copy running-config tftp:
Copies the current running configuration from RAM to a TFTP server for backup or distribution.
Definition: copy running-config tftp: is a Cisco IOS privileged exec command. Copies the current running configuration from RAM to a TFTP server for backup or distribution.
Overview
The `copy running-config tftp:` command is a fundamental IOS tool used to back up the active configuration from a router or switch to a TFTP server. This command is critical for network engineers because it provides a quick, reliable method to preserve the current operational state before making changes, after successful troubleshooting, or as part of a regular backup routine. The running configuration resides in RAM and is volatile; without a backup, a device reload or power failure can erase all changes made since the last save to NVRAM (startup-config). By copying to a TFTP server, you create an external, version-controlled copy that can be restored or deployed to other devices.
The underlying concept is straightforward: the device acts as a TFTP client, initiating a file transfer to a remote TFTP server. The command triggers the router to send the running configuration as a text file to the specified server. TFTP uses UDP port 69 and does not provide authentication or encryption, so it should only be used in trusted, isolated management networks. Alternatives include `copy running-config startup-config` (saves locally to NVRAM), `copy running-config ftp:` (FTP with authentication), `copy running-config scp:` (secure copy via SSH), or `archive` commands for automated backups. The TFTP option is chosen for its simplicity and low overhead, but it lacks security.
In a typical workflow, an engineer might first verify the current configuration with `show running-config`, then use `copy running-config tftp:` to back it up before applying changes. After changes are tested, another backup is taken. This command is also used to clone configurations to new devices or to restore a known-good config after a failure. Important IOS behaviors: the command is interactive by default—it prompts for the TFTP server IP and destination filename. You can suppress prompts by providing all parameters inline (e.g., `copy running-config tftp://10.0.0.1/rtr-config`). The output is buffered; the command may take several seconds for large configs. Privilege level 15 (enable) is required. The command does not modify the running config; it only reads it. If the TFTP server is unreachable, the command fails with a timeout or error message. The file transferred is a plain text representation of the running configuration, including all current settings. This command is available in all IOS versions and is a staple for CCNA and CCNP candidates.
copy running-config tftp:When to Use This Command
- Backing up the running configuration before making major changes
- Restoring a known-good configuration to another router
- Distributing a standard configuration to multiple devices
- Archiving configurations for compliance or auditing
Parameters
| Parameter | Syntax | Description |
|---|---|---|
| destination-file | filename (e.g., backup-config.txt) | The filename to save the configuration as on the TFTP server. If omitted, the router prompts for it. Common practice is to include the device hostname and date (e.g., R1-config-20250325.txt). Avoid spaces or special characters; use alphanumeric and hyphens/underscores. |
| tftp-server-address | A.B.C.D (e.g., 10.0.0.1) | The IP address of the TFTP server. If omitted, the router prompts for it. Must be reachable from the device. Ensure the TFTP server is running and has write permissions in its root directory. Common mistake: using an unreachable IP or forgetting to start the TFTP server. |
Command Examples
Basic backup to TFTP server
copy running-config tftp:Address or name of remote host []? 192.168.1.100 Destination filename [router-confg]? router-backup-20250321 !! %Error opening tftp://192.168.1.100/router-backup-20250321 (Permission denied) or Address or name of remote host []? 192.168.1.100 Destination filename [router-confg]? router-backup-20250321 !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! [OK - 12345 bytes] 12345 bytes copied in 0.234 secs (52756 bytes/sec)
The command prompts for the TFTP server IP (192.168.1.100) and filename (router-backup-20250321). The exclamation marks indicate successful transfer progress. The final line shows bytes copied and transfer rate. If permission denied, check TFTP server directory permissions.
Specifying source and destination in one line
copy running-config tftp://192.168.1.100/running-config-backupDestination filename [running-config-backup]? !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! [OK - 12345 bytes] 12345 bytes copied in 0.234 secs (52756 bytes/sec)
By providing the full URL, the command skips the host prompt. It still asks for filename confirmation (press Enter to accept). The output confirms successful copy with byte count and speed.
