Cisco Industrial Ethernet 4000, 4010 and 5000 Switch Software. Configuration Guide (2022)

Configuring Enhanced Object Tracking

Monitoring Enhanced Object Tracking

9. {

ip route prefix mask {ip-address |

For static routing networks only. Establish static routes.

interface-id [ip-address]} [distance] [name]

[permanent | track track-number] [tag tag]

Entering track track-number specifies that the static route is installed

only if the configured track object is up.

10.

end

Return to privileged EXEC mode.

11.

show ip route track table

Display information about the IP route track table.

12.

copy running-config startup-config

(Optional) Save your entries in the configuration file.

For configuration examples, see this URL:

http://www.cisco.com/en/US/docs/ios/12_3/12_3x/12_3xe/feature/guide/dbackupx.html

Monitoring Enhanced Object Tracking

Use the following privileged EXEC or User EXEC commands ito display enhanced object tracking information.

Command

Purpose

show ip route track table

Display information about the IP route track table.

show track [object-number]

Display information about the all tracking lists or the

specified list.

show track brief

Display a single line of tracking information output.

show track interface [brief]

Display information about tracked interface objects.

show track ip [object-number] [brief] route

Display information about tracked IP-route objects.

show track resolution

Display the resolution of tracked parameters.

show track timers

Display tracked polling interval timers.

1027

Configuring MODBUS TCP

Understanding MODBUS TCP, page 1029

Configuring the Switch as the MODBUS TCP Server, page 1030

Displaying MODBUS TCP Information, page 1031

Understanding MODBUS TCP

Use Modicon Communication Bus (MODBUS) TCP over an Ethernet network when connecting the switch to devices such

as intelligent electronic devices (IEDs), distributed controllers, substation routers, Cisco IP Phones, Cisco Wireless

Access Points, and other network devices such as redundant substation switches.

MODBUS is a serial communications protocol for client-server communication between a switch (server) and a device

in the network running MODBUS client software (client). You can use MODBUS to connect a computer to a remote

terminal unit (RTU) in supervisory control and data acquisition (SCADA) systems.

The client can be an IED or a human machine interface (HMI) application that remotely configure and manage devices

running MODBUS TCP. The switch functions as the server.

The switch encapsulates a request or response message in a MODBUS TCP application data unit (ADU). A client sends

a message to a TCP port on the switch. The default port number is 502.

MODBUS and Security, page 1029

Multiple Request Messages, page 1030

MODBUS and Security

If a firewall or other security services are enabled, the switch TCP port might be blocked, and the switch and the client

cannot communicate.

If a firewall and other security services are disabled, a denial-of-service attack might occur on the switch.

To prevent a denial-of-service attack and to allow a specific client to send messages to the switch (server), you can

use this standard access control list (ACL) that permits traffic only from the source IP address 10.1.1.n:

interface Ethernet0/0

ip address 10.1.1.1 255.255.255.0

ip access-group 1 in

access-list 1 permit 10.1.1.0 0.0.0.255

To configure quality of service (QoS) to set the rate-limit for MODBUS TCP traffic:

interface FastEthernet0/1

ip address 10.1.1.1 255.255.255.0

ip access-group 1 in

rate-limit input access-group 101 8000 8000 8000 conform-action transmit exceed-action drop

1029

Configuring MODBUS TCP

Configuring the Switch as the MODBUS TCP Server

access-list 101 permit tcp 10.1.1.0 0.0.0.255 any eq 502

Multiple Request Messages

The switch can receive multiple request messages from clients and respond to them simultaneously.

You can set the number of client connections from 1 to 5. The default is 1.

Configuring the Switch as the MODBUS TCP Server

Defaults, page 1030

Enabling MODBUS TCP on the Switch, page 1030

Defaults

The switch is not configured as a MODBUS TCP server.

The TCP switch port number is 502.

The number of simultaneous connection requests is 1.

