed. Firewalls are for security.
Many introductory networking courses incorrectly describe NAT as 'hiding' internal addresses, leading beginners to think it functions like a firewall. Vendors also sometimes overstate NAT's security benefits.
Mistake
IPv6 addresses are so long that you must have a DHCP server to assign them.
Correct
IPv6 devices can use SLAAC (Stateless Address Autoconfiguration) to automatically generate their own IP addresses based on the network prefix advertised by the router — no DHCP server required.
People assume IPv6 works just like IPv4, where DHCP is the standard automation tool. SLAAC is a simpler, more efficient approach that is unique to IPv6.
Mistake
DHCP relay and DHCP server are different names for the same thing.
Correct
A DHCP server gives out IP addresses. A DHCP relay (enabled with `ip helper-address`) forwards DHCP broadcast messages from clients on one subnet to a DHCP server on a different subnet.
The terms sound similar and both are involved in DHCP delivery, so beginners conflate the roles. The exam directly tests this distinction.
Mistake
NAT overload and dynamic NAT are identical.
Correct
NAT overload (PAT) uses port numbers to allow many private IPs to share one public IP. Dynamic NAT uses a pool of public IPs and gives each private IP a unique public IP (one-to-one when available). PAT is more efficient when you have fewer public IPs than private devices.
Both are 'dynamic' in the sense that they translate on demand, but the underlying mechanism (port translation vs IP pool) is fundamentally different.
Reveal each answer, then mark whether you got it right. Score 60%+ to unlock the next chapter.
DHCP automatically assigns IP addresses to devices from a pool, while static IP addressing requires you to manually enter an IP address on each device. DHCP is easier for large networks; static is used for servers that need a permanent address.
No, NAT is not a security measure. It conserves public IP addresses by allowing many private IPs to share one public IP. True security comes from firewalls, ACLs, and intrusion prevention systems.
Use the command `show ip nat translations`. If the output shows any entries, NAT is active. You can also use `show ip nat statistics` to see translation counts and pool usage.
IPv4 and IPv6 are entirely separate protocols with different address formats (32-bit decimal vs 128-bit hexadecimal), different packet headers, and different routing mechanisms. They require dual-stack configuration to operate together.
A DHCP lease is the duration for which a device is allowed to use a specific IP address. The default lease time varies by vendor but is often 24 hours or 8 hours. The device must renew the lease before it expires to keep the address.
The 'overload' keyword enables Port Address Translation (PAT), allowing many private IP addresses to share a single public IP by using unique port numbers. Without 'overload', only one-to-one translations occur.
You've finished Infrastructure Services: DHCP, NAT, and IPv6. Continue through the 300-410 study guide to build a complete picture of the exam.
Done with this chapter?