Imagine spending hours configuring a complex network only to have a router fail and lose everything. In the CCNA 200-301 exam and real-world networking, the ability to back up and restore IOS configurations is a fundamental survival skill. This chapter covers how to save your running-config to NVRAM, export it to external servers via TFTP/FTP/SCP, and restore it when disaster strikes. Mastering these operations ensures you can recover from human error, hardware failure, or planned upgrades without rebuilding from scratch.
Jump to a section
Think of a Cisco router's configuration as a detailed architectural blueprint for an office building. The running-config is the live blueprint on the foreman's clipboard — it changes every time a wall is moved or a desk is added. The startup-config is the master blueprint locked in the office safe (NVRAM). When the power goes out, the foreman's clipboard is wiped clean, so the crew must retrieve the master blueprint from the safe to rebuild.
A smart architect doesn't keep only one copy. They make photocopies (backups) of the master blueprint and store them off-site in a fireproof vault (TFTP server, FTP server, or USB drive). If the office safe is destroyed (NVRAM corruption) or the master blueprint is wrong (misconfiguration), the architect can retrieve a known-good copy from the off-site vault and restore it.
Restoring is like bringing that photocopy back to the job site and placing it into the safe. The foreman then copies it to his clipboard (copy startup-config running-config or reload) so the crew works from the correct plan. The entire process — backup and restore — ensures the building is always built to the intended design, even after disaster strikes. The Cisco IOS commands are the tools that make this happen: copy running-config startup-config locks the current plan into the safe, copy startup-config tftp: exports a copy to an external server, and copy tftp: startup-config retrieves a copy from the server to replace the safe's contents.
What Are Configuration Backup and Restore?
Every Cisco device has two main configuration files: the running-config (active in RAM) and the startup-config (stored in NVRAM). The running-config is volatile — it disappears on reload or power loss. The startup-config is non-volatile and is loaded into RAM during boot. Backing up means saving a copy of either config to an external location (TFTP server, FTP server, SCP server, USB flash, or even a text file on your PC). Restoring means copying a saved config back into the device, either as startup-config or directly into running-config.
Why It Matters for CCNA
The 200-301 exam tests your ability to use the correct copy commands, understand the differences between configuration files, and troubleshoot common backup/restore failures. You must know the syntax for TFTP (the most common protocol), the default file locations, and the behavior of commands like copy running-config startup-config (write memory). Exam questions often present a scenario where a router loses its config after reload, and you must identify that the startup-config is missing or corrupted, then choose the correct restore procedure.
Step-by-Step Mechanism
#### 1. Saving Running-Config to Startup-Config
The command copy running-config startup-config (or the alias write memory) writes the current running configuration into NVRAM as the startup-config. This is the simplest backup — it protects against power loss but not against device failure. The file is stored locally.
#### 2. Backing Up to an External Server
To back up to a TFTP server, use:
Router# copy running-config tftp:
Address or name of remote host []? 192.168.1.100
Destination filename [router-confg]? my-backup-config
!!The device sends the config file using TFTP (UDP port 69). The server must be reachable and have write permissions. FTP and SCP work similarly but require authentication. For USB backup:
Router# copy running-config usbflash0:#### 3. Restoring from an External Server
To restore a configuration as the startup-config (so it survives reload):
Router# copy tftp: startup-config
Address or name of remote host []? 192.168.1.100
Source filename []? my-backup-config
Destination filename [startup-config]?
!!To apply it immediately to the running-config (without reload):
Router# copy tftp: running-configThis merges the file with the current running-config. If you want to replace the entire running-config, you should first erase it with erase startup-config and reload, then restore.
#### 4. Erasing Configuration
To completely wipe the startup-config (simulating a fresh device):
Router# erase startup-configAfter reload, the device will boot into setup mode because no startup-config exists.
#### 5. Using the 'archive' Feature
The archive feature provides automatic configuration backup and rollback. It can capture configs at scheduled intervals or before major changes. The command archive enables the feature, and path specifies the backup location.
Key IOS Commands and Verification
show running-config — displays current config in RAM.
show startup-config — displays config in NVRAM.
show flash: — lists files in flash memory (including config backups).
dir usbflash0: — lists files on USB drive.
debug ip tftp — useful for troubleshooting TFTP transfers.
Example output of show flash::
Directory of flash:/
1 -rw- 4567890 <date> c2960-lanbasek9-mz.150-2.SE11.bin
2 -rw- 12345 <date> my-backup-configInteraction with Other Topics
Configuration backup is closely related to IOS image management (backing up IOS images similarly uses copy commands) and to password recovery (where you bypass the startup-config to regain access). It also ties into network automation, where tools like Ansible use SCP to push configs. Understanding the copy command syntax is essential for all these scenarios.
