# Cisco IOS Image Management > Chapter 235 of the Courseiva CCNA curriculum — https://courseiva.com/learn/ccna/ios-image-management ## Introduction Cisco IOS image management is a critical skill for any network engineer, as it involves upgrading, backing up, and restoring the operating system that powers Cisco devices. On the CCNA 200-301 exam, you must understand the commands and procedures for managing IOS images, including the use of TFTP, FTP, and USB storage. This chapter covers the essential steps, from verifying the current image to performing a successful upgrade, ensuring you can maintain and troubleshoot devices in production networks. ## The Phone OS Upgrade Analogy What happens when your smartphone requires a major OS upgrade? First, you check the current version in Settings (like 'show version' on a Cisco router). Then you download the new OS file from a trusted server—say, Apple's update server—over the internet (like using TFTP or FTP to copy the IOS image from a server). The download might take a while, and your phone ensures the file is intact by verifying its checksum (similar to 'verify /md5' on Cisco). Once downloaded, the phone prepares to install: it backs up your data (like copying the running-config to startup-config), then reboots into recovery mode (like setting the boot variable and reloading). During the install, the phone replaces the old OS with the new one—if the power fails or something goes wrong, the phone could be bricked (like a router that can't boot if the image is corrupted). After the install, the phone boots into the new OS, and you check the version again to confirm success. This mirrors the Cisco IOS upgrade process: copy the image, set the boot system, reload, and verify. ## Core explanation ### What is Cisco IOS Image Management? Cisco IOS (Internetwork Operating System) is the software that runs on Cisco routers and switches. Managing these images involves tasks such as upgrading to a new version, backing up the current image, restoring from a backup, and ensuring the device boots correctly. The CCNA 200-301 exam expects you to know the commands and procedures for these tasks, including the use of TFTP, FTP, SCP, and USB storage. ### Why It Matters Network devices require periodic updates to fix bugs, add features, or comply with security policies. An incorrect upgrade can render a device unbootable, causing network outages. Understanding image management ensures you can safely upgrade devices and recover from failures. ### Key Concepts - **IOS Image File**: The binary file containing the operating system, typically named like `c2900-universalk9-mz.SPA.152-4.M7.bin`. The filename encodes platform, feature set, compression, and version. - **Boot System Variable**: A configuration command that tells the router where to find the IOS image on the next reload. Set via `boot system` command. - **Configuration Register**: A 16-bit value that controls the boot process, including whether the router loads the startup configuration or enters ROMmon. The default is `0x2102`. - **TFTP/FTP/SCP Servers**: Common protocols to transfer images. TFTP is simple but unreliable (no authentication), FTP supports authentication, and SCP provides secure transfer. - **ROMmon**: The bootstrap program that runs if the IOS image is missing or corrupted. Allows low-level recovery. ### Step-by-Step Mechanism 1. **Verify Current Image and Space**: Use `show version` to see the current IOS version and `show flash:` or `dir flash:` to list files in flash memory. Ensure enough free space for the new image. 2. **Obtain the IOS Image**: Download the correct image from Cisco.com or your internal server. The image must match the hardware platform and feature set. 3. **Transfer the Image**: Use `copy tftp: flash:` or `copy ftp: flash:` to copy the image to the device. Provide the server IP, source filename, and destination filename. The command shows progress and verifies the copy. 4. **Set Boot Variable**: Configure `boot system flash:/` in global configuration mode. This tells the router which image to load on next reboot. 5. **Save Configuration**: Write the running config to startup config with `write memory` or `copy running-config startup-config`. 6. **Reload and Verify**: Issue `reload` to reboot. After reload, use `show version` to confirm the new IOS version is running. ### IOS CLI Verification Commands ``` Router> show version Cisco IOS Software, C2900 Software (C2900-UNIVERSALK9-M), Version 15.2(4)M7, RELEASE SOFTWARE (fc1) ... System image file is "flash:c2900-universalk9-mz.SPA.152-4.M7.bin" ``` ``` Router> show flash: flash:/ -rw- 12345678 Jan 1 2020 00:00:00 +00:00 c2900-universalk9-mz.SPA.152-4.M7.bin -rw- 12345 Jan 1 2020 00:00:00 +00:00 other-file ``` ``` Router# copy tftp: flash: Address or name of remote host []? 192.168.1.100 Source filename []? c2900-universalk9-mz.SPA.152-4.M7.bin Destination filename [c2900-universalk9-mz.SPA.152-4.M7.bin]? Accessing tftp://192.168.1.100/c2900-universalk9-mz.SPA.152-4.M7.bin... Loading... !