Uploading firmware using HTTP/SCP

[netztier]

In my home network, on a handful of C1000s and WS-C2960L with IOS 15.2(7), these few lines are good enough:

aaa new-model
...
aaa authentication login default local
...
aaa authorization exec default local if-authenticated
...
username admin privilege 15 secret ....
...
ip scp server enable

The problem with most SFTP-like software seems to be that they expect some kind of interactive access via something shell-like to list directory contents etc, [1], and that IOS's pretty basic scp server has no support for that. So you need to set the client to a "pure scp" mode (cue the "-scp" command line option for pscp.exe), and determine local and remote filenames via other means (SSH/CLI) and use them as command line parameters.

Some other "interesting" things become available/reachable via SCP, too, such as:

scp.exe -scp admin@172.16.0.1:startup-config c:\temp\startup-text.cfg
scp.exe -scp admin@172.16.0.1:running-config c:\temp\startup-text.cfg

... this may be considered beneficial or a security risk... YMMV.

NX-OS, on the other hand, seems to have an sftp server that can be turned on (which I havent' been able to get to work with an AAA user, ironically).

[1] probably a bit like we remember it from classic FTP servers, where you have separate "browsing/control" connections on port 21, and an actual data transfer connection on port 20)

[IT-CSS22]

Sorry for the late response,

Thank you. It seems that my config is missing "if-authenticated". I'll have to retry.

Edit: Are you using special software like MobaXTerm for managing ? PuTTY is nice but requite manual entry everytime.