Save Running-Config to NVRAM
The most basic backup: `copy running-config startup-config` (or `write memory`). This writes the current active configuration to NVRAM, ensuring it survives a reload. Always do this after any change. If you forget and the router reloads, you lose all changes. On the exam, if a question says 'the router lost its config after reload', the first check is whether the admin ran this command. Example: `Router# copy running-config startup-config` returns `[OK]`.
Backup to TFTP Server
Use `copy running-config tftp:` to send the config to a remote TFTP server. You'll be prompted for the server IP and filename. Ensure the TFTP server is running and accessible. The default filename is usually the hostname-confg (e.g., Router-confg). If the transfer fails, check connectivity (ping) and TFTP server permissions. Example: `Router# copy running-config tftp:` then enter `192.168.1.100` and `backup-config`.
Backup to USB Flash
If the router has a USB port, you can copy directly to a USB flash drive. Insert the drive, then `copy running-config usbflash0:`. Verify the file with `dir usbflash0:`. This is useful when no network server is available. Example: `Router# copy running-config usbflash0:my-backup`.
Restore Startup-Config from TFTP
To restore a saved config as the startup-config, use `copy tftp: startup-config`. This overwrites the existing startup-config. After reload, the device will use the restored config. If you want to apply it immediately without reload, use `copy tftp: running-config` — but be aware this merges, not replaces. Example: `Router# copy tftp: startup-config` then enter server IP and filename.
Restore Running-Config from TFTP (Merge)
Use `copy tftp: running-config` to merge a saved config into the current running-config. This is useful for adding a few lines without reloading. However, if the saved config contains commands that conflict with existing ones, the merge may produce unexpected results. For a full restore, it's safer to erase startup-config, reload, then copy the saved config as startup-config and reload again.
Erase and Reload for Clean Restore
To completely replace the running-config with a saved one, first erase the startup-config with `erase startup-config`, then reload. The router will boot into setup mode. Then copy the saved config as startup-config and reload again. This ensures no residual commands remain. Example: `Router# erase startup-config`, `Router# reload`, then after boot, `Router# copy tftp: startup-config`, `Router# reload`.
Verify Backup Files
After any backup, verify the file exists and is not truncated. Use `show flash:` or `dir usbflash0:` to list files. For TFTP, check the server's file listing. You can also view the file contents with `more flash:filename` (for text files). On the exam, you may be asked to identify the correct command to verify a backup file.
In a large enterprise network, configuration backup is not optional — it's part of the disaster recovery plan. Network engineers schedule automatic backups of all switches and routers to a central TFTP or SCP server using scripts or tools like RANCID or Ansible. For example, a company with 500 switches might run a cron job every night that SSHes into each switch and executes copy running-config tftp: to a centralized backup server. This ensures that if a switch fails and is replaced, the new switch can be restored with the exact configuration from the previous night.
Another scenario: during a major change window, an engineer takes a manual backup before making changes. They use copy running-config tftp: to save the current state. If the change goes wrong (e.g., a mistyped ACL locks them out), they can restore the previous config by copying it back via copy tftp: startup-config and reloading. This is far faster than re-entering all commands.
Common pitfalls: TFTP has no authentication or encryption, so backups over untrusted networks are a security risk. In production, SCP or FTP with authentication is preferred. Also, TFTP has a 32 MB file size limit (some implementations), so large configs may fail. Always verify the backup file size matches. Misconfiguration: if the backup server IP is incorrect or the server is down, the copy command will timeout. Engineers often script a ping check before the copy.
When a device is replaced, the restore process is critical. The new device is booted with a base config (management IP, VLANs), then the full config is copied via SCP. Engineers must ensure the new device's hardware matches (e.g., interface names) or the config will fail. This is why many organizations standardize on similar hardware models.
The CCNA 200-301 exam tests configuration backup and restore under the topic 'Manage Cisco IOS files and device configurations' (Objective 1.6). Expect 1-2 questions on the correct copy command syntax and file locations. The most common wrong answers involve confusing running-config and startup-config. Candidates often pick copy startup-config running-config when the question asks for a backup to TFTP. Remember: 'backup' always involves an external server, so the command includes tftp:, ftp:, or usbflash0:.
Another trap: the question says 'save the configuration so it survives a reload.' Many candidates choose copy running-config tftp: — but that only saves to an external server, not to NVRAM. The correct answer is copy running-config startup-config (or write memory). The exam loves this distinction.
Specific values: the default TFTP filename is hostname-confg (e.g., Router-confg). The default directory for TFTP on the server is often /tftpboot. Know that copy tftp: running-config merges, not replaces. If the question says 'restore the exact configuration,' the best answer is to erase startup-config, reload, copy tftp: startup-config, and reload again.
Calculation traps: none for this topic, but be aware of file size limits (TFTP 32 MB, but configs are usually small). Decision rule: if the question mentions 'backup to a remote server,' look for tftp: or ftp: in the command. If it says 'protect against power loss,' look for startup-config as the destination. For 'restore after replacement,' the process is erase, reload, copy, reload.