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! [OK - 12345678 bytes] ``` ### Interaction with Configuration Register The configuration register (config-register) controls boot behavior. Default `0x2102` means: load IOS from flash, load startup-config. If set to `0x2142`, the router ignores startup-config (password recovery). If set to `0x2100`, the router boots into ROMmon. Use `show version` to see the current config-register value. ## Real-world context In an enterprise network, IOS upgrades are planned during maintenance windows to minimize downtime. For example, a company with a pair of redundant routers can upgrade one at a time, ensuring no single point of failure. The network engineer first tests the new image in a lab environment that mirrors production. Then, during the maintenance window, the engineer copies the image to the router via a secure method like SCP, sets the boot variable, and reloads. If the upgrade fails, the engineer can fall back to the previous image by setting the boot variable to the old image and reloading again. Another common scenario is recovering a router that has a corrupted or accidentally deleted IOS. The router boots into ROMmon, where the engineer can use `tftpdnld` command to download a new image from a TFTP server directly into memory. This requires configuring the management interface with an IP address and ensuring connectivity to the TFTP server. For switches, the process is similar but often involves the `archive` command or USB auto-upgrade. Performance considerations: Copying large images over slow WAN links can take a long time. Engineers often use FTP or SCP for faster transfers, or physically copy the image to a USB drive and insert it into the router. Misconfigurations like setting the wrong boot variable or forgetting to save the configuration can cause the router to boot from an unintended image. Always double-check the boot statements and have a backup plan, such as keeping the old image in flash until the new one is verified. ## Exam focus The CCNA 200-301 exam tests IOS image management under the 'Network Access' and 'Infrastructure Management' objectives. You need to know the exact commands and the order of operations. Common wrong answers include: 1. **Using `copy flash: tftp:` to upgrade**: This copies FROM flash TO TFTP, which is a backup operation, not an upgrade. Candidates often confuse the direction. 2. **Setting `boot system` after reloading**: The boot variable must be set BEFORE reload. If you reload first, the router will boot using the current boot variable (still pointing to the old image). 3. **Forgetting to save the configuration**: If you set the boot variable but don't save, the router will revert to the old boot variable on reload. 4. **Using `reload` without confirming**: The reload command prompts for confirmation; if you don't confirm, the reload is cancelled. Specific values: The default config-register is `0x2102`. The command to copy from TFTP is `copy tftp: flash:`. The verification command is `show version`. The command to set boot is `boot system flash:/filename.bin`. Calculation traps: None for this topic, but you should know that the image filename includes version information. For example, `c2900-universalk9-mz.SPA.152-4.M7.bin` indicates version 15.2(4)M7. Decision rule: If the question asks about upgrading, the correct sequence is: copy image, set boot system, save config, reload, verify. If it asks about backing up, the sequence is: copy flash: tftp: (or ftp:). ## Step by step 1. **Verify Current IOS and Flash Space** — Before any upgrade, check the current IOS version and available space in flash memory. Use `show version` to see the running image name and version. Use `show flash:` or `dir flash:` to list files and their sizes. Ensure you have enough free space for the new image. If space is insufficient, delete old images using `delete flash:/old-image.bin`. Be careful not to delete the current running image unless you have a backup. 2. **Obtain the Correct IOS Image** — Download the appropriate IOS image from Cisco.com (requires a valid service contract) or from your internal software repository. The image filename includes platform, feature set, and version. For example, `c2900-universalk9-mz.SPA.152-4.M7.bin` is for a Cisco 2900 series with universal feature set, version 15.2(4)M7. Ensure the image is compatible with your hardware and has the required licenses. 3. **Copy the Image to Flash via TFTP** — Use the `copy tftp: flash:` command. You will be prompted for the TFTP server IP address, source filename, and destination filename. The router will download the file and store it in flash. The exclamation marks indicate progress. After completion, verify the file is present with `show flash:`. If using FTP, use `copy ftp: flash:` and provide username/password. For SCP, use `copy scp: flash:` (requires SSH server). 4. **Set the Boot System Variable** — In global configuration mode, set the boot variable to point to the new image: `boot system flash:/new-image.bin`. This tells the router which image to load on the next reload. You can specify multiple boot statements; the router tries them in order. To remove old boot statements, use `no boot system` commands. Verify with `show run | include boot system`. 