This example shows how to use TFTP to upload a copy of the router’s active configuration to a remote server:
Freebsd%touchFreebsd%/tftpboot/router1-confgchmod 666Freebsd%/tftpboot/router1-confgtelnetTrying 172.25.1.5... Connected to Router1. Escape character is '^]'. User Access Verification Password:Router1Router1><vtypassword>enablePassword:Router1#<enablepassword>copy running-config tftp://Address or name of remote host [172.25.1.1]?172.25.1.1/router1-confg<enter>Destination filename [router1-confg]?<enter>!!! 9640 bytes copied in 3.956 secs (2437 bytes/sec) Router1#
We cannot overstress the importance of making regular backups of your router configuration files and keeping copies in a safe place. If you have a serious failure that damages a router’s hardware or software, the configuration will be destroyed. And anybody who has had to reconstruct a complex router configuration file from memory will tell you how difficult and stressful this task is. But if you have a backup of the last working configuration file, you can usually get a router working again within minutes of fixing any hardware problems.
Typical Mean Time Between Failure (MTBF) estimates for Cisco routers tend to be about 16 years. This sounds like a long time, but in a large network it means that you can expect to see a few failures every year. Unfortunately, human error is far more common than a device failure, and these human errors can result in complete or partial loss of the configuration file.
In the example, we created an empty backup configuration file on the TFTP server and then instructed the router to send its running configuration to this server. It is important to adjust the file permissions with the Unix chmod command. The transfer will fail if the configuration file is not world writable. We highly recommend moving the configuration files out of the TFTP directory to ensure that the file isn’t read by unauthorized people or accidentally overwritten.
Reading files located in the TFTP directory is trivial because the TFTP program needs this directory to be both world readable and world writeable. Since router configuration files contain passwords and IP addresses, you should take steps to protect these files as much as possible. In fact, you don’t even need to be logged into the TFTP server to read these files. In the following example, we are able to access the TFTP server and read a router configuration file from another router:
Router1#more tftp://! ! Last configuration change at 11:23:59 EST Sat Jan 11 2003 by ijbrown ! NVRAM config last updated at 00:37:16 EST Sat Jan 11 2003 by ijbrown ! Version 12.2 service tcp-keepalives-in service timestamps debug datetime msec service timestamps log datetime localtime service password-encryption ! hostname Router1 <removed for brevity>172.25.1.1/router1-confg
As you can see, any files left in the TFTP directory can be easily viewed or even deliberately corrupted. TFTP is notoriously insecure, so we recommend using care whenever you work with this protocol.
Recipe 1.18 provides an automated script that gathers the configuration files for a list of routers on a nightly basis and stores these files for 30 days, by default.
Get Cisco IOS Cookbook, 2nd Edition now with the O’Reilly learning platform.
O’Reilly members experience books, live events, courses curated by job role, and more from O’Reilly and nearly 200 top publishers.