Enabling MODBUS TCP on the Switch

Beginning in privileged EXEC mode:

Command

Purpose

configure terminal

Enters global configuration mode.

scada modbus tcp server

Enables MODBUS TCP on the switch

scada modbus tcp server port

(Optional) Sets the TCP port to which clients send messages.

tcp-port-number

The range for tcp-port-number is 1 to 65535. The default is 502.

scada modbus tcp server

(Optional) Sets the number of simultaneous connection requests

connection connection-requests

sent to the switch. The range for connection-requests is 1 to 5.

The default is 1.

end

Returns to privileged EXEC mode.

show scada modbus tcp server

Displays the server information and statistics.

copy running-config startup

(Optional) Saves your entries in the configuration file.

config

To disable MODBUS on the switch and return to the default settings, enter the no scada modbus tcp server global

configuration command.

To clear the server and client statistics, enter the clear scada modbus tcp server statistics privileged EXEC command.

After you enable MODBUS TCP on the switch, this warning appears:

WARNING: Starting Modbus TCP server is a security risk.

Please understand the security issues involved before

proceeding further. Do you still want to start the

server? [yes/no]:

1030

Ethernet CFM

Cisco Industrial Ethernet switches supports Ethernet CFM. Ethernet CFM is an end-to-end per-service-instance (per

VLAN) Ethernet layer OAM protocol that includes proactive connectivity monitoring, fault verification, and fault isolation.

End-to-end can be provider-edge-to-provider-edge (PE-to-PE) device or customer-edge-to-customer-edge

(CE-to-CE) device. Ethernet CFM, as specified by 802.1ag, is the standard for Layer 2 ping, Layer 2 traceroute, and

end-to-end connectivity check of the Ethernet network.

For complete command and configuration information for Ethernet CFM, see the Configuring Ethernet OAM, CFM, and

E-LMI chapter of the System Management guide at this URL:

http://www.cisco.com/c/en/us/td/docs/switches/connectedgrid/cg-switch-sw-master/software/configuration/guide/

sysmgmt/CGS_1000_Sysmgmt/sm_oam.html

1033

Working with the Cisco IOS File System,

Configuration Files, and Software Images

This document describes how to manipulate the switch flash file system, how to copy configuration files, and how to

archive (upload and download) software images to a switch.

Note: For complete syntax and usage information for the commands used in this chapter, see the Cisco IOS Configuration

Fundamentals Command Reference, Release 15.0 from the Cisco.com page.

Working with the Flash File System

The flash file system is a single flash device on which you can store files. It also provides several commands to help you

manage software image and configuration files. The default flash file system on the switch is named flash:.

The switch has a removable compact flash card that stores the Cisco IOS software image and configuration files.

Removing the compact flash card does not interrupt switch operation unless you need to reload the Cisco IOS software.

However, if you remove the compact flash card, you do not have access to the flash file system, and any attempt to

access it generates an error message.

Use the show flash: privileged EXEC command to display the compact flash file settings. For more information about the

command, go to this URL:

https://www.cisco.com/c/en/us/td/docs/ios/fundamentals/command/reference/cf_book.html

For information about how to remove or replace the compact flash memory card on the switch, see the Hardware

Installation Guide Hardware Technical Guide.

Displaying Available File Systems

To display the available file systems on your switch, use the show file systems privileged EXEC command as shown in

this example.

Switch# show file systems

File Systems:

Size(b)

Free(b)

Type Flags Prefixes

opaque

bs:

134086656

117346304

flash

flash:

opaque

system:

opaque

tmpsys:

524288

518334

nvram

nvram:

opaque

xmodem:

opaque

ymodem:

opaque

null:

opaque

tar:

network

tftp:

network

rcp:

network

http:

network

ftp:

1035

Working with the Cisco IOS File System, Configuration Files, and Software Images

Working with the Flash File System

network

scp:

network

https:

opaque

cns:

Switch#

Detecting an Unsupported SD Flash Memory Card

When the switch starts and detects an unsupported Secure Digital (SD) flash memory card, or when you insert an

unsupported SD flash memory card while the switch is running, the following warning message is displayed:

WARNING: Non-IT SD flash detected. Use of this card during normal

operation can impact and severely degrade performance of the system.

Please use supported SD flash cards only.

To display information about the SD flash memory card on the screen, use the show platform sdflash privileged EXEC

command.

