TFTP, FTP, and SFTP Comparison

TFTP (Trivial File Transfer Protocol), FTP (File Transfer Protocol), and SFTP (SSH File Transfer Protocol) are all used to transfer files between network devices, but they differ dramatically in reliability, security, and complexity. On Cisco devices, these protocols are commonly used to backup and restore configurations, upgrade IOS images, and transfer logs. The CCNA exam expects you to know the key differences, especially which one to use in a given scenario.

TFTP was designed in the 1980s as a lightweight alternative to FTP. It runs over UDP port 69 and uses a simple lock-step protocol: each data packet must be acknowledged before the next is sent. It has no authentication, no directory listing, and no security. Its simplicity makes it easy to implement in firmware, which is why it's still used for booting diskless workstations and for quick file transfers on local trusted networks.

FTP, defined in RFC 959, runs over TCP and uses two connections: a control connection on port 21 and a data connection on port 20 (active mode) or a negotiated high port (passive mode). FTP provides authentication (username/password), directory navigation, and file management commands. However, both credentials and data are transmitted in cleartext unless FTP over TLS/SSL (FTPS) is used—but Cisco exam objectives treat FTP as insecure.

SFTP is not FTP over SSH—it is a completely different protocol that runs as a subsystem of SSH (typically on port 22). It provides file transfer with encryption, integrity checking, and strong authentication (password or public key). Cisco IOS supports SFTP as a client starting from certain versions, but it is not a full SFTP server. For the exam, remember that SFTP is the most secure option and is preferred when transferring sensitive data over untrusted networks.

TFTP (UDP-based): - The client sends a Read Request (RRQ) or Write Request (WRQ) to the server on UDP port 69. - The server responds with the first data packet (512 bytes or less) from a source port (usually 69) to the client's ephemeral port. For WRQ, the server sends an ACK first, then data. - The client sends an ACK for each data packet. Each data packet has a block number (starting at 1). The ACK contains the block number of the packet being acknowledged. - If a packet is lost, the sender retransmits after a timeout (default 5 seconds, but configurable). Because it's UDP, there is no congestion control or windowing. - The last data packet is less than 512 bytes (unless the file size is exactly a multiple of 512). The receiver knows the transfer is complete when it receives a packet smaller than 512 bytes. - No authentication or encryption. The only error detection is the UDP checksum.

FTP (TCP-based): - The client opens a TCP control connection to the server on port 21. Authentication (username/password) is sent in cleartext. - The client can request active or passive mode. In active mode, the server opens a TCP data connection from port 20 to the client's ephemeral port. In passive mode, the client opens a TCP data connection to a server port (usually a high port) negotiated via the control connection. - Data transfer occurs over the data connection using TCP, which provides reliability, flow control, and congestion control. - After transfer, the control connection remains open for further commands (e.g., directory listing, delete). - FTP uses separate ports for control and data, which can complicate firewall rules.

SFTP (SSH-based): - The client establishes an SSH connection to the server on port 22. This involves TCP handshake, SSH version negotiation, key exchange, and authentication (password or public key). All traffic is encrypted. - Once the SSH session is established, the client requests an SFTP subsystem. The server responds with an SFTP version packet. - File transfer uses the SFTP protocol messages (e.g., SSH_FXP_OPEN, SSH_FXP_READ, SSH_FXP_WRITE, SSH_FXP_CLOSE) encapsulated in the encrypted SSH channel. - Reliability is provided by TCP underneath SSH. Integrity is ensured by SSH's MAC (Message Authentication Code). - No separate data connection—everything goes over the single SSH connection.

TFTP: - Default timeout: 5 seconds for retransmission. - Maximum retransmissions: Usually 5 (varies by implementation). - Block size: 512 bytes (can be larger with TFTP options negotiation, but Cisco defaults to 512). - Ports: Client uses ephemeral UDP port; server listens on UDP 69.

FTP: - Control port: TCP 21. - Data port: TCP 20 (active mode) or negotiated high port (passive mode, typically >1023). - Default timeout for idle control connection: 15 minutes (varies by server). - Transfer mode: Stream (default) or block.

SFTP: - Port: TCP 22 (shared with SSH). - Authentication: Password or public key. - Encryption: Depends on SSH configuration (e.g., AES, 3DES). - No separate data port.

To copy files using TFTP, FTP, or SFTP, use the copy command:

Router# copy running-config tftp://192.168.1.100/config.txt
Address or name of remote host [192.168.1.100]?
Destination filename [config.txt]?
!!
1024 bytes copied in 1.234 secs (830 bytes/sec)

For FTP:

Router# copy running-config ftp://user:pass@192.168.1.100/config.txt

For SFTP:

Router# copy running-config sftp://user@192.168.1.100/config.txt

To verify file transfer success, use dir on the flash:

Router# dir flash:
Directory of flash:/
1  -rw-    1024    Jan 1 2025 00:00:00 +00:00  config.txt

To configure FTP username and password globally (for FTP transfers that don't embed credentials in the URL):

Router# configure terminal
Router(config)# ip ftp username admin
Router(config)# ip ftp password cisco123

To set TFTP timeout:

Router(config)# ip tftp timeout 10

In enterprise networks, TFTP is often used for quick, local transfers within a data center or lab. For example, a network engineer might use TFTP to back up the config of a core switch before a major change. The engineer sets up a TFTP server on their laptop, connects to the switch's management IP, and issues the copy command. The transfer is fast and simple, but there is no encryption—anyone sniffing the network can see the config. This is acceptable on a physically secure, isolated management network.

FTP is sometimes used for transferring large IOS images to routers in a staging area. The engineer can use FTP's directory listing to verify files before transfer. However, because FTP sends passwords in cleartext, it is often replaced by SFTP or SCP in production. A common pitfall is forgetting to configure passive mode when the client is behind a firewall—active FTP will fail because the server cannot initiate a connection to the client. Many Cisco devices default to passive mode for FTP, but it's worth checking.

SFTP is the go-to for secure transfers, especially over the internet or untrusted networks. For instance, an enterprise with branch offices might use SFTP to push configuration updates to routers at remote sites. The SSH tunnel ensures that even if the traffic is intercepted, the contents remain confidential. However, SFTP requires more CPU overhead due to encryption, so for very large files (e.g., 100 MB IOS images), the transfer may be slower than TFTP. Some organizations use SCP (Secure Copy) instead, which is also over SSH and is often faster for file transfers. Cisco devices support SCP as well, but the exam focuses on SFTP.

Misconfiguration can lead to failed transfers. For example, if the TFTP server is not running or the file path is incorrect, the router will timeout after several retries. For FTP, a common error is 'Invalid username or password'—the router prompts for credentials if not provided in the URL. For SFTP, the router must have an SSH client configured (the ip ssh command is not needed for the client, but the server must support SFTP).