Options

http, tftp

acidsatyracidsatyr Member Posts: 111
in CCIE
Hi,

can you upload files on cisco switch/router acting as http or tftp server?
Or is it that you can only download from them?
· Share on FacebookShare on Twitter

Comments

  • Options
    xenodamusxenodamus Member Posts: 758
    TFTP is used to backup IOS/config files as well as upload new ones to devices.

    I don't think think that's a CCIE level topic, though....icon_rolleyes.gif
    CISSP | CCNA:R&S/Security | MCSA 2003 | A+ S+ | VCP6-DTM | CCA-V CCP-V
    · Share on FacebookShare on Twitter
  • Options
    OnefiveOnefive Member Posts: 23 ■□□□□□□□□□
    acidsatyr wrote: »
    Hi,

    can you upload files on cisco switch/router acting as http or tftp server?
    Or is it that you can only download from them?

    I've seen some devices allow you to download files via http and ftp, but tftp is the most common. As for the router or switch acting as a tftp or ftp server, I don't think IOS implements these features, and would be a huge security issue if they did. It could be useful if you wanted to setup some kind of a PUSH model in updating ios images or configs, but SNMP already allows you to do this in a much safer way.
    · Share on FacebookShare on Twitter
  • Options
    acidsatyracidsatyr Member Posts: 111
    xenodamus wrote: »
    TFTP is used to backup IOS/config files as well as upload new ones to devices.

    I don't think think that's a CCIE level topic, though....icon_rolleyes.gif

    Going down that road, what is a CCENT doing in here then?
    I've seen some devices allow you to download files via http and ftp, but tftp is the most common. As for the router or switch acting as a tftp or ftp server, I don't think IOS implements these features, and would be a huge security issue if they did. It could be useful if you wanted to setup some kind of a PUSH model in updating ios images or configs, but SNMP already allows you to do this in a much safer way.

    Yeah, ios allows you to use router as http, https, tftp and ftp (older ios only) server.
    What i tried today was to copy local config to cisco router using tftp, but i guess you can't use it to upload stuff only download.
    anyway, thx
    · Share on FacebookShare on Twitter
  • Options
    Bl8ckr0uterBl8ckr0uter Inactive Imported Users Posts: 5,031 ■■■■■■■■□□
    Onefive wrote: »
    but SNMP already allows you to do this in a much safer way.

    Really? Everything that I have read has lead me to believe that doing any type of changes using SNMP is bad (Security is Not MY Problem). Care to elaborate?
    · Share on FacebookShare on Twitter
  • Options
    Forsaken_GAForsaken_GA Member Posts: 4,024
    acidsatyr wrote: »
    Yeah, ios allows you to use router as http, https, tftp and ftp (older ios only) server.
    What i tried today was to copy local config to cisco router using tftp, but i guess you can't use it to upload stuff only download.
    anyway, thx

    I may not understand what you're trying to do, and it's probably obvious, but yes, tftp can upload and download. For example, I've sent images and configurations to remote servers running both ftp and tftp, and I've pulled images and configurations from the same. I've never tried to upload something like an image and then see if the http server portion will actually serve it though, could you elaborate on what it is you're trying to do that's not working?
    · Share on FacebookShare on Twitter
  • Options
    OnefiveOnefive Member Posts: 23 ■□□□□□□□□□
    knwminus wrote: »
    Really? Everything that I have read has lead me to believe that doing any type of changes using SNMP is bad (Security is Not MY Problem). Care to elaborate?


    SNMPv1/2 would be just as insecure as ftp ( unless you were using ftp with TLS ). SNMPv3 on the other hand provides authentication, encryption, and more granular access restrictions.
    · Share on FacebookShare on Twitter
  • Options
    TurgonTurgon Banned Posts: 6,308 ■■■■■■■■■□
    knwminus wrote: »
    Really? Everything that I have read has lead me to believe that doing any type of changes using SNMP is bad (Security is Not MY Problem). Care to elaborate?

    Check SNMP v3
    · Share on FacebookShare on Twitter
  • Options
    TurgonTurgon Banned Posts: 6,308 ■■■■■■■■■□
    Onefive wrote: »
    I've seen some devices allow you to download files via http and ftp, but tftp is the most common. As for the router or switch acting as a tftp or ftp server, I don't think IOS implements these features, and would be a huge security issue if they did. It could be useful if you wanted to setup some kind of a PUSH model in updating ios images or configs, but SNMP already allows you to do this in a much safer way.