This example shows an unsupported SD flash memory card:

Switch# show platform sdflash

SD Flash Manufacturer

: SMART MODULAR (ID=27h) - Non IT

Size

: 485MB

Serial number

: B01000A5

Revision

: 2.0

Manufacturing date: 12/2009

This example shows a supported SD flash memory card:

Switch# show platform sdflash

SD Flash Manufacturer

: SMART MODULAR (ID=27h)

Size

: 972MB

Serial number

: 07000019

Revision

: 2.0

Manufacturing date: 3/2010

Note: When you enter the show platform sdflash privileged EXEC command, the name, date, and other fields that are

displayed depend on the manufacturer of the SD flash memory card. However, if the SD flash memory card is

unsupported, “Non IT” is displayed after the manufacturer’s name.

Note: The output of the show platform sdflash privileged EXEC command is also included in the show tech-support

privileged EXEC command output.

1036

Working with the Cisco IOS File System, Configuration Files, and Software Images

Working with the Flash File System

SD Flash Memory Card LED

Color

System Status

Off / blinking green

SD flash memory card transfer in progress.

Slow blinking amber

SD flash memory card is unsupported.

Fast blinking amber

SD flash memory card is not present.

Amber

Error accessing the SD flash memory card.

Cisco IOS boot image cannot be found.

Green

SD flash memory card is functioning.

Setting the Default File System

Table 67

show file systems Field Descriptions

Field

Value

Size(b)

Amount of memory in the file system in bytes.

Free(b)

Amount of free memory in the file system in bytes.

Type

Type of file system.

flash—The file system is for a flash memory device.

nvram—The file system is for a NVRAM device.

opaque—The file system is a locally generated pseudo file system (for example, the system) or a download

interface, such as brimux.

unknown—The file system is an unknown type.

Flags

Permission for file system.

ro—read-only.

rw—read/write.\

wo—write-only.

Prefixes

Alias for file system.

flash:—Flash file system.

nvram:—NVRAM.

null:—Null destination for copies. You can copy a remote file to null to find its size.

rcp:—Remote Copy Protocol (RCP) network server.

system:—Contains the system memory, including the running configuration.

tftp:—TFTP network server.

xmodem:—Obtain the file from a network machine by using the Xmodem protocol.

ymodem:—Obtain the file from a network machine by using the Ymodem protocol.

You can specify the file system or directory that the system uses as the default file system by using the cd filesystem:

1037

Working with the Cisco IOS File System, Configuration Files, and Software Images

Working with the Flash File System

privileged EXEC command. You can set the default file system to omit the filesystem: argument from related commands.

For example, for all privileged EXEC commands that have the optional filesystem: argument, the system uses the file

system specified by the cd command.

By default, the default file system is flash:.

You can display the current default file system as specified by the cd command by using the pwd privileged EXEC

command.

Displaying Information About Files on a File System

You can view a list of the contents of a file system before manipulating its contents. For example, before copying a new

configuration file to flash memory, you might want to verify that the file system does not already contain a configuration

file with the same name. Similarly, before copying a flash configuration file to another location, you might want to verify

its filename for use in another command.

To display information about files on a file system, use one of the privileged EXEC commands in Table 68 on page 1038.

Table 68

Commands for Displaying Information About Files

Command

Description

dir [/all] [filesystem:][filename]

Display a list of files on a file system.

show file systems

Display more information about each of the files on a file system.

show file information file-url

Display information about a specific file.

show file descriptors

Display a list of open file descriptors. File descriptors are the internal representations

of open files. You can use this command to see if another user has a file open.

Changing Directories and Displaying the Working Directory

Beginning in privileged EXEC mode, follow these steps to change directories and display the working directory:

Command

Purpose

dir filesystem:

Displays the directories on the specified file system.

For filesystem:, use flash: for the system board flash device.

cd new_configs

Changes to the directory of interest.

The command example shows how to change to the directory named

new_configs.

pwd

Displays the working directory.

Creating and Removing Directories

Beginning in privileged EXEC mode, follow these steps to create and remove a directory:

1038

Working with the Cisco IOS File System, Configuration Files, and Software Images

Working with the Flash File System

Command

Purpose

dir filesystem:

Displays the directories on the specified file system.

