First, the essential ideas
- Management access
- Management access lets an authorized operator inspect or change a device. A local console, remote command session, web interface and cloud management service have different paths and trust dependencies.
- SSH and host key
- Secure Shell protects a remote session. A server host key identifies the server to the client; a user credential identifies the operator to the server. Encryption without checking the intended host can protect a connection to the wrong system.
- SCP and SFTP
- Secure Copy Protocol and SSH File Transfer Protocol are different file-transfer mechanisms using SSH. SFTP is not FTP with TLS. Modern OpenSSH scp commonly uses SFTP unless legacy SCP is explicitly requested.
- AAA and VTY
- Authentication, authorization and accounting answer identity, permission and activity-record questions. Virtual terminal lines are IOS remote-session entry points; their configured login and transport policy matters.
- Configuration and software file
- A configuration file records settings and can contain sensitive secrets or hashes. A software image contains executable device software. Copying either file does not install it or prove its trustworthiness.
- Digest and provenance
- A cryptographic digest summarizes file bytes to detect differences. Matching digests support integrity only relative to the compared copies; trusted provenance requires an authenticated source or signed verification.
- Console and prompt
- Open the named GNS3 Console. IOS >, # and (config)# differ from the Linux shell and the sftp> interactive prompt. Type only commands, not prompt labels.
- Rollback boundary
- Removing a test file or restoring a service setting is different from restoring active device configuration. This lab never loads the copied configuration or installs a software image.
The router file is copied to Admin1, then transferred to Files1 using SFTP. This is a complete three-endpoint workflow with explicit platform limits. No copied configuration is applied, and no software is installed. Keep all backup files private because even a disposable configuration can contain credential material.
See the idea
A private backup crosses two verified transfers
Router1 supplies SCP; Admin1 verifies the copy; Files1 supplies the separate supported SFTP endpoint.
Retrieve with SCP
Admin1 retrieves Router1's private file using the documented SCP protocol. Host checking and user authorization remain required.
What this model leaves out: Logical file workflow, not direct cabling. All three hosts connect through Switch1. SFTP runs on Files1, not the selected IOS server; no software is installed.
Full visual explanation and references
Router1's backup reaches Admin1 by SCP, then Files1 by SFTP. Switch1 carries the local traffic; the file is never applied as a restore.
Logical file workflow, not direct cabling. All three hosts connect through Switch1. SFTP runs on Files1, not the selected IOS server; no software is installed.
- Retrieve with SCP
Admin1 retrieves Router1's private file using the documented SCP protocol. Host checking and user authorization remain required.
www.cisco.comwww.cisco.com - Compare local read-backs
Compare two SCP read-backs on Linux: sizes against Router1's count, then SHA-256 values with each other. Agreement checks copy consistency, not independent source integrity or permission to restore.
www.cisco.comsec.cloudapps.cisco.com - Reach the SFTP endpoint
Admin1 transfers the file to Linux Files1 and verifies a downloaded comparison copy. This does not claim SFTP-server support on Router1.
www.rfc-editor.orgwww.cisco.com
One idea at a time
Start with something familiar.
First separate logging into a device from transferring a file. Then identify who is the server for each connection. The same SSH transport can carry a terminal or a file-transfer subsystem, but successful terminal login does not prove every subsystem is enabled.
Why learn this?
An encrypted transfer to the wrong host or path is still a mistake. A successfully copied configuration can contain sensitive data, and applying it blindly can remove management access. File handling needs checks beyond a progress bar.
An everyday comparison
A courier can carry a sealed envelope to a verified recipient. A sealed envelope alone does not prove the recipient is correct, the sender is trusted or the enclosed instructions should be carried out.
What happens in a network
Encryption protects the transfer, host identity identifies the recipient, permissions control access and file verification checks the received bytes. Applying a configuration remains a separate authorized action.
Where the comparison stopsCryptographic protocols and file permissions are not physical seals. A digest from an untrusted sender cannot independently prove that a file is safe or genuine.
Follow one worked example
- Keep an independent recovery path.
Router1's GNS3 Console stays open while remote SSH and SCP are configured and tested.
Why: A remote-access mistake must not force password bypass or a blind reset.
- Verify the endpoint and user separately.
The SSH host key identifies the server; the lab account is then authenticated and authorized for its permitted work.
Why: A correct password does not establish that the server presenting the login is the intended device.
- Copy without applying.
Router1 writes a private bootflash backup, and Admin1 retrieves it using legacy SCP mode where required.
Why: Creating and copying a file should not change the router's active settings.
- Use SFTP where it is supported.
Admin1 uploads the backup to Files1 and downloads a comparison copy. Matching digests check the round trip.
Why: This demonstrates SFTP operations without inventing an SFTP server capability on the chosen IOS release.