    IOS has supported a tftp server for quite sometime.
    · Share on FacebookShare on Twitter
  • Options
    TurgonTurgon Banned Posts: 6,308 ■■■■■■■■■□
    acidsatyr wrote: »
    Hi,

    can you upload files on cisco switch/router acting as http or tftp server?
    Or is it that you can only download from them?

    You can upload and download files using IOS TFTP. Just be sure you have enough flash memory for the files.
    · Share on FacebookShare on Twitter
  • Options
    OnefiveOnefive Member Posts: 23 ■□□□□□□□□□
    Turgon wrote: »
    IOS has supported a tftp server for quite sometime.


    Which versions of IOS have a tftpd? I know Cisco has a discontinued windows TFTP daemon, but I wouldn't suggest using that due to security issues.
    · Share on FacebookShare on Twitter
  • Options
    Bl8ckr0uterBl8ckr0uter Inactive Imported Users Posts: 5,031 ■■■■■■■■□□
    Onefive wrote: »
    SNMPv1/2 would be just as insecure as ftp ( unless you were using ftp with TLS ). SNMPv3 on the other hand provides authentication, encryption, and more granular access restrictions.


    I knew about SNMP v3 but the Net Engineers I spoke with about this basically said that even still it is very insecure (compared to an SSH or SFTP). Thanks for the clarification.
    · Share on FacebookShare on Twitter
  • Options
    TurgonTurgon Banned Posts: 6,308 ■■■■■■■■■□
    Onefive wrote: »
    Which versions of IOS have a tftpd? I know Cisco has a discontinued windows TFTP daemon, but I wouldn't suggest using that due to security issues.

    The capability for a router to run as a tftp server has been there for a very long time. Historically it has been used to enable the copy of one IOS from a router to another.

    How To Copy a System Image from One Device to Another - Cisco Systems
    · Share on FacebookShare on Twitter
  • Options
    OnefiveOnefive Member Posts: 23 ■□□□□□□□□□
    Awesome. I didn't know that feature existed. There have been many times where that would have come in handy for me, I've always resulted in finding a Unix box to throw up hpa-tftpd.
    · Share on FacebookShare on Twitter
  • Options
    acidsatyracidsatyr Member Posts: 111
    Yeah, i never paid attention to this since i never had to use it, and now I'm not sure if its possible or not, or maybe i'm just overlooking something.
    So, we sometimes use to archive local router config via tftp/ftp to dedicated server using something like:
    copy running-config tftp://10.1.1.1/archive/backup.config
    (we don't really use this manually, we use snmp and EEM to do saves for us).

    Now, when i tried to do the same thing when tftp server is a router, if fails, and says "I/O Error".
    In other words it doesn't allow me to PUSH my config to router, only download. I don't have problem with pulling down config, for example
    copy tftp://10.1.1.1/archive/backup.config flash://archive
    Same with http.

    So yeah i know the question might be silly, but i don't see why wouldn't i be able to PUSH the config to tftp, http router?
    So can it be done, and what am i missing?

    Thanks.

    edit: so, again, to be clear, i'm not talking about setting up proper servers, i talking about using routers as tftp/http servers and then PUSHIN config from LOCAL router to them, not pulling it down.
    · Share on FacebookShare on Twitter
  • Options
    tierstentiersten Member Posts: 4,505
    Think about what would happen if you could use TFTP which doesn't use any authentication to push router configs :P
    · Share on FacebookShare on Twitter
  • Options
    acidsatyracidsatyr Member Posts: 111
    Ok ok, ;) you are right; i was thinking more of ftp and HTTP which does require auth.
    Can i push with HTTP?
    · Share on FacebookShare on Twitter
  • Options
    tierstentiersten Member Posts: 4,505
    acidsatyr wrote: »
    Ok ok, ;) you are right; i was thinking more of ftp and HTTP which does require auth.
    Can i push with HTTP?
    The FTP server could let you upload files but not configs. However, there were a bunch of vulnerabilities in it and Cisco just ripped the whole thing out and its not longer present in new versions of IOS.

    The HTTP server doesn't let you upload files or configs.

    You're pretty much stuck with TFTP if you want to get files onto an IOS device.
    · Share on FacebookShare on Twitter
Sign In or Register to comment.