Course contents

Chapter 11: IP Services on IOSLesson 6 of 10

TFTP, FTP, SFTP and SCP compared

Ports, security and copy commands for each file transfer protocol, and which to use for backups and images.

Intermediate · 8 min read

Technical definition

File transfer protocols are the standard ways to move files between devices. On Cisco equipment they are used to back up configurations, load IOS images and collect logs. The choice depends on whether the transfer needs authentication and encryption.

The protocols side by side

File transfer protocols at CCNA depth
File transfer protocols at CCNA depthProtocol; Transport and port; Login; Encrypted; Typical use. TFTP: UDP 69 None No Booting devices, lab image and config copies FTP: TCP 21 (control) and 20 (data, active mode) Username and password in clear text No Bulk file transfer on trusted networks FTPS: TCP 21 (explicit) or 990 (implicit) Username and password Yes (TLS) FTP with encryption SFTP: TCP 22 (inside SSH) SSH credentials or keys Yes Secure file transfer and automation SCP: TCP 22 (inside SSH) SSH credentials Yes Copying files to and from network devices HTTP / HTTPS: TCP 80 / 443 Optional HTTPS only Downloading images and files from web serversProtocolTransport andportLoginEncryptedTypical useTFTPUDP 69NoneNoBooting devices,lab image andconfig copiesFTPTCP 21 (control)and 20 (data,active mode)Username andpassword in cleartextNoBulk filetransfer ontrusted networksFTPSTCP 21 (explicit)or 990 (implicit)Username andpasswordYes (TLS)FTP withencryptionSFTPTCP 22 (insideSSH)SSH credentialsor keysYesSecure filetransfer andautomationSCPTCP 22 (insideSSH)SSH credentialsYesCopying files toand from networkdevicesHTTP / HTTPSTCP 80 / 443OptionalHTTPS onlyDownloadingimages and filesfrom web servers

On small screens, swipe sideways or focus the diagram and use the arrow keys.

Read across: if it has no login or encryption, use it only on a trusted management network. Everything with SSH or TLS protects credentials.

Copying on a Cisco device

Example commands and output on this page were written from Cisco IOS documentation and generally described behaviour. They were not captured from a live device, so prompts and details can differ on your platform and version.

! Back up the running configuration to a TFTP server copy running-config tftp://192.0.2.10/R1-config ! Back up with FTP (credentials set globally) ip ftp username backup ip ftp password S3cretPass copy startup-config ftp://192.0.2.10/R1-startup ! Back up with SCP (device must allow SCP and use AAA) copy running-config scp://admin@192.0.2.10/R1-config

The syntax is the same: copy source destination. The server address 192.0.2.10 is from the documentation range; the credentials are placeholders.

Letting the router accept SCP

aaa new-model aaa authentication login default local aaa authorization exec default local username admin privilege 15 secret ExampleSecret1 ip ssh version 2 ip scp server enable

SCP rides on SSH, so SSH must already work. ip scp server enable lets the device receive copies.

How TFTP behaves

A TFTP client sends its request to UDP port 69. The server then answers from a different, random UDP port, and each block of 512 bytes is acknowledged before the next is sent. That makes it slow and awkward to firewall, which is another reason to keep it on a management network.

Choosing

  • Bootloader recovery or an isolated lab: TFTP.
  • Regular backups across a network you do not fully trust: SCP or SFTP.
  • Anything carrying a password across a shared network: never plain FTP or TFTP.

Test yourself

Predict · scenario 1

Which protocol sends no username or password and uses UDP port 69?

Predict · scenario 2

Which two file transfer methods are both carried inside SSH on TCP 22?

Predict · scenario 3

You must send a configuration backup across the internet to a remote server. Which is the best choice?

FAQ

Which is the most secure?
SFTP and SCP, because both run inside an SSH session and encrypt credentials and data. FTPS also encrypts, using TLS. TFTP and plain FTP do not.
Why is TFTP still used?
It is tiny and needs no login, so it works inside bootloaders and small devices that cannot run a full stack. Use it only on a trusted management network.
Is SFTP the same as FTPS?
No. SFTP is a file protocol that runs over SSH on TCP 22. FTPS is the old FTP protocol wrapped in TLS. They are not interoperable.