IP Addresses and Services Configuration Guide for Cisco 8000 Series Routers, IOS XR Releases

PDF

IP Addresses and Services Configuration Guide for Cisco 8000 Series Routers, IOS XR Releases

File transfer services

Updated: September 8, 2026

Want to summarize with AI?

Log in

Explains how FTP, TFTP, rcp, and SCP locate and transfer files, and provides tasks for configuring clients, operating a TFTP server, and copying individual files securely.

Starting with Cisco IOS XR Release 26.4.1, FTP and TFTP are deprecated because they do not provide secure file transfers. If either feature remains configured, the router logs a syslog deprecation warning once every 30 days. Use SCP or SFTP where supported. For more information, see Optional RPM packages for FTP, TFTP, and RCP protocols and services.

File transfer services are resource managers and file-system interfaces that

  • use URLs to identify files on routers or remote servers

  • move configuration files, software images, core dumps, and other files between systems, and

  • provide different authentication, security, and server behaviors through FTP, TFTP, rcp, and SCP.

Protocol characteristics

This table compares the file transfer services.

Table 1. File transfer protocols

Protocol

Primary characteristic

Use case

FTP

TCP/IP file transfer defined in RFC 959

Transfers files and supports configurable client behavior.

TFTP

Simplified file transfer, usually without client authentication

Transfers files and can serve files from router storage.

rcp

Remote copy client

Can save a core dump to a remote server.

SCP

Authenticated transfer over SSHv2

Securely transfers one file between a local and a remote device.

FTP connections

An FTP connection is a TCP/IP file transfer session that

  • moves files between network nodes

  • can use passive client behavior and an anonymous-user password, and

  • can use a configured router interface as its source.

FTP is defined in RFC 959.

Configure FTP client connections

Set the FTP client characteristics used for file transfers.

Procedure

  1. Configure the FTP client settings and commit the configuration.

    Example:

    Router# configure
Router(config)# ftp client passive
Router(config)# ftp client anonymous-password xxxx
Router(config)# ftp client source-interface HundredGigE 0/0/0/0
Router(config)# commit

  2. Verify each FTP client setting.

    Example:

    Router# show running-config ftp client passive
Router# show running-config ftp client anonymous-password xxxx
Router# show running-config ftp client source-interface HundredGigE 0/0/0/0

TFTP connections

A TFTP connection is a simplified file transfer session that

  • moves files between networked systems

  • usually operates without a username and password, and

  • can use either a router client or a router-based server.

Configure TFTP client connections

Select a consistent source interface for TFTP client traffic.

Procedure

  1. Configure and commit the TFTP client source interface.

    Example:

    Router# configure
Router(config)# tftp client source-interface HundredGigE 0/0/0/0
Router(config)# commit

  2. Verify the client configuration and service registration.

    Example:

    Router# show running-config tftp client source-interface HundredGigE 0/0/0/0
tftp client source-interface HundredGigE 0/0/0/0
Router# show cinetd services
Vrf Name Family  Service  Proto Port     ACL max_cnt  curr_cnt  wait   Program Client Option     
default  v4      tftp     udp    69  				unlimited  0       wait   tftpd    sysdb disk0:         
default  v4      telnet   tcp    23  				10         0       nowait telnetd  sysdb

TFTP servers

A router-based TFTP server is a file service that

  • responds to requests from reachable TFTP client routers

  • provides files such as system images or configurations from router storage, and

  • reduces the need for a dedicated server on each network segment.

Table 2. Feature History Table

Feature Name

Release Information

Feature Description

TFTP Server support in Router

Release 7.5.4

You can now configure the Cisco 8000 Series Router as a TFTP server to serve requests from client routers. This capability reduces costs and time delays in your network by eliminating the redundancy of having a machine that acts only as a server on every network segment.

This feature introduces the following commands:

Configure a router as a TFTP server

Provide files to TFTP clients from a router storage directory.

Before you begin

  • Verify reachability between the server and client routers with ping.

  • Create any destination file before a client sends a write request.

Procedure

  1. Configure the TFTP server home directory and commit the configuration.

    Example:

    Router# configure
Router(config)# tftp ipv4 server homedir disk0:
Router(config)# commit

  2. Verify the server configuration.

    Example:

    Router# show running-config tftp ipv4 server homedir disk0:
tftp vrf default ipv4 server homedir disk0:

  3. Verify that Cisco inetd registered the TFTP service.

    Example:

    Router# show cinetd services
Vrf Name Family Service     Proto Port ACL  max_cnt  curr_cnt wait  Program Client Option        
default  v4       tftp        udp   69      unlimited 0       wait   tftpd   sysdb disk0:         
default  v4       telnet      tcp   23      10        0       nowait telnetd sysdb

SCP transfers

Secure Copy Protocol (SCP) is a file transfer protocol that

  • uses SSHv2 to provide secure and authenticated transfers

  • supports both client and server operations on Cisco IOS XR devices, and

  • copies one file between a local device and a remote device.