Your first small task
On paper, label Router1 as the SCP server, Admin1 as the client and Files1 as the SFTP server. Explain what happens if terminal SSH succeeds but the IOS SCP service is disabled.
Show a hint
SSH is the protected transport; the requested application within that connection still needs to be available.
Check the expected result
The terminal can remain usable while the file-transfer operation fails. Server subsystem support and authorization must be checked separately from SSH connectivity.
Pause and explain it in your own words
The backup digest matches after transfer. Is it now safe to load into a different router?
Show a hint
Integrity of bytes does not establish platform compatibility, intended settings or authorization.
Show the explanation
No. The matching digest only compares the copies. Loading requires a separate approved change, compatible platform and interfaces, review of sensitive settings and a tested recovery plan.
Short answer
What should you understand today?
Secure administration requires the intended host, an authorized user, limited management exposure and verified file handling. SSH protects sessions; SCP and SFTP transfer files through SSH but are not interchangeable server capabilities. Verify identity, destination, permissions and copied bytes. Copying a configuration or software image does not restore settings, install software or prove the file is trusted.
Before you begin
Learning targets
- Review Day 15 running versus startup configuration and safe Console recovery.
- Use GNS3 2.2.55 with one entitled C8000v IOS XE 17.12.1a, two Ubuntu 24.04 LTS nodes and one built-in Ethernet switch.
- Prepare fresh lab-only local accounts and strong unique secrets; no real configuration or licensed software file is distributed.
- Compare console, Telnet, SSH, HTTP, HTTPS and cloud-managed administration.
- Distinguish SSH server identity from user authentication and permission.
- Configure local AAA, SSH-only VTY access and the IOS SCP server.
- Retrieve a configuration with SCP and use SFTP on an explicitly supported Linux endpoint.
- Compare backup read-backs on Linux and repair a disabled SCP service without weakening host checking.
- Stage an entitled software file after capacity and vendor-hash checks; verify the device copy and perform scoped cleanup without installation.
Words you will meet
Open a word when you need its meaning. You do not need to memorize the whole list before reading.
Management access
Management access lets an authorized operator inspect or change a device. A local console, remote command session, web interface and cloud management service have different paths and trust dependencies.
SSH and host key
Secure Shell protects a remote session. A server host key identifies the server to the client; a user credential identifies the operator to the server. Encryption without checking the intended host can protect a connection to the wrong system.
SCP and SFTP
Secure Copy Protocol and SSH File Transfer Protocol are different file-transfer mechanisms using SSH. SFTP is not FTP with TLS. Modern OpenSSH scp commonly uses SFTP unless legacy SCP is explicitly requested.
AAA and VTY
Authentication, authorization and accounting answer identity, permission and activity-record questions. Virtual terminal lines are IOS remote-session entry points; their configured login and transport policy matters.
Configuration and software file
A configuration file records settings and can contain sensitive secrets or hashes. A software image contains executable device software. Copying either file does not install it or prove its trustworthiness.
Digest and provenance
A cryptographic digest summarizes file bytes to detect differences. Matching digests support integrity only relative to the compared copies; trusted provenance requires an authenticated source or signed verification.
Console and prompt
Open the named GNS3 Console. IOS >, # and (config)# differ from the Linux shell and the sftp> interactive prompt. Type only commands, not prompt labels.
Rollback boundary
Removing a test file or restoring a service setting is different from restoring active device configuration. This lab never loads the copied configuration or installs a software image.
Choose an administration path deliberately
Console provides local or out-of-band text access and remains valuable when the routed path fails, but physical access must be protected. Telnet and ordinary HTTP do not provide the session confidentiality expected for sensitive administration. SSH protects a command session, while HTTPS protects a web interface when its certificate is validated. Cloud management adds an external identity and service dependency.
- Use secure supported access methods and restrict the management path.
- Do not disable certificate or host-key checks to make a connection easier.
Authenticate the server before trusting the session
SSH authenticates a server host key and then authenticates the user. First-use trust is a bootstrap decision, not proof obtained from encryption alone. Production keys should be checked using an approved independent inventory or channel. A changed-key warning needs investigation; blindly deleting known_hosts or disabling checking discards important protection.
- User authentication and server identity solve different problems.
- Keep the trusted Console open until remote access and rollback are verified.
SCP and SFTP are separate capabilities
Both use SSH, but legacy SCP and SFTP are different protocols. OpenSSH 9 changed scp's default transfer protocol to SFTP. Cisco documents cases where IOS XE's SCP server needs the uppercase -O client option to request legacy SCP. That option changes the transfer protocol, not host-key verification or the SSH encryption requirement. Platform and release support must be checked.
