IP Services · Topic 9 of 9
TFTP and FTP in the Network
Compare TFTP and FTP, what each is used for in a network, the ports and security differences, and how to copy configs and images on a Cisco device.
- 4 min
- Exam objective 4.9
- TFTP uses UDP and starts at port 69. FTP uses TCP with ports 21 and 20.
- TFTP has no authentication and no directory listing. FTP asks for a username and password.
- Neither protocol encrypts anything.
What it is
TFTP and FTP move files between devices, and neither encrypts anything.
Engineers use them to back up a configuration, restore it or load a new operating system image.
TFTP (Trivial File Transfer Protocol) is very small and simple. It has no login, no directory listing and almost no features. That makes it easy to build into devices with little memory, such as one that is booting and needs its image.
FTP (File Transfer Protocol) is fuller. It asks for a username and password, lets you browse directories, and copes with larger transfers.
How it works
The two protocols differ in transport, ports, login and behaviour.
| TFTP | FTP | |
|---|---|---|
| Transport | UDP | TCP |
| Port | 69 to start the transfer | 21 control, 20 data in active mode |
| Login | None | Username and password |
| Directory listing | No | Yes |
| Reliability | Application acknowledgements | Provided by TCP |
| Encryption | None | None |
| Typical use | Small files, boot images, config backups on a trusted network | Larger files that need a login |
TFTP
TFTP works in lock-step: send a block, wait for an acknowledgement, send the next.
Because it runs on UDP, TFTP supplies its own simple reliability with acknowledgements and timeouts. The standard block size is 512 bytes, although a larger size can be negotiated as an option. The first request goes to port 69, and the rest of the transfer then moves to another port chosen for it.
TFTP has no authentication. Anyone who can reach the server and knows a filename can try to fetch the file.
FTP
FTP uses two connections.
- The control connection on TCP port 21 carries commands and replies.
- The data connection carries the file itself.
- In active mode, the server opens the data connection back to the client from port 20.
- In passive mode, the client opens it to a port the server announces. This suits firewalls better, because the client starts both connections.
The FTP login is sent in clear text, so FTP is not secure either. Secure alternatives exist, but they are outside this objective.
On a Cisco device
Both protocols are used with the copy command. The source comes first, then the destination.
copy running-config tftp:
copy tftp: running-config
copy flash: tftp:
copy ftp://user:password@10.1.1.100/config.txt running-configThe device asks for the server address and file name if you omit them. For FTP you can store credentials:
ip ftp username backupuser
ip ftp password SECRETWORD- Copying into the running configuration merges the file with what is there.
- Copying into the startup configuration replaces it entirely.
copy A B always means source A, destination B. copy running-config tftp: sends the config out. copy tftp: running-config pulls it in.
Checking an image
Before installing a new image, check that it arrived intact:
verify /md5 flash:imagefile.binThis compares the file's hash with the value the vendor publishes.
If a transfer fails, check that the server is running, the device can ping it, no ACL blocks UDP 69 or TCP 20 and 21, and flash has enough free space.
What to remember for the exam
Eight facts matter.
- TFTP uses UDP and starts at port 69. FTP uses TCP with ports 21 and 20.
- TFTP has no authentication and no directory listing. FTP asks for a username and password.
- Neither protocol encrypts anything.
- TFTP is light, suited to small files and booting devices.
- FTP is more capable and relies on TCP for reliability.
- FTP uses a control connection and a separate data connection.
- Both are commonly used to back up configs and move IOS images.
- The
copycommand takes source first, then destination.
Common mistakes
These six errors are common.
Mixing up the transport. TFTP is UDP and FTP is TCP, which is a key difference.
Calling TFTP secure because it is simple. It has no authentication or encryption.
Reversing the copy direction. Read source and destination in order.
Forgetting the merge effect. Copying into the running configuration does not erase what is there.
Not checking the image. A corrupted download can stop a device booting.
Swapping the port roles. Port 21 is control. Port 20 is data in active mode.
Check yourself
Work through these three prompts.
How do TFTP and FTP compare in transport protocol, ports and login?
TFTP uses UDP, starts at port 69 and has no login. FTP uses TCP with port 21 for control and port 20 for data in active mode, and asks for a username and password.
What happens to existing commands when you copy a file into the running configuration compared with the startup configuration?
Copying into the running configuration merges the file with what is there. Copying into the startup configuration replaces it entirely.
What is the difference between FTP's control connection and its data connection?
The control connection on TCP port 21 carries commands and replies. The data connection carries the file itself.
Topic 9 of 9 in IP Services
Test yourself on IP Services
The full Cisco CCNA 200-301 question bank has 1,206 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by Cisco. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.