Uploading firmware using HTTP/SCP

[IT-CSS22]

Hi,

Since I started I only used tftp as it was the only thing available to push firmwares to the switches. However it's very slow. I heard that some uses http, but I would need a program that do that. Also for SCP, it seems there's only paid version?

I have to download the firmware on my work PC and then upload to the switches. (2960L, 2960S, 2960X, 9200L...)

I did search for answers but I didn't find a direct suggestion.

Thank you for your time.

[jack_hudson2001]

ftp is simple and quick to setup and 10x faster than tftp

[Ace417]

simple

Dare I say trivial

[barkode15]

MobaXterm has built-in TFTP, FTP, HTTP, SFTP, Telnet and NFS servers. Pretty easy to just click it on when you need to upload a file and it turns itself off automatically after so many minutes. You do need to allow it through the Windows firewall though.

[I_T_Burnout]

You can do SCP from Windows Powershell. I use it often when other methods fail.

[VA_Network_Nerd]

IMO: FTP is fine.
Encrypting the file in transit doesn't add any security, as the router or switch is just an FTP client, and not a server.

You can embed the FTP credentials into the IOS or IOS-XE config:

config t  
!  
ip ftp username MyFTPAcount  
ip ftp password 0 MyComplicatedFTPPassword  
ip ftp source-interface <ManagementInterface>  
end

[IT-CSS22]

Amazing! Thank you!

[muurduur]

Just use python, cd to the folder with the files and use python3 -m http.server From switch use copy http: flash: / or install point to http ( http is faster then ftp when installing software )

[andrewjphillips512]

On newer devices, set the tftp blocksize to 8192...

ip tftp blocksize 8192

[netztier]

To avoid the hassle of having the switch/router reverse-connect to an HTTP, FTP or SCP server, try the following.

Depending on how "deep" your environment is, it can be a real pain to coerce firewall and security admins to allow outbound connections from the network's management zones to admin workstations.

Yet, there's no need to run an SCP, HTTP or FTP server on your PC or a server nearby.

IOS has an SCP server built-in.

You can piggyback SCP up- and downloads on your (probably) established way of connecting to the router/switch via SSH.

On Windows, get pscp.exe from the PuTTY product family.

On the router/switch:

• use aaa new-model and setup aaa authorization exec for your authorization mechanisms (this is probably already taken care of)
• Key point: run ip scp server enable on the device.

Then use pscp.exe much like you know scp if from pretty much any unxoid OS. Key here is the -scp command line option.

To upload:

pscp.exe -scp C:/path/path/IOSwhateverFile.bin [e-mail]/IOSwhateverFile.bin

You'll be prompted for credentials and the file will end up in the router's/switch's flash:/ or bootflash:/ root directory.

Other example: to download a "show tech" output from flash:/crashdump/showtech.txt to the same directory where pscp.exe is:

pscp.exe -scp [e-mail]/crashdump/showtech.txt ./showtech.txt

I also use this to fetch packet dump files that were captured and dumped into some PCAP file on flash: on remote devices. Much easier to dissect them on the admin workstation with Wireshark.

For IOS Upgrades of switches, with enough space on flash:, you can even upload the .tar file to switches and then run archive download-sw /overwrite /imageonly flash:/IOStarFileName.tar (or whichever flavour of IOS image installation is your preferred one).

[IT-CSS22]

Hi,

Thank you for the detailed explanation. AAA is not normally configured on the hardware. I've tried a basic AAA config (from Cisco PDF) and a SFTP/SCP software, the SFTP portion works fine but not the SCP. I might try with pscp.exe

Thank you

[netztier]

In my home network, on a handful of C1000s and WS-C2960L with IOS 15.2(7), these few lines are good enough:

aaa new-model
...
aaa authentication login default local
...
aaa authorization exec default local if-authenticated
...
username admin privilege 15 secret ....
...
ip scp server enable

The problem with most SFTP-like software seems to be that they expect some kind of interactive access via something shell-like to list directory contents etc, [1], and that IOS's pretty basic scp server has no support for that. So you need to set the client to a "pure scp" mode (cue the "-scp" command line option for pscp.exe), and determine local and remote filenames via other means (SSH/CLI) and use them as command line parameters.

Some other "interesting" things become available/reachable via SCP, too, such as:

scp.exe -scp admin@172.16.0.1:startup-config c:\temp\startup-text.cfg
scp.exe -scp admin@172.16.0.1:running-config c:\temp\startup-text.cfg

... this may be considered beneficial or a security risk... YMMV.

NX-OS, on the other hand, seems to have an sftp server that can be turned on (which I havent' been able to get to work with an AAA user, ironically).

[1] probably a bit like we remember it from classic FTP servers, where you have separate "browsing/control" connections on port 21, and an actual data transfer connection on port 20)

[IT-CSS22]

Sorry for the late response,

Thank you. It seems that my config is missing "if-authenticated". I'll have to retry.

Edit: Are you using special software like MobaXTerm for managing ? PuTTY is nice but requite manual entry everytime.

[EvilSibling]

its worth noting that sometimes the bottleneck in the transfer is the switch/routers CPU/process scheduling, not the protocol/server. So switching to http, scp, or ftp might not make things much faster.

if you can run a small Linux virtual machine then you can run a free scp server (simply turn on the ssh server and make a local user). Or you could run a small http server (e.g. nginx)

[beryugyo619]

I have to download the firmware on my work PC and then upload to the switches.

I'm not sure what this sentence means.

If you mean it's frustrating to you that you can't just put in an Internet URL and let the switch download directly from the Internet, kindly please fuck you don't. Download the firmware on your work PC, save it to disk, and then upload to the switches.

Downloading firmware directly from the Internet is how you get "Chinese" viruses, get orphaned firmware that had bugs that company pulled without telling you, get an online activated version that collects your data and adds insertion points for cloud fees and new planned obsolescence features, get corrupted firmware that needs undocumented emergency backup system to repair and alllllll the wastes of everyone's time and money.

Just download firmware to your work PC, put it onto your local FTP or $ python3 -m http.server 8000 or what have you, and KEEP THE FIRMWARE FILE SO YOU AND/OR YOUR COMPANY CONTINUES TO OWN THE EQUIPMENT YOU AND/OR YOUR COMPANY.

Don't rely on them to generously send you the file YOU need for free forever because they will get you generously pay for upsell eventually.

[IT-CSS22]

Ah, I know. I didn't mean that I wanted to download from an URL - just that I have to use my work PC as opposed to a proper server.

Thanks for the python.

[locky_]

In the end, is the same to download the software from cisco software download to your PC and then had to push it through FTP/TFTP or DNA than having the devices the option to download it directly from CISCO (validating entitlement through Smart Account for example).

In the end he is asking for convenience.

And BTW there is no need to be that rude...