For filesystem:, use flash: for the system board flash device.

mkdir old_configs

Creates a new directory.

The command example shows how to create the directory named old_configs.

Directory names are case sensitive.

Directory names are limited to 45 characters between the slashes (/); the name

cannot contain control characters, spaces, deletes, slashes, quotes,

semicolons, or colons.

dir filesystem:

Verifies your entry.

To delete a directory with all its files and subdirectories, use the delete /force /recursive filesystem:/file-url privileged

EXEC command.

Use the /recursive keyword to delete the named directory and all subdirectories and the files contained in it. Use the

/force keyword to suppress the prompting that confirms a deletion of each file in the directory. You are prompted only

once at the beginning of this deletion process. Use the /force and /recursive keywords for deleting old software images

that were installed by using the archive download-sw command but are no longer needed.

For filesystem, use flash: for the system board flash device. For file-url, enter the name of the directory to be deleted.

All the files in the directory and the directory are removed.

Caution: When files and directories are deleted, their contents cannot be recovered.

Copying Files

To copy a file from a source to a destination, use the copy source-url destination-url privileged EXEC command. For the

source and destination URLs, you can use running-config and startup-config keyword shortcuts. For example, the

copy running-config startup-config command saves the currently running configuration file to the NVRAM section of

flash memory to be used as the configuration during system initialization.

You can also copy from special file systems (xmodem:, ymodem:) as the source for the file from a network machine that

uses the Xmodem or Ymodem protocol.

Network file system URLs include ftp:, rcp:, and tftp: and have these syntaxes:

FTP—ftp:[[//username [:password]@location]/directory]/filename

RCP—rcp:[[//username@location]/directory]/filename

TFTP—tftp:[[//location]/directory]/filename

Local writable file systems include flash:.

Some invalid combinations of source and destination exist. Specifically, you cannot copy these combinations:

From a running configuration to a running configuration

From a startup configuration to a startup configuration

From a device to the same device (for example, the copy flash: flash: command is invalid)

1039

Working with the Cisco IOS File System, Configuration Files, and Software Images

Working with the Flash File System

For specific examples of using the copy command with configuration files, see Working with Configuration Files,

page 1042.

To copy software images either by downloading a new version or by uploading the existing one, use the archive

download-sw or the archive upload-sw privileged EXEC command. For more information, see Working with Software

Images, page 1055.

Deleting Files

When you no longer need a file on a flash memory device, you can permanently delete it. To delete a file or directory

from a specified flash device, use the delete [/force] [/recursive] [filesystem:]/file-url privileged EXEC command.

Use the /recursive keyword for deleting a directory and all subdirectories and the files contained in it. Use the /force

keyword to suppress the prompting that confirms a deletion of each file in the directory. You are prompted only once at

the beginning of this deletion process. Use the /force and /recursive keywords for deleting old software images that

were installed by using the archive download-sw command but are no longer needed.

If you omit the filesystem: option, the switch uses the default device specified by the cd command. For file-url, you

specify the path (directory) and the name of the file to be deleted.

When you attempt to delete any files, the system prompts you to confirm the deletion.

Caution: When files are deleted, their contents cannot be recovered.

This example shows how to delete the file myconfig from the default flash memory device:

Switch# delete myconfig

Creating, Displaying, and Extracting tar Files

You can create a tar file and write files into it, list the files in a tar file, and extract the files from a tar file as described in

the next sections.

Note: Instead of using the copy privileged EXEC command or the archive tar privileged EXEC command, we recommend

using the archive download-sw and archive upload-sw privileged EXEC commands to download and upload software

image files.

Creating a tar File

To create a tar file and write files into it, use this privileged EXEC command:

archive tar /create destination-url flash:/file-url

For destination-url, specify the destination URL alias for the local or network file system and the name of the tar file to

create. These options are supported:

For the local flash file system, the syntax is

flash:

For the FTP, the syntax is

ftp:[[//username[:password]@location]/directory]/tar-filename.tar

For the RCP, the syntax is

rcp:[[//username@location]/directory]/tar-filename.tar

For the TFTP, the syntax is

tftp:[[//location]/directory]/tar-filename.tar

The tar-filename.tar is the tar file to be created.

