Table Of Contents

Using a TFTP Server

Obtaining a Windows TFTP Server

Enabling UNIX TFTP Support

Enabling TFTP Access on a Sun Solaris System

Enabling TFTP Access on a Linux System

TFTP Download Error Codes

Using a TFTP Server

---

This appendix describes how to use a TFTP server to access PIX Firewall or PDM images. You must have a TFTP or FTP server to install the PIX Firewall software.

You must have an activation key that enables Data Encryption Standard (DES), the more secure 3DES, or AES which PDM requires for support of the Secure Sockets Layer (SSL) protocol. If your PIX Firewall is not enabled for DES, you can have a new activation key sent to you by completing the form at the following website: http://www.cisco.com/pcgi-bin/Software/FormManager/formgenerator.pl?pid=221&fid=324

This section includes the following topics:

•Obtaining a Windows TFTP Server

•Enabling UNIX TFTP Support

•TFTP Download Error Codes

Obtaining a Windows TFTP Server

The Microsoft Windows based TFTP server previously provided by Cisco Systems has been discontinued and is no longer supported by Cisco Systems. This software suffers from a security bug described in (http://online.securityfocus.com/bid/2886). Persons still using the server should consider replacing it with any of the high quality freeware and shareware TFTP servers.

As a historical note, the Cisco TFTP server was released to customers in 1995 and at a time when no other freely available TFTP servers existed. Today, there are many TFTP servers available that can be easily found by searching for "tftp server" on your internet search engine. We do not specifically recommend any particular TFTP implementation.

It is also useful to note that modern versions of Cisco IOS software also support the use of FTP instead of TFTP for loading of images or configuration files. Use of FTP overcomes a number of inherent limitations of TFTP including a lack of security and a 16 MB file size limitation.

Enabling UNIX TFTP Support

The procedure for enabling TFTP access on your workstation varies depending on your operating system.

This section contains the following topics:

•Enabling TFTP Access on a Sun Solaris System

•Enabling TFTP Access on a Linux System

Enabling TFTP Access on a Sun Solaris System

Follow these steps to enable TFTP access on a Sun Solaris system:

---

Step 1 Log in as root.

Step 2 Add or uncomment the following line in your /etc/inetd.conf file:

tftp    dgram   udp     wait    root    /usr/sbin/in.tftpd  in.tftpd

Step 3 Specify the TFTP directory. By default it is /tftpboot unless you append "-s <directory>" in the previous step. View the in.tftpd man page for more information.

Step 4 Either reboot your system or use the following commands to find the "inetd" process and send it the SIGHUP signal to force it to reread the inetd.conf file:

/bin/ps -ef | grep inetd

kill -1 inetd_process_ID

---

Enabling TFTP Access on a Linux System

Follow these steps to enable TFTP access on a Linux system:

---

Note If you use Linux, these steps vary depend on whether or not you are using "inetd" or "xinetd." If you have the file "/etc/inetd.conf," you are using inetd. RedHat 7.0 uses "xinetd."

---

---

Step 1 Log in as root.

Step 2 If you are running Linux with "inetd," add or uncomment the following line in your /etc/inetd.conf file:

tftp    dgram   udp     wait    root    /usr/sbin/tcpd  in.tftpd

If you are running Linux with "xinetd," Edit the /etc/xinetd.d/tftp file as follows:

a. Change the line "disable = yes" to "disable = no."

b. Change the line "user = nobody" to "user = root."

c. If you want to specify a different TFTP directory, replace "/tftpboot" in the line "server_args = -s /tftpboot" with the name of your directory.

Step 3 Enter the following command:

/etc/init.d/xinetd restart

---

TFTP Download Error Codes

PDM cannot be downloaded via TFTP from the PIX Firewall unit's monitor mode. You must use the copy tftp flash:pdm command described in "Installing PDM."

During a TFTP download, non-fatal errors may appear in the midst of dots that display as the software downloads. The error code appears inside angle brackets. Table A-1 lists the code values.

For example, random bad blocks appear as follows:

....<11>..<11>.<11>......<11>...

Also, the display may show "A" and "T" for ARP and timeouts, respectively. Receipt of non-IP packets causes the protocol number to display inside parentheses.

Table A-1 TFTP Error Code Numeric Values 

Error Code	Description
-1	Timeout between the PIX Firewall and TFTP server.
2	The packet length as received from the Ethernet device was not big enough to be a valid TFTP packet.
3	The received packet was not from the server specified in the server command.
4	The IP header length was not big enough to be a valid TFTP packet.
5	The IP protocol type on the received packet was not UDP, which is the underlying protocol used by TFTP.
6	The received IP packet's destination address did not match the address specified by the address command.
7	The UDP ports on either side of the connection did not match the expected values.  This means either the local port was not the previously selected port, or the foreign port was not the TFTP port, or both.
8	The UDP checksum calculation on the packet failed.
9	An unexpected TFTP code occurred.
10	A TFTP transfer error occurred.
-10	The image filename you specified cannot be found. Check the spelling of the filename and that permissions permit the TFTP server to access the file. In UNIX, the file needs to be world readable.
11	A TFTP packet was received out of sequence.

Error codes 9 and 10 cause the download to stop.