Objective 4.9
Describe the capabilities and functions of TFTP/FTP in the network
Why routers need file transfer
A router’s flash memory holds its operating system image (a file such as c2900-universalk9-mz.SPA.157-3.M8.bin or isr4300-universalk9.17.09.04a.SPA.bin) and its startup configuration. Two everyday tasks require moving files between the device and a server: backing up and restoring configurations, and upgrading IOS by copying a new image to flash. Both are done with the copy command, which can use TFTP, FTP, SCP, SFTP, HTTP, or a USB stick as the source or destination.
TFTP: Trivial File Transfer Protocol
TFTP is the simplest possible file transfer. It uses UDP port 69 for the initial request; the server then continues the transfer from a randomly chosen port. It has no authentication (no username or password), no encryption, and no directory listing; you must know the exact filename. Its only two operations are “read this file” and “write this file.” Reliability is handled by TFTP itself with a simple acknowledgment for every 512-byte block, since UDP provides none.
Because it is so simple, TFTP servers are tiny and every network engineer has one on their laptop (Tftpd64, SolarWinds TFTP Server). It is the traditional choice for a quick config backup or an IOS copy inside a trusted LAN. Cisco IP phones use TFTP to download their firmware and configuration (see DHCP option 150). TFTP should never be exposed to untrusted networks.
FTP: File Transfer Protocol
FTP is the full-featured, much older cousin. It uses TCP for reliability and needs two connections:
- Control connection on TCP port 21: carries the commands (login, change directory, list, get, put).
- Data connection on TCP port 20 (in active mode): carries the actual file contents and directory listings.
FTP requires a username and password (though “anonymous” FTP accepts any) and supports directory listings, renaming, and deleting. The credentials and data are still sent in clear text, so FTP is authenticated but not secure.
Active versus passive FTP is about who opens the data connection:
| Mode | Data connection is opened by | Ports | Firewall implications |
|---|---|---|---|
| Active | Server, from its port 20 to a port the client announced | Server 20 to client high port | Client-side firewall/NAT often blocks the inbound connection from the server |
| Passive (PASV) | Client, to a high port the server announced | Client high port to server high port | Works through most client-side firewalls and NAT; server firewall must allow a port range |
In active mode the client says “connect back to me on port X,” which fails when the client is behind NAT because the server’s inbound connection has no translation. Passive mode was invented to fix exactly that, and it is why most FTP clients default to passive.
Comparison
| Feature | TFTP | FTP |
|---|---|---|
| Transport | UDP | TCP |
| Ports | 69 | 21 control, 20 data (active) |
| Authentication | None | Username and password |
| Encryption | None | None (clear text) |
| Directory listing | No | Yes |
| Reliability | Own ACK per block | TCP |
| Typical use | Quick config backups, IOS copy on LAN, IP phone firmware | Larger transfers, scripted backups, Internet downloads |
Secure alternatives
Because both TFTP and FTP are unencrypted, modern practice prefers SCP (Secure Copy, runs over SSH on TCP 22; enable on IOS with ip scp server enable after SSH is set up) or SFTP (SSH File Transfer Protocol, also over SSH on TCP 22, and unrelated to FTP despite the name). FTPS (FTP over TLS) also exists. For the CCNA, know that SCP and SFTP exist, both use SSH on port 22, and they are the secure replacements.
Using copy with TFTP
Back up the running configuration to a TFTP server:
R1# copy running-config tftp:
Address or name of remote host []? 192.168.1.70
Destination filename [r1-confg]? R1-backup-2026-09-08.cfg
!!
1842 bytes copied in 0.312 secs (5904 bytes/sec)
Copy a new IOS image from the TFTP server to flash:
R1# copy tftp: flash:
Address or name of remote host []? 192.168.1.70
Source filename []? c2900-universalk9-mz.SPA.157-3.M8.bin
Destination filename [c2900-universalk9-mz.SPA.157-3.M8.bin]?
Accessing tftp://192.168.1.70/c2900-universalk9-mz.SPA.157-3.M8.bin...
Loading c2900-universalk9-mz.SPA.157-3.M8.bin from 192.168.1.70 (via
GigabitEthernet0/0): !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
[OK - 107852584 bytes]
107852584 bytes copied in 289.102 secs (373061 bytes/sec)
Each ! is a successful block. You can also give the whole path on one line: copy tftp://192.168.1.70/R1-backup.cfg running-config. Remember that copying to running-config merges the file into the current configuration (it does not replace it), while copying to startup-config replaces the startup file.
After the image is in flash, verify it with verify /md5 flash:filename and then tell the router to boot from it:
R1# show flash:
-#- --length-- -----date/time------ path
1 107852584 Sep 8 2026 15:02:10 c2900-universalk9-mz.SPA.157-3.M8.bin
2 98765432 Jan 5 2024 10:11:12 c2900-universalk9-mz.SPA.155-3.M.bin
R1# configure terminal
R1(config)# boot system flash:c2900-universalk9-mz.SPA.157-3.M8.bin
R1(config)# end
R1# copy running-config startup-config
R1# reload
Verify the running version afterward with show version, which lists the image file the router booted from and the IOS version.
Using copy with FTP
FTP needs credentials. Set them globally so copy can log in:
R1(config)# ip ftp username backupuser
R1(config)# ip ftp password Ftp!Pass99
R1(config)# ip ftp passive
R1(config)# end
R1# copy running-config ftp:
Address or name of remote host []? 192.168.1.71
Destination filename [r1-confg]? R1-backup.cfg
Writing R1-backup.cfg !
1842 bytes copied in 1.104 secs (1668 bytes/sec)
R1# copy ftp: flash:
Address or name of remote host []? 192.168.1.71
Source filename []? c2900-universalk9-mz.SPA.157-3.M8.bin
Destination filename [c2900-universalk9-mz.SPA.157-3.M8.bin]?
ip ftp passive makes the router use passive mode, which is usually required when a firewall sits between the router and the server. Credentials can also be embedded in the URL: copy ftp://backupuser:Ftp!Pass99@192.168.1.71/R1-backup.cfg running-config.