A device acts as an SCP server when it receives an SCP request. The SSH server starts a new SCP server instance for each incoming subsystem request.

A device acts as an SCP client when it sends a file transfer request to another device.

SCP transfer limitations

SCP transfers have these limitations.

  • SCP transfers one file at a time.

  • SCP cannot copy a file directly between two remote devices.

  • The SSH server process must run on a destination that acts as the SCP server.

How SCP transfers files

SCP uses an authenticated SSHv2 connection to transfer a file between a local device and a remote device.

Summary

The process uses these roles.

  • Client: Starts the SSH connection and requests the file transfer.

  • Server: Starts a new SCP instance for each incoming subsystem request.

  • Source: Reads the file from its local directory and sends it to the destination.

  • Sink: Receives the file at the destination.

Workflow

These stages describe how SCP transfers a file.

  1. The client starts an SSHv2 connection to the remote device and requests a file transfer.

  2. The SSH server starts an SCP server instance for the incoming request.

  3. The device that provides the file operates in source mode, and the receiving device operates in sink mode.

  4. The source reads the file from its local directory and sends it through the authenticated connection to the sink.

Result

The file is available on the selected local or remote destination.

Transfer a file with SCP

Securely copy an individual file to or from a remote device.

Before you begin

Ensure that the SSH server process runs on a destination that acts as the SCP server.

SCP cannot transfer multiple files or copy a file directly between two remote devices.

Procedure

  1. Copy the local file to the remote destination and enter the remote password when prompted.

    Example:

    Router# scp /harddisk:/test123.txt user@192.0.2.10:/remote/test123.txt
Connecting to 192.0.2.10...
Password:

  2. Verify that the destination contains the file.

    Example:

    remote-host:/remote> ls -altr test123.txt

The specified file exists at the remote destination.

Optional RPM packages for FTP, TFTP, and RCP protocols and services

Optional RPM packages for insecure protocols and services is a feature that

  • removes FTP, TFTP, and RCP insecure protocol features from the default base system image,

  • makes these services available only through explicit installation of optional RPMs, if supported on the platform, and

  • reduces the system attack surface by requiring administrators to actively opt in to use any insecure features.

Table 3. Feature History Table

Feature Name

Release Information

Feature Description

Optional RPM packages for FTP, TFTP, and RCP protocols and services

Release 26.4.1

Introduced in this release on: Fixed Systems (8200 [ASIC: Q200, P100], 8700 [ASIC: P100, K100], 8010 [ASIC: A100]); Centralized Systems (8600 [ASIC:Q200]); Modular Systems (8800 [LC ASIC: Q100, Q200, P100])

Optional RPM packaging for FTP, TFTP, and RCP is a platform security feature that removes these insecure file-transfer features from the Cisco IOS XR base image on supported platforms. The supported functionality becomes available only through the required optional RPMs, and related configuration or commands are blocked unless the RPMs are installed. Migration to secure alternatives such as SCP and SFTP is encouraged.

Client package behavior

The packaging change removes FTP and TFTP client support from the IOS XR base image. This affects how protocol components are included in the system image but does not change their runtime behavior when the required optional RPM is installed.

FTP and TFTP features are deprecated. If an administrator configures these services, the system generates syslog warnings every 30 days while insecure features remain in use.

Optional RPM requirements

Use this reference to identify the optional RPMs required for FTP, TFTP, and RCP client operations and TFTP server features on each supported platform type.

  • Supported non-optical platforms: FTP, TFTP, and RCP client operations require the IP-INSECURE-APPS optional RPM. TFTP server operation requires the TFTP optional RPM and depends on IP-INSECURE-APPS.

  • Supported optical platforms: FTP, TFTP, and RCP client operations require the IP-INSECURE-APPS optional RPM. The TFTP server is not supported.

Managing upgrades and downgrades with configured FTP and TFTP features

This process applies when a supported device with FTP or TFTP configuration is upgraded to release 26.4.1 or downgraded after the upgrade.

Summary

  • The customer prepares the image and optional RPM selection.

  • The install manager processes the upgrade or downgrade.

  • CfgMgr reports configuration inconsistency when the committed configuration needs an optional RPM that is absent.

The process preserves the FTP and TFTP feature behavior when the required optional RPMs are included. It reports an inconsistency when configured features are not present in the image.

Workflow

These are the stages of managing upgrades and downgrades with configured FTP/TFTP features.