- Do not diagnose every subsystem failure as a bad password.
- Never force obsolete cryptographic algorithms just to conceal a compatibility problem.
Legacy FTP and TFTP have different capabilities
FTP supports authenticated file operations with separate control and data connections, but ordinary FTP does not encrypt its credentials or payload. TFTP is a simpler UDP-based transfer protocol without FTP's login model or general directory workflow. Their capabilities matter for understanding older network operations, not as recommendations for sensitive backups.
- FTP, FTPS, SFTP and TFTP are not interchangeable names.
- Prefer a supported secure transfer path for secrets and configuration backups.
A file transfer needs identity, path and integrity checks
Before transfer, verify server identity, available storage, exact source and destination names and the account's permission. Treat configurations as sensitive even when passwords are hashed. Compare received bytes using a digest or equivalent approved verification. A file's existence does not establish completeness; a trusted vendor hash or signature adds provenance beyond comparing two copies.
- Matching two copies checks consistency, not necessarily trustworthy origin.
- Never distribute Cisco image files as part of a classroom transfer exercise.
Copying is not restoring, and service recovery is not password bypass
Copy running-config to a file creates a snapshot of current settings. It does not save startup configuration unless that is the chosen destination. Copying a file back into running configuration can merge commands and should not be described as a universal replacement. The lab tests a disabled SCP service while leaving SSH and the Console available.
- A transfer failure is not authorization to bypass identity controls.
- v1.1 is current through 2 February 2027; v2.0 begins 3 February 2027.
Software staging starts with entitlement and a trusted reference
Staging means placing a software file in a temporary device directory without executing it. Before isolating this lab, the authorized operator must obtain a genuine C8000v consolidated .bin package from Cisco Software Download over certificate-validated HTTPS using their own entitlement. Record the actual product, release, original filename, byte count, download-page URL, retrieval date and Cisco-published SHA-512 value. A SHA-512 whole-file digest has 128 hexadecimal characters. Do not use a forum mirror, another learner's image, a renamed backup or an invented hash. No package is supplied by this lesson. If the file, entitlement or authenticated reference is unavailable, mark this branch unavailable and perform only the paper assessment.
- The running lab router's entitlement does not automatically authorize every additional software download or use.
- A trusted reference comes from the authenticated vendor channel, not from a hash supplied alongside an untrusted file.
Check capacity, verify staged bytes and remove only the new file
Let B be the authenticated package's byte count. Before transfer, require Router1 bootflash free bytes and Admin1's qcs45 filesystem available bytes each to exceed B plus 1,073,741,824 bytes. The extra one GiB is a conservative exercise reserve, not a Cisco installation requirement. Admin1 already holds the source elsewhere and needs room for one read-back copy. Confirm bootflash:qcs45-stage does not exist and ~/qcs45/software-returned.bin is absent. Stop on insufficient space or any collision; never delete existing boot images, packages or unrelated files to make room. Compare source size and SHA-512 with the vendor reference before copying through the recovered SCP service.
- Use independent vendor comparison, not merely equality between two copies of an untrusted file.
- Cleanup is limited to paths created by this branch; restore disposable snapshots after retiring all private artifacts.
Real-world walkthrough
SSH works but the backup transfer fails
In a fictional maintenance exercise, Admin1 can open a router terminal, but a file retrieval fails after a workstation upgrade. The operator should inspect the requested transfer protocol and server subsystem before resetting credentials. A second controlled fault disables only the lab SCP service so the learner can distinguish protocol compatibility from service availability.
- Record the exact client version, command, server identity and error without including a password in the transcript.
- Check whether modern scp requested SFTP and whether the selected IOS release supports that server subsystem.
- Use the documented legacy SCP option only for this supported endpoint; retain host-key checks and approved cryptography.
- Verify SCP service and AAA authorization from the Console, restore the one disabled service setting and retry the original private file.
- Compare the local read-back sizes, SHA-256 values and permissions. Record copy consistency, not independent router-source integrity, configuration restoration or software installation.
Guided GNS3 lab
Private backup by SCP, supported SFTP round trip
Configure protected SSH/SCP, retrieve a private backup, use Linux SFTP and recover a disabled SCP service. Conditionally stage a genuine entitled software file, verify its vendor hash by read-back and remove the staged copy. No practical test was executed during authoring; software installation is excluded.
Addressing plan
| Device | Interface | Address | Purpose |
|---|---|---|---|
| Router1 | GigabitEthernet1 | 192.0.2.1/24 | SSH/SCP server. |
| Admin1 | ens3 | 192.0.2.10/24 | Interactive administrator and transfer client. |
| Files1 | ens3 | 192.0.2.20/24 | Supported SFTP endpoint, not an IOS feature claim. |
Set up the lab
- Create all four nodes and exactly three listed links. No gateways or outside bridges are needed. Keep Router1 Console open throughout.