5. **Save Configuration and Reload** — Save the running configuration to startup configuration using `write memory` or `copy running-config startup-config`. Then issue `reload` to reboot the router. The router will prompt you to confirm. After reload, the router should load the new IOS image. If the image is corrupted or missing, the router may fall back to ROMmon. 6. **Verify the Upgrade** — After the router reloads, use `show version` to confirm the new IOS version is running. Check the uptime to ensure it matches the reload time. Also verify that all interfaces come up and the router functions correctly. If the image fails to load, you may need to boot from a backup image or use ROMmon recovery. ## Comparisons ### TFTP vs FTP **TFTP:** - Uses UDP port 69 - No authentication or encryption - Simple to set up, no user credentials - Limited to 32MB file size (some implementations) - No directory listing **FTP:** - Uses TCP ports 20 and 21 - Supports username/password authentication - More reliable due to TCP - No file size limitation - Supports directory listing and file management ## Common misconceptions - **Misconception:** The `copy tftp: flash:` command copies FROM flash TO tftp. **Reality:** The syntax is `copy `. So `copy tftp: flash:` copies FROM tftp TO flash. (Candidates often reverse the source and destination because they think of 'copy to tftp'.) - **Misconception:** You can upgrade the IOS by simply overwriting the old image in flash. **Reality:** You must set the boot variable to the new image before reloading; otherwise, the router will still boot the old image. (Candidates assume the router automatically uses the newest image.) - **Misconception:** The `reload` command immediately reboots the router. **Reality:** The `reload` command prompts for confirmation and can be cancelled within 60 seconds by default. (Candidates think reload is immediate, but it actually waits for confirmation.) - **Misconception:** The configuration register 0x2102 means the router ignores the startup configuration. **Reality:** 0x2102 means the router loads the IOS from flash and loads the startup configuration. 0x2142 ignores startup config. (The numbers are similar, leading to confusion.) ## Key takeaways - Use `show version` to display current IOS version and uptime. - Use `show flash:` to list files in flash memory. - The `copy tftp: flash:` command downloads an image from a TFTP server to flash. - Set the boot variable with `boot system flash:/filename.bin` in global config. - Always save the configuration with `write memory` before reloading. - The default configuration register is 0x2102. - In ROMmon, use the `tftpdnld` command to recover a missing IOS. ## FAQ **What is the difference between `copy tftp: flash:` and `copy flash: tftp:`?** `copy tftp: flash:` copies a file from a TFTP server to the router's flash memory (used for upgrades). `copy flash: tftp:` copies a file from flash to a TFTP server (used for backups). The source is always first, destination second. Remember: 'copy from to'. **How do I recover a router that has no IOS image?** When a router has no valid IOS image, it boots into ROMmon (ROM Monitor). From ROMmon, you can use the `tftpdnld` command to download an IOS image via TFTP. First, set the management interface IP, TFTP server IP, and filename using `set` commands. Then run `tftpdnld`. Alternatively, you can use Xmodem via console, but it is very slow. **What does the configuration register 0x2102 do?** 0x2102 is the default configuration register value. It means: 1) The router boots from flash (first valid IOS image) or netboot if flash fails. 2) The router loads the startup configuration. 3) The console break is disabled. Changing the last digit to 1 (0x2101) boots from ROMmon, and to 4 (0x2142) ignores startup config. **Can I upgrade IOS via the console port?** Yes, but it is extremely slow. You can use Xmodem or Ymodem protocols via the console cable. The command is `copy xmodem: flash:` on the router, then send the file from your terminal emulator. This is only practical for small images or emergency recovery when no network access is available. **What is the boot system command and how do I use it?** The `boot system` command in global configuration mode specifies which IOS image to load on the next reboot. For example: `boot system flash:/c2900-universalk9-mz.SPA.152-4.M7.bin`. You can enter multiple `boot system` commands; the router tries them in order. Use `no boot system` to remove entries. Always save the configuration after setting. **How do I verify that an IOS image is not corrupted after copying?** After copying, you can verify the file's integrity using the `verify /md5 flash:/filename.bin` command. This computes the MD5 hash and compares it to a known good hash provided by Cisco. If they match, the file is intact. The `show flash:` command only shows the file size, not integrity. **What is the difference between an IOS image and a firmware image on a switch?** For routers, the IOS image is the operating system. For switches, the term 'IOS' is also used, but some switches run IOS-like operating systems (e.g., IOS on Catalyst switches). The management process is similar. However, some switches have separate firmware for the supervisor engine (e.g., on modular switches). Always check the platform documentation. --- Interactive version with quiz and diagrams: https://courseiva.com/learn/ccna/ios-image-management