Compare TFTP, FTP, SCP and SFTP. Which do you use to move images and configs to network devices?
Show the answer
Say this first
TFTP is UDP 69 with no authentication and no encryption, sending one 512-byte block at a time: simple enough for boot ROMs, PXE and IP phones, but slow and insecure. FTP uses TCP 21 for control plus a separate data connection, with credentials in clear text. SCP and SFTP both run over SSH on TCP 22, so they are authenticated and encrypted. SCP only copies files, while SFTP is a full file protocol with listing, resume and rename. For network devices I use SCP or HTTPS and keep TFTP for boot-time cases that have nothing else.
Go deeper
| Protocol | Transport | Authentication | Encryption | Notes |
|---|---|---|---|---|
| TFTP | UDP 69, then ephemeral ports | none | none | lock-step 512-byte blocks by default |
| FTP | TCP 21 control; data from port 20 (active) or to a server port (passive) | user and password in clear | none (FTPS adds TLS) | two connections, painful through NAT |
| SCP | SSH, TCP 22 | SSH | yes | copy only |
| SFTP | SSH subsystem, TCP 22 | SSH | yes | not FTP over SSH, a separate protocol |
TFTP limits
The server answers from a new ephemeral port, so stateful firewalls need a TFTP helper. Block numbers are 16 bits, so with 512-byte blocks a file over about 32 MB fails unless both ends support the blocksize option (RFC 2348) or block number rollover.
SCP on IOS
ip ssh version 2
aaa new-model
aaa authentication login default local
aaa authorization exec default local
ip scp server enablePull an image from a server:
R1# copy scp://admin@10.0.0.5/isr4400-universalk9.17.09.04a.SPA.bin bootflash:
R1# verify /md5 bootflash:isr4400-universalk9.17.09.04a.SPA.binCompare the hash with the one the vendor publishes before you boot it.
OpenSSH 9.0 and later run the SFTP protocol under the scp command by default. To push a file to a
device that only has an SCP server, use scp -O for the legacy protocol.
They will ask next
Why is TFTP so slow over a WAN?
It is lock-step: one block, then wait for its ACK. With 512-byte blocks and a 50 ms round trip that is about 10 KB per second, however fast the link is.
Why does active FTP break through firewalls and NAT?
The server opens the data connection back to the client, to an address and port the client sent inside the PORT command. NAT and firewalls must read and rewrite that payload. Passive mode keeps every connection client-initiated.
Traps
- Saying SFTP is FTP over SSL. That is FTPS. SFTP is part of SSH.
- Assuming TFTP can move a file of any size.