- Use a fresh Files1 account named lab with a unique strong lab password; its home directory must be writable only as authorized. Preinstall openssh-server and client tools before isolation.
- Choose a private 16-character or longer alphanumeric ROUTER_SECRET and replace its placeholder before typing. Privilege 15 is used only for this disposable SCP server exercise; production roles need least privilege and separate review.
- First-use host-key acceptance is permitted only in this completely new disconnected topology after verifying nodes/cables. For real devices use an approved out-of-band fingerprint. Stop on unexpected changed-key warnings.
- Backups contain sensitive configuration. Run umask 077 on Admin1 and do not publish files, passwords, hashes of secrets or screenshots containing credentials.
- Paper alternative: follow the file path and diagnose subsystem errors without images or accounts. Mark all negotiation, transfers and digest comparisons unmeasured.
- Software branch requires the genuine privately prepared /opt/qcs45-assets/c8000v-staging.bin and authenticated vendor manifest described above. No file or hash is provided here. Missing entitlement or reference means unavailable, not permission to substitute a backup or dummy. Keep this asset and all VM snapshots private.
Address Router1
In GNS3, right-click Router1 and choose Console before typing. Start at > or # on the fresh router. Type each line without the prompt and press Enter. Stop on a syntax error; retain the console for recovery.
enable
configure terminal
hostname Router1
interface GigabitEthernet1
ip address 192.0.2.1 255.255.255.0
no shutdown
endWhat each command means
enable- Enter privileged EXEC (#) from user EXEC (>); use only your authorized lab credentials.
configure terminal- Enter global configuration mode from privileged EXEC (#); accepted changes affect the running device.
hostname Router1- Set the disposable router identity used by SSH key generation.
interface GigabitEthernet1- Select the cable to Switch1 Ethernet0.
ip address 192.0.2.1 255.255.255.0- Assign the private management address.
no shutdown- Enable this cable interface.
end- Return to privileged EXEC (#). This neither saves the configuration nor reverses accepted changes.
- What you should see
- Router1 owns the planned address on the isolated segment.
- Why this step matters
- No route to a public network is needed for this local management workflow.
Prepare Admin1
In GNS3, right-click Admin1 and choose Console before typing. At the Linux shell, verify ens3 is the declared cable and use a fresh working directory. Type each line without the prompt and press Enter. Stop on a syntax error; retain the console for recovery.
sudo ip address add 192.0.2.10/24 dev ens3
sudo ip link set ens3 up
umask 077
mkdir ~/qcs45
cd ~/qcs45
ssh -VWhat each command means
sudo ip address add 192.0.2.10/24 dev ens3- Assign the client address used to contact both servers.
sudo ip link set ens3 up- Enable the private client link.
umask 077- Make newly created backup files private to this user.
mkdir ~/qcs45- Create a fresh private exercise directory; stop if it already contains unrelated data.
cd ~/qcs45- Make the exercise directory the destination for relative file paths.
ssh -V- Record the OpenSSH client version and its expected transfer defaults.
- What you should see
- Admin1 is ready without altering its system resolver or adding an external route.
- Why this step matters
- A private working directory reduces accidental disclosure and ambiguous file destinations.
Prepare the SFTP endpoint
In GNS3, right-click Files1 and choose Console before typing. At the Linux shell of the pre-created lab account, configure only the private link. Type each line without the prompt and press Enter. Stop on a syntax error; retain the console for recovery.
sudo ip address add 192.0.2.20/24 dev ens3
sudo ip link set ens3 up
sudo systemctl start ssh
sudo ssh-keygen -lf /etc/ssh/ssh_host_ed25519_key.pubWhat each command means
sudo ip address add 192.0.2.20/24 dev ens3- Assign the separate supported file-server address.
sudo ip link set ens3 up- Enable the private server interface.
sudo systemctl start ssh- Start the installed OpenSSH server with its supported SFTP subsystem.
sudo ssh-keygen -lf /etc/ssh/ssh_host_ed25519_key.pub- Read the server's public host-key fingerprint through the trusted Console for later comparison.
- What you should see
- Files1's SSH service should run; record the public fingerprint, not its private key.
- Why this step matters
- A concrete SFTP endpoint avoids pretending an unsupported IOS server subsystem exists.