Understanding the Output
The output begins with prompts for the TFTP server address and filename. After entering the information, the router attempts to connect to the TFTP server. If successful, a series of exclamation marks (!) appear, each representing a successful packet transfer.
The final line shows the total bytes copied, the time taken, and the transfer rate in bytes per second. If the transfer fails, an error message like '%Error opening tftp://...' appears, often due to incorrect IP, no TFTP server running, or permission issues. A successful transfer is indicated by '[OK - <bytes>]' and the byte count.
Watch for 'Permission denied' or 'timeout' errors, which indicate server configuration problems.
Configuration Scenarios
Backup running configuration to TFTP server before a major change
A network engineer needs to upgrade OSPF configuration on a core router. To ensure a rollback is possible, the current running config must be backed up to a central TFTP server at 192.168.1.100.
Topology
R1(Gi0/0)---192.168.1.0/24---TFTP-Server(192.168.1.100)Steps
- 1.Step 1: Verify connectivity to TFTP server: ping 192.168.1.100
- 2.Step 2: Enter privileged EXEC mode: enable
- 3.Step 3: Copy running config to TFTP: copy running-config tftp:
- 4.Step 4: At prompt, enter TFTP server address: 192.168.1.100
- 5.Step 5: At prompt, enter destination filename: R1-config-before-ospf-change.txt
- 6.Step 6: Confirm the transfer: type 'y' or press Enter to accept default
! No configuration changes are made; this is a backup command. Router# copy running-config tftp: Address or name of remote host []? 192.168.1.100 Destination filename [router-confg]? R1-config-before-ospf-change.txt !! 1456 bytes copied in 2.345 secs (621 bytes/sec)
Verify: Verify the file exists on the TFTP server (e.g., check server directory). On the router, you can also use `show file information tftp://192.168.1.100/R1-config-before-ospf-change.txt` to confirm size and accessibility.
Watch out: If the TFTP server is not running or the directory is not writable, the command will timeout or return 'Error opening tftp://...'. Always verify TFTP server status and permissions beforehand.
Restore running configuration from TFTP backup after a failed change
After applying a new ACL on a branch router, connectivity is lost. The engineer must restore the previous running config from a TFTP backup to quickly recover service.
Topology
R2(Gi0/0)---10.10.10.0/24---TFTP-Server(10.10.10.5)Steps
- 1.Step 1: Access the router via console or management IP (if still reachable).
- 2.Step 2: Enter privileged EXEC mode: enable
- 3.Step 3: Copy the backup config from TFTP to running-config: copy tftp: running-config
- 4.Step 4: At prompt, enter TFTP server address: 10.10.10.5
- 5.Step 5: At prompt, enter source filename: R2-config-backup.txt
- 6.Step 6: Confirm the transfer and overwrite the running config.
- 7.Step 7: Verify the restored configuration: show running-config | section access-list
! Restoring from TFTP backup Router# copy tftp: running-config Address or name of remote host []? 10.10.10.5 Source filename []? R2-config-backup.txt Destination filename [running-config]? Accessing tftp://10.10.10.5/R2-config-backup.txt... Loading R2-config-backup.txt from 10.10.10.5 (via GigabitEthernet0/0): ! [OK - 2100 bytes] 2100 bytes copied in 1.234 secs (1702 bytes/sec) %SYS-5-CONFIG_I: Configured from console by console
Verify: Use `show running-config` to confirm the ACL is removed or corrected. Test connectivity with ping to a previously blocked host.
Watch out: Restoring a configuration does not automatically save it to startup-config. After restoration, run `copy running-config startup-config` to make the change persistent. Also, ensure the backup file is from a compatible IOS version; otherwise, commands may be rejected.
Troubleshooting with This Command
When troubleshooting TFTP backup failures, the first step is to verify network connectivity between the router and the TFTP server. Use `ping` from the router to the server IP. If ping fails, check routing, ACLs, and interface status. Next, confirm the TFTP server is running and listening on UDP port 69. On the server, you can use netstat or a TFTP client to test. Common symptoms include: - 'Timeout' or 'Error opening tftp://...' – indicates the server is unreachable or not responding. Check for firewall rules blocking UDP 69, or that the server is on the same VLAN/routed correctly. - 'Permission denied' – the TFTP server directory may be read-only or the file already exists with no overwrite permission. Ensure the server allows writes. - 'Invalid filename' – the filename may contain illegal characters. Use only alphanumeric, hyphens, underscores, and dots. - Partial transfer or corrupted file – often due to network congestion or MTU issues. TFTP uses fixed 512-byte blocks; large configs may cause timeouts. Consider using FTP or SCP for larger files.