The running-config is volatile; the startup-config is stored in NVRAM and survives reloads.
Use `copy running-config startup-config` or `write memory` to save changes to NVRAM.
Backup to an external server uses `copy running-config tftp:` (or ftp: or scp:).
Restore as startup-config with `copy tftp: startup-config`; to apply immediately, use `copy tftp: running-config` (merge).
For a clean restore, erase startup-config, reload, copy the saved config as startup-config, then reload again.
Verify backup files with `show flash:` or `dir usbflash0:`; check file size.
TFTP uses UDP port 69 and has no authentication; SCP or FTP is preferred for security.
These come up on the exam all the time. Here's how to tell them apart.
copy running-config startup-config
Saves locally to NVRAM
Protects against power loss only
No network requirement
Default command for saving changes
Does not create an external backup
copy running-config tftp:
Saves to remote TFTP server
Protects against device failure
Requires network connectivity and TFTP server
Used for disaster recovery
File can be stored off-site
Mistake
Running-config is automatically saved to NVRAM when you exit the router.
Correct
The running-config is only saved to NVRAM when you explicitly issue `copy running-config startup-config` or `write memory`. Otherwise, changes are lost on reload.
Many beginners assume the router saves automatically, like a word processor's autosave.
Mistake
Copying a config from TFTP to running-config replaces the entire running-config.
Correct
The command `copy tftp: running-config` merges the file with the current running-config. It does not erase existing commands unless they are explicitly overridden by the file. To replace completely, you must erase startup-config, reload, then copy to startup-config and reload.
The word 'copy' suggests overwriting, but IOS merges for running-config.
Mistake
The startup-config is stored in flash memory.
Correct
The startup-config is stored in NVRAM (Non-Volatile RAM), not flash. Flash stores the IOS image and other files. NVRAM is a separate memory region.
Both are non-volatile, so students confuse them. The `show startup-config` command reads from NVRAM.
Mistake
You can backup a configuration by copying it to a TFTP server using the command `copy startup-config tftp:` — that's the same as backing up running-config.
Correct
Yes, you can also backup startup-config with `copy startup-config tftp:`. This is less common because startup-config may be outdated. The exam may ask which file to backup; the answer depends on whether you want the current active config (running) or the saved one (startup).
Students think only running-config is backed up, but both can be.
Reveal each answer, then mark whether you got it right. Score 60%+ to unlock the next chapter.
Running-config is the active configuration stored in RAM. It is volatile and lost on reload or power loss. Startup-config is stored in NVRAM and is loaded into RAM as running-config during boot. Changes to running-config do not affect startup-config until you issue `copy running-config startup-config` or `write memory`. Exam tip: If a question says 'changes are lost after reload', it means the admin forgot to save to startup-config.
You cannot backup both in a single command. The IOS image is stored in flash, and the configuration is in NVRAM or as a file. To backup the IOS, use `copy flash: tftp:` (e.g., `copy flash:c2960-lanbasek9-mz.150-2.SE11.bin tftp:`). To backup the config, use `copy running-config tftp:`. Some third-party tools automate both, but natively they are separate operations.
TFTP uses UDP port 69. Common causes: firewall blocking UDP, TFTP server not running, incorrect IP address, or network connectivity issues. Also, TFTP has a 32 MB file size limit. Use `ping` to test connectivity, check the server's status, and ensure the filename does not contain spaces. On the exam, a timeout error typically points to connectivity problems.
Yes, if the router has a USB port. Use `copy running-config usbflash0:` (or `usbflash1:` for the second port). The USB must be formatted with a FAT32 file system. Verify with `dir usbflash0:`. This is useful when no network is available. Exam tip: Know that the default USB mount point is `usbflash0:`.
The archive feature automates configuration backups. You can configure it to capture the running-config to a specified path (e.g., TFTP) at a set interval or before a `configure terminal` session. For example: `archive` then `path tftp://192.168.1.100/$h-$t` (where $h is hostname, $t is timestamp). It also supports rollback to a previous version. This is more advanced but may appear on the exam.
If you are locked out (e.g., due to a misconfigured ACL), you cannot use remote backup/restore. You need console access. You can perform password recovery by interrupting the boot process and setting the configuration register to ignore startup-config (0x2142). Then reload, the router boots without loading startup-config, allowing you to copy the backup from TFTP or USB. This is a common exam scenario.
The default filename is the router's hostname followed by '-confg'. For example, if the hostname is 'Router', the default is 'Router-confg'. You can override it by typing a different name when prompted. On the exam, you may be asked to identify the default filename.
You've just covered Backing Up and Restoring Configuration — now see how well it sticks with free CCNA 200-301 practice questions. Full explanations included, no account needed.
Done with this chapter?