Configure SSH identity and the lab user
In GNS3, right-click Router1 and choose Console before typing. Start at #. Replace ROUTER_SECRET privately before typing its line. Type each line without the prompt and press Enter. Stop on a syntax error; retain the console for recovery.
configure terminal
ip domain name lab.test
username lab privilege 15 algorithm-type scrypt secret ROUTER_SECRET
crypto key generate rsa modulus 3072
ip ssh version 2
end
show ip ssh
show crypto key mypubkey rsaWhat each command means
configure terminal- Enter global configuration mode from privileged EXEC (#); accepted changes affect the running device.
ip domain name lab.test- Set the local domain used with the hostname for default key naming.
username lab privilege 15 algorithm-type scrypt secret ROUTER_SECRET- Create the disposable privileged SCP account with a scrypt-protected local secret; never reuse this broad lab role in production.
crypto key generate rsa modulus 3072- Generate a 3072-bit RSA host key on the fresh router; stop if an existing key would be overwritten.
ip ssh version 2- Require SSH version 2 rather than legacy compatibility.
end- Return to privileged EXEC (#). This neither saves the configuration nor reverses accepted changes.
show ip ssh- Inspect supported SSH version and server configuration.
show crypto key mypubkey rsa- Record public-key identity via the trusted Console; never export a private key.
- What you should see
- The fresh router should have an SSHv2 server identity and the intended local account.
- Why this step matters
- Server keys identify the endpoint; the user secret separately authenticates the administrator.
Enable local AAA and SCP
In GNS3, right-click Router1 and choose Console before typing. Start at # with the Console retained. These defaults are only for a clean disposable node. Type each line without the prompt and press Enter. Stop on a syntax error; retain the console for recovery.
configure terminal
aaa new-model
aaa authentication login default local
aaa authorization exec default local
line vty 0 4
login authentication default
transport input ssh
exit
ip scp server enable
endWhat each command means
configure terminal- Enter global configuration mode from privileged EXEC (#); accepted changes affect the running device.
aaa new-model- Enable IOS AAA processing on this fresh lab configuration.
aaa authentication login default local- Use the local account database for the default login method.
aaa authorization exec default local- Authorize an EXEC shell using local user attributes, required by this SCP server setup.
line vty 0 4- Select the declared remote terminal lines.
login authentication default- Apply the default login authentication list to these lines.
transport input ssh- Allow SSH rather than Telnet on the selected VTY lines.
exit- Return to global configuration.
ip scp server enable- Enable the supported IOS SCP service over SSH.
end- Return to privileged EXEC (#). This neither saves the configuration nor reverses accepted changes.
- What you should see
- Local authentication, EXEC authorization and the SCP server should be configured.
- Why this step matters
- SSH transport, user authorization and file-transfer service are separate prerequisites.
Verify the remote terminal
In GNS3, right-click Admin1 and choose Console before typing. At the Linux shell, check the new isolated host identity, then enter the router password only at its prompt. After login, run show privilege and exit in that remote session. Type each line without the prompt and press Enter. Stop on a syntax error; retain the console for recovery.
ssh lab@192.0.2.1
show privilege
exitWhat each command means
ssh lab@192.0.2.1- Connect to Router1 as the lab user; retain host-key checking and document the isolated first-use trust boundary.
show privilege- At Router1's remote IOS prompt, verify the intended lab privilege rather than assuming it.
exit- Leave the remote IOS session and return to Admin1's Linux shell.
- What you should see
- A remote IOS session should open with the intended account; preserve errors if it does not.
- Why this step matters
- Terminal success is a prerequisite observation, not proof that SCP or SFTP file operations work.
Create a private configuration snapshot
In GNS3, right-click Router1 and choose Console before typing. Start at # in the trusted Console. At the destination-filename confirmation accept day45.cfg only; do not target startup-config. Retain this exact file unchanged throughout the comparisons and service fault; do not recreate it after changing SCP. Type each line without the prompt and press Enter. Stop on a syntax error; retain the console for recovery.
copy running-config bootflash:day45.cfg
dir bootflash:day45.cfgWhat each command means
copy running-config bootflash:day45.cfg- Write a private snapshot file on router storage without applying or installing it.
dir bootflash:day45.cfg- Record the exact filename and byte count for comparison with Admin1's read-backs; this is not a digest.
- What you should see
- The file should exist with a recorded byte count; no running setting should change because of the copy.
- Why this step matters
- No device-side hash command is assumed. A configuration snapshot can contain credential material and must remain private.