A diagnostic flow: 1) Ping TFTP server. 2) Check routing table (`show ip route`). 3) Verify interface status (`show interfaces`). 4) Test TFTP with a small file using `copy tftp: flash:` to isolate the issue. 5) Check server logs. 6) If using Windows TFTP server, ensure it's configured to allow writes. 7) For IOS-XE, the command syntax is identical, but the output may include progress indicators. Correlate with `debug ip tftp` events (use with caution in production) to see packet exchanges. Healthy output shows sequential block acknowledgments; missing ACKs indicate packet loss. Also, ensure the router has sufficient memory; low memory can cause the command to fail silently. Finally, verify the file integrity after transfer by comparing checksums or using `more` on the file.
CCNA Exam Tips
Remember that 'copy running-config tftp:' is a privileged EXEC command; you must be in enable mode.
The TFTP server must be reachable and have appropriate write permissions; the exam may test troubleshooting failed transfers.
The default filename is 'router-confg' (note the missing 'i' in 'config') — a common trick on the exam.
Know that 'copy running-config tftp:' backs up the active configuration, while 'copy startup-config tftp:' backs up the saved configuration.
Common Mistakes
Forgetting to specify the correct TFTP server IP or filename, leading to failed transfers.
Not ensuring the TFTP server is running and accessible from the router (firewall, ACLs).
Confusing 'copy running-config tftp:' with 'copy tftp: running-config' — the latter restores a config, not backs up.
copy running-config tftp: vs show running-config
Both 'copy running-config tftp:' and 'show running-config' are used to examine the active configuration, but they differ in output destination and subsequent actions. They are often confused because both involve the running configuration, yet one creates a remote backup while the other provides a local screen display.
| Aspect | copy running-config tftp: | show running-config |
|---|---|---|
| Action | Copies configuration to TFTP server | Displays configuration on console |
| Output | Writes to file on TFTP server | Prints to terminal session |
| Storage effect | Creates persistent backup on TFTP | No storage change; ephemeral display |
| Network dependency | Requires reachable TFTP server | None; local operation |
| Typical use | Backup or distribute config | Quick inspection or troubleshooting |
| Impact on device | Generates outbound TFTP traffic | No network impact |
Use copy running-config tftp: when you need a persistent copy of the current configuration on a remote TFTP server for backup or replication.
Use show running-config when you need to verify the active configuration locally without altering any files or creating network traffic.
Platform Notes
In IOS-XE (e.g., Catalyst 9000 switches), the `copy running-config tftp:` command works identically to classic IOS, but the output may show a percentage progress bar. The syntax for inline specification is `copy running-config tftp://<server-ip>/<filename>`. On NX-OS (Cisco Nexus switches), the equivalent command is `copy running-config tftp:` as well, but NX-OS also supports `copy running-config tftp://<server-ip>/<filename> vrf <vrf-name>` if the TFTP server is in a non-default VRF.
For ASA firewalls, the command is `copy running-config tftp:` with similar syntax, but the ASA may require the `tftp-server` command to pre-configure the server address. In IOS-XR, the command is `copy running-config tftp://<server-ip>/<filename>` and it uses a different file system structure; the running config is stored in a binary format, but the TFTP copy converts it to ASCII. Note that IOS-XR does not support interactive prompts; all parameters must be provided inline.
For IOS versions 12.x and 15.x, the command behavior is consistent, but 16.x (IOS-XE) may have additional options like `compress` or `encrypt`. Always check the specific platform documentation for any deviations.
Related Commands
Practice for the CCNA 200-301
Test your knowledge with practice questions covering all CCNA 200-301 exam domains.
Practice CCNA 200-301 Questions