  1. The customer selects a secure replacement such as SSH, SCP, or SFTP, or includes the IP-INSECURE-APPS optional RPM with the image using a Golden ISO.

  2. The install manager upgrades the supported device to release 26.4.1. If FTP or TFTP is configured without IP-INSECURE-APPS, the device raises a configuration inconsistency alarm.

  3. The customer clears the configuration inconsistency before modifying configuration when the alarm is raised.

  4. The install manager processes a downgrade through chassis reload, install replace with a GISO, or normal downgrade. The downgrade is seamless for FTP and TFTP feature functionality; a normal downgrade can be rejected when a required RPM is missing.

  5. If a TFTP server configuration came from the TFTP optional RPM, a downgrade to a release that does not include the required TFTP optional RPM can raise a CfgMgr inconsistency alarm.

TFTP and FTP client configuration commands

Use this reference to identify configuration commands affected by the optional RPM packaging change.

Table 4. Configuration commands and package requirements

Feature

Command

Required optional RPM

TFTP client

  • ip tftp client dscp <> or tftp client dscp <>

  • ip tftp client retries <> or tftp client retries <>

  • ip tftp client source-interface <> or tftp client source-interface <>

  • ip tftp client timeout <> or tftp client timeout <>

  • ip tftp client vrf <WORD> or tftp client vrf <WORD>

IP-INSECURE-APPS

TFTP server

  • ip tftp server homedir <>

  • tftp server homedir <>

  • tftp vrf <WORD> ipv4 server homedir <>

  • tftp vrf <WORD> ipv6 server homedir <>

TFTP and IP-INSECURE-APPS

FTP client

  • ip ftp client anonymous-password <> or ftp client anonymous-password <>

  • ip ftp client passive or ftp client passive

  • ip ftp client password <WORD/clear/encrypted> or ftp client password <WORD/clear/encrypted>

  • ip ftp client source-interface <> or ftp client source-interface <>

  • ip ftp client username <> or ftp client username <>

  • ip ftp client vrf <> or ftp client vrf <>

IP-INSECURE-APPS

Use FTP, TFTP, and RCP exec commands

Use FTP, TFTP, and RCP operations on supported platforms through the supported optional RPM packages.

FTP and TFTP client functionality is removed from the IOS XR base image in Release 26.4.1. The affected exec command families include copy, utility, load, install, and script add.

Before you begin

Install the IP-INSECURE-APPS optional RPM before using FTP, TFTP, or RCP client operations. Install the TFTP optional RPM as well when using TFTP server operations on non-optical supported platforms.

Procedure

  1. Enter the FTP, TFTP, or RCP exec command.

    Example:

    RP/0/RP0/CPU0:ios# install source ftp:
RP/0/RP0/CPU0:ios# install source tftp:
RP/0/RP0/CPU0:ios# install add source ftp:
RP/0/RP0/CPU0:ios# install add source tftp:
RP/0/RP0/CPU0:ios# install replace ftp:
RP/0/RP0/CPU0:ios# install replace tftp:
RP/0/RP0/CPU0:ios# copy ftp: harddisk:
RP/0/RP0/CPU0:ios# copy harddisk: ftp:
RP/0/RP0/CPU0:ios# copy tftp: harddisk:
RP/0/RP0/CPU0:ios# copy harddisk: tftp:
RP/0/RP0/CPU0:ios# load ftp:
RP/0/RP0/CPU0:ios# load tftp:

  2. Check that the operation is accepted and functions normally.

    When the required optional RPM is installed, the corresponding commands are functional. When it is absent, the commands are unavailable and the applicable syslog warning is emitted.

The FTP, TFTP, and RCP exec operation completes when its required optional RPM is installed.

YANG behavior without optional RPMs

Use this reference to identify the expected YANG and CfgMgr behavior when FTP or TFTP optional RPM support is unavailable.

Table 5. YANG model behavior

YANG model

Behavior when required RPM is missing

Applicable feature

Cisco-IOS-XR-ipv4-filesystems-cfg.yang

Returns an unknown-namespace error indicating that the model is unavailable.

FTP and TFTP client

Cisco-IOS-XR-shellutil-copy-act.yang

FTP and TFTP copy operations fail with “ERROR: FTP-TFTP optional rpm not installed.”

FTP and TFTP copy operations

Cisco-IOS-XR-ip-tcp-cfg.yang

TFTP server configuration fails with “Operation not supported: tftp optional rpm is not installed.”

TFTP server

Cisco-IOS-XR-um-ftp-tftp-cfg.yang

FTP and TFTP client configuration is rejected by CfgMgr.

FTP and TFTP client

The affected YANG model inventory also includes Cisco-IOS-XR-config-autosave-cfg and Cisco-IOS-XR-spirit-install-act. Other configuration nodes in these models are not affected.