Retrieve and compare two SCP read-backs
In GNS3, right-click Admin1 and choose Console before typing. At the Linux shell in ~/qcs45, require day45.cfg and backup-readback.cfg to be absent. Use the same trusted router identity and enter the password only when prompted. Do not change the router file between reads. Stop on a failed transfer, size difference or digest mismatch. Type each line without the prompt and press Enter. Stop on a syntax error; retain the console for recovery.
scp -O lab@192.0.2.1:bootflash:day45.cfg ./day45.cfg
scp -O lab@192.0.2.1:bootflash:day45.cfg ./backup-readback.cfg
chmod 600 day45.cfg backup-readback.cfg
stat -c '%n %s %a' day45.cfg backup-readback.cfg
sha256sum day45.cfg backup-readback.cfgWhat each command means
scp -O lab@192.0.2.1:bootflash:day45.cfg ./day45.cfg- Uppercase -O requests legacy SCP from the IOS SCP server instead of OpenSSH's default SFTP; it does not disable encryption or host checking.
scp -O lab@192.0.2.1:bootflash:day45.cfg ./backup-readback.cfg- Read the same unchanged router file again into a separate local path, preserving the first copy.
chmod 600 day45.cfg backup-readback.cfg- Restrict both private configuration copies to this local user.
stat -c '%n %s %a' day45.cfg backup-readback.cfg- On Linux, display filename, byte count and octal permissions. Require both sizes to match Router1's recorded count and both modes to be 600.
sha256sum day45.cfg backup-readback.cfg- On Linux, compute both whole-file SHA-256 values and compare all 64 hexadecimal characters. These are two local hashes, not a router-generated reference.
- What you should see
- Both sizes should match the router's recorded byte count and both local SHA-256 values should agree. Record actual observations, not invented values.
- Why this step matters
- This establishes read-back consistency only. The copies could agree on incorrect source bytes; it does not independently authenticate the router file, validate its settings or authorize loading it.
Round-trip the backup with SFTP
In GNS3, right-click Admin1 and choose Console before typing. At the Linux shell in ~/qcs45, connect to Files1 and compare its fingerprint with the value read from its Console. The next three lines are entered at sftp>, then the final command at the returned Linux shell. Type each line without the prompt and press Enter. Stop on a syntax error; retain the console for recovery.
sftp lab@192.0.2.20
put day45.cfg day45.cfg
get day45.cfg returned.cfg
bye
sha256sum day45.cfg returned.cfgWhat each command means
sftp lab@192.0.2.20- Open the supported Linux SFTP subsystem using the Files1 lab account and checked host identity.
put day45.cfg day45.cfg- Upload the private local file to the lab user's home directory on Files1.
get day45.cfg returned.cfg- Download the same remote file under a distinct local comparison name.
bye- Close SFTP and return to the ordinary Linux shell.
sha256sum day45.cfg returned.cfg- On Linux, compare all 64 characters of each SHA-256: the retained local baseline and the Files1 read-back. Neither value is a device-side digest.
- What you should see
- The local SHA-256 values should agree, establishing round-trip consistency only; Files1 holds a sensitive backup in its private account.
- Why this step matters
- This is an SFTP procedure on a supported endpoint, not a claim of IOS SFTP-server support or independent backup-source integrity.
Disable only the router SCP service
In GNS3, right-click Router1 and choose Console before typing. Start at # after the successful baseline transfer. Keep the Console and SSH configuration unchanged. Type each line without the prompt and press Enter. Stop on a syntax error; retain the console for recovery.
configure terminal
no ip scp server enable
endWhat each command means
configure terminal- Enter global configuration mode from privileged EXEC (#); accepted changes affect the running device.
no ip scp server enable- Disable only the IOS SCP server for the deliberate lab fault.
end- Return to privileged EXEC (#). This neither saves the configuration nor reverses accepted changes.
- What you should see
- The SCP subsystem is disabled while the configured SSH terminal remains available.
- Why this step matters
- This bounds the fault to file-transfer service availability, not credential or host-key identity.
Compare failed copy with working SSH
In GNS3, right-click Admin1 and choose Console before typing. At the Linux shell in ~/qcs45, use a new destination name so the working backup is not overwritten. Type each line without the prompt and press Enter. Stop on a syntax error; retain the console for recovery.
scp -O lab@192.0.2.1:bootflash:day45.cfg ./fault-copy.cfg
ssh lab@192.0.2.1
exitWhat each command means
scp -O lab@192.0.2.1:bootflash:day45.cfg ./fault-copy.cfg- Attempt the same SCP source while its server subsystem is disabled; record the actual error.
ssh lab@192.0.2.1- Check that the same authorized SSH terminal can still be available.
exit- After the remote login, exit IOS to return to the Linux shell.
- What you should see
- The copy should fail while terminal login remains possible; do not bypass identity controls to change the result.
- Why this step matters
- Different SSH applications can have different service and authorization outcomes.
Restore SCP from the Console
In GNS3, right-click Router1 and choose Console before typing. Start at # in the retained trusted Console. Type each line without the prompt and press Enter. Stop on a syntax error; retain the console for recovery.
configure terminal
ip scp server enable
end
show ip sshWhat each command means
configure terminal- Enter global configuration mode from privileged EXEC (#); accepted changes affect the running device.
ip scp server enable- Restore the single service setting removed during the fault.
end- Return to privileged EXEC (#). This neither saves the configuration nor reverses accepted changes.
show ip ssh- Verify SSH server configuration remains intact.
- What you should see
- The intended SCP service is enabled again without altering the account or host key.
- Why this step matters
- Restoring the known service is the planned inverse, not a password reset or host-key bypass.
Retest the file and retain a limited conclusion
In GNS3, right-click Admin1 and choose Console before typing. At the Linux shell in ~/qcs45, require restored-copy.cfg to be absent and retrieve the same unchanged router backup. Do not run copy running-config again: that would create a different snapshot. Type each line without the prompt and press Enter. Stop on a syntax error; retain the console for recovery.
scp -O lab@192.0.2.1:bootflash:day45.cfg ./restored-copy.cfg
sha256sum day45.cfg restored-copy.cfgWhat each command means
scp -O lab@192.0.2.1:bootflash:day45.cfg ./restored-copy.cfg- Repeat the original supported protocol after service restoration, retaining the original local baseline.
sha256sum day45.cfg restored-copy.cfg- On Linux, compare all 64 SHA-256 characters of the original local baseline and the recovery read-back; do not compare against a device hash or a SHA-512 value.
- What you should see
- The transfer should succeed and the two local SHA-256 values should agree; no configuration was loaded.
- Why this step matters
- This verifies service recovery and copy consistency, not independent source integrity or the correctness of the saved configuration.
Stage, verify and retire an entitled software file
In GNS3, right-click Admin1 and choose Console before typing. Conditional branch only after all entitlement gates above and SCP recovery. Open Admin1 and Router1 GNS3 Consoles. Lines 1-3: Admin1 shell; 4-5: Router1 #; 6: Admin1; 7: Router1; 8-9: Admin1; 10-12: Router1. Check size, vendor hash, fresh paths and capacity before line 5. Require each free-byte value > B + 1073741824. Stop on any mismatch or collision. Confirm deletion only for the exact new filename, then remove the empty directory. Finally retire private copies and lab access as in Cleanup; do not install or reload. Type each line without the prompt and press Enter. Stop on a syntax error; retain the console for recovery.
stat -c '%s %U %a' /opt/qcs45-assets/c8000v-staging.bin
sha512sum /opt/qcs45-assets/c8000v-staging.bin
df -B1 ~/qcs45
dir bootflash:
mkdir bootflash:qcs45-stage
scp -O /opt/qcs45-assets/c8000v-staging.bin lab@192.0.2.1:bootflash:qcs45-stage/c8000v-staging.bin
dir bootflash:qcs45-stage/c8000v-staging.bin
scp -O lab@192.0.2.1:bootflash:qcs45-stage/c8000v-staging.bin ~/qcs45/software-returned.bin
sha512sum /opt/qcs45-assets/c8000v-staging.bin ~/qcs45/software-returned.bin
delete bootflash:qcs45-stage/c8000v-staging.bin
rmdir bootflash:qcs45-stage
dir bootflash:What each command means
stat -c '%s %U %a' /opt/qcs45-assets/c8000v-staging.bin- Admin1 Console: record source byte count, owner and mode; require the vendor size, intended operator and mode 600.
sha512sum /opt/qcs45-assets/c8000v-staging.bin- Admin1 Console: compare all 128 digest characters with the authenticated Cisco reference; stop if they differ.
df -B1 ~/qcs45- Admin1 Console: inspect available bytes on the read-back destination filesystem, using the B-plus-reserve gate.
dir bootflash:- Router1 Console at #: record free bytes and existing names; require enough capacity and no qcs45-stage directory.
mkdir bootflash:qcs45-stage- Router1 Console at #: create only the new dedicated directory after all preflight checks pass.
scp -O /opt/qcs45-assets/c8000v-staging.bin lab@192.0.2.1:bootflash:qcs45-stage/c8000v-staging.bin- Admin1 Console: send the genuine file to the exact new device path over checked SSH/SCP; never accept an overwrite or changed host identity.
dir bootflash:qcs45-stage/c8000v-staging.bin- Router1 Console at #: inspect the staged file and compare its byte count with B; existence alone is insufficient.
scp -O lab@192.0.2.1:bootflash:qcs45-stage/c8000v-staging.bin ~/qcs45/software-returned.bin- Admin1 Console: read back the exact device file into a previously absent private local path; no software goes to Files1.
sha512sum /opt/qcs45-assets/c8000v-staging.bin ~/qcs45/software-returned.bin- Admin1 Console: compare both actual values with the independent authenticated vendor SHA-512, not only with each other.
delete bootflash:qcs45-stage/c8000v-staging.bin- Router1 Console at #: confirm only this branch's exact file at the prompts, whether verification succeeded or failed; use no wildcard or recursive option.
rmdir bootflash:qcs45-stage- Router1 Console at #: remove only the now-empty directory this exercise created; stop if it is not empty.
dir bootflash:- Router1 Console at #: verify the staging directory is absent and inspect reclaimed space without modifying any boot assets.
- What you should see
- Record actual size, capacity and vendor-digest comparisons plus scoped cleanup, or mark the branch unavailable. All authoring runtime remains unexecuted.
- Why this step matters
- This adds real software-file handling to configuration backup while separating entitlement, trusted origin, transfer integrity and installation authorization.
Verify
- Verify SSHv2, the intended local identity and the documented first-use or independent host-key trust context.
- Match both SCP read-back sizes to Router1's recorded byte count. Compare Linux SHA-256 values for the two reads, then for the SFTP round trip and recovery copy against the retained baseline. This checks consistency, not independent router-source integrity; keep all copies private.
- Show SCP-disabled failure and SSH terminal availability, then a successful same-source SCP retest after restoration.
- State that Linux SFTP is a supported alternative and software installation, configuration restore, cloud management and production hardening remain untested.
- For software staging record entitlement, actual vendor filename-to-alias mapping, authenticated reference, B and both capacity checks; require the original and read-back SHA-512 to match that vendor value.
- Verify exact staged-file size and subsequent absence of the dedicated device directory. No boot setting, installation or reload is changed; lack of entitlement means practical unavailable, not completed.
Troubleshoot
- SCP fails immediately on OpenSSH 9: check the requested transfer protocol and documented -O requirement; do not disable host-key checks.
- Authentication works but SCP is denied: inspect the IOS SCP service, local privilege and EXEC authorization from the retained Console.
- Changed host-key warning: stop and verify the reason through a trusted path; do not delete known_hosts or accept a changed key blindly.
- Digest mismatch: preserve both copies privately, check exact paths and transfer completion, and do not apply either as a configuration or software update.
GNS3 does not provide Cisco software images. Use Cisco images only when the applicable license or entitlement permits this environment. Do not share or redistribute image files. Cisco Modeling Labs is an official alternative; its supplied reference images are licensed for CML, not automatically for export to GNS3. Use the labeled paper alternative when authorized software is unavailable. No emulator execution is claimed by this lesson.
- Account for and retire private backup copies on Router1, Admin1 and Files1; do not distribute them.
- Stop the isolated project and restore clean snapshots before any future connection to a real network.
- Stop all four nodes after preserving sanitized observations. Revert or discard disposable snapshots containing router users, host keys and private artifacts. On retained images remove only dedicated lab files/accounts through normal authorized administration.
- After the software branch, delete only the newly staged device file and its empty directory as shown. Retire Admin1's software-returned.bin and the privately prepared source through approved local administration or discard their disposable snapshot; never share image-containing projects.
Practice set
Answer before you reveal
01Does SSH terminal success prove SFTP support?
SSH can carry different applications. The selected IOS release is used for SCP, while the Linux server explicitly supplies SFTP.
02What does uppercase scp -O change?
It does not mean turning off host-key verification, encryption or authorization. It addresses the documented OpenSSH-to-IOS subsystem mismatch.
03Does a matching digest prove a file is trustworthy?
Trusted origin requires authenticated provenance or signed verification; compatibility and authorization to install remain separate.
04Why keep the Console open?
A remote management mistake should not require password bypass or blind resetting. Console security also requires physical or platform access controls.
05How is SFTP different from TFTP?
They are separate protocols with different features and security properties. Similar spelling is not a reason to use TFTP for sensitive backups.
06What does copying running-config to bootflash do?
The destination is not startup-config. Copying and loading have different effects and need separate verification and authorization.
07Paper ticket: B is 800,000,000 bytes and Router1 has 1,500,000,000 free. May staging start?
Add the explicitly chosen 1,073,741,824-byte reserve to B. Do not delete existing boot assets to force the gate to pass. This arithmetic is a worksheet, not measured device capacity or an installation requirement.
08Source and read-back hashes agree, but both differ from the authenticated Cisco hash. What next?
Check that the manifest names this exact original package and algorithm. Record the mismatch, remove only the new staged file and empty directory, and obtain an authorized fresh source before retrying. Never install, reload or replace the reference with the observed hash.
Knowledge check
Quiz: prove the reasoning
Keep these
Technical takeaways
- Check the intended host and user separately.
- SCP and SFTP are different server capabilities despite sharing SSH.
- Keep configuration copies private at every endpoint.
- Compare file bytes without confusing integrity with trusted provenance.
- A successful copy is not a configuration restore or software installation.