1040

Working with the Cisco IOS File System, Configuration Files, and Software Images

Working with the Flash File System

For flash:/file-url, specify the location on the local flash file system from which the new tar file is created. You can also

specify an optional list of files or directories within the source directory to write to the new tar file. If none are specified,

all files and directories at this level are written to the newly created tar file.

This example shows how to create a tar file. This command writes the contents of the new-configs directory on the local

flash device to a file named saved.tar on the TFTP server at 172.20.10.30:

Switch# archive tar /create tftp:172.20.10.30/saved.tar flash:/new-configs

Displaying the Contents of a tar File

To display the contents of a tar file on the screen, use this privileged EXEC command:

archive tar /table source-url

For source-url, specify the source URL alias for the local or network file system. These options are supported:

For the local flash file system, the syntax is

flash:

For the FTP, the syntax is

ftp:[[//username[:password]@location]/directory]/tar-filename.tar

For the RCP, the syntax is

rcp:[[//username@location]/directory]/tar-filename.tar

For the TFTP, the syntax is

tftp:[[//location]/directory]/tar-filename.tar

The tar-filename.tar is the tar file to display.

You can also limit the display of the files by specifying an optional list of files or directories after the tar file; then only

those files appear. If none are specified, all files and directories appear.

This example shows how to display the contents of a switch tar file that is in flash memory:

Switch# archive tar /table flash:image-name.tar

image-name/ (directory)

image-name/html/ (directory)

image-name/html/file.html (0 bytes)

image-name/image-name.bin (610856 bytes)

image-name/info (219 bytes)

This example shows how to display only the /html directory and its contents:

Switch# archive tar /table flash: image-name/html

cimage-name/html

cimage-name/html/ (directory)

cimage-name/html/const.htm (556 bytes)

cimage-name/html/xhome.htm (9373 bytes)

cimage-name/html/menu.css (1654 bytes)

Extracting a tar File

To extract a tar file into a directory on the flash file system, use this privileged EXEC command:

archive tar /xtract source-url flash:/file-url [dir/file...]

For source-url, specify the source URL alias for the local file system. These options are supported:

1041

Working with the Cisco IOS File System, Configuration Files, and Software Images

Working with Configuration Files

For the local flash file system, the syntax is

flash:

For the FTP, the syntax is

ftp:[[//username[:password]@location]/directory]/tar-filename.tar

For the RCP, the syntax is

rcp:[[//username@location]/directory]/tar-filename.tar

For the TFTP, the syntax is

tftp:[[//location]/directory]/tar-filename.tar

The tar-filename.tar is the tar file from which to extract files.

For flash:/file-url [dir/file...], specify the location on the local flash file system into which the tar file is extracted. Use the

dir/file... option to specify an optional list of files or directories within the tar file to be extracted. If none are specified, all

files and directories are extracted.

This example shows how to extract the contents of a tar file located on the TFTP server at 172.20.10.30. This command

extracts just the new-configs directory into the root directory on the local flash file system. The remaining files in the

saved.tar file are ignored.

Switch# archive tar /xtract tftp://172.20.10.30/saved.tar flash:/new-configs

Displaying the Contents of a File

To display the contents of any readable file, including a file on a remote file system, use the more [/ascii | /binary |

/ebcdic] file-url privileged EXEC command:.

This example shows how to display the contents of a configuration file on a TFTP server:

Switch# more tftp://serverA/hampton/savedconfig

! Saved configuration on server

version 11.3

service timestamps log datetime localtime

service linenumber

service udp-small-servers

service pt-vty-logging

Working with Configuration Files

This section describes how to create, load, and maintain configuration files.

Configuration files contain commands entered to customize the function of the Cisco IOS software. A way to create a

basic configuration file is to use the setup program or to enter the setup privileged EXEC command. For more

information, see Performing Switch Setup Configuration, page 59

You can copy (download) configuration files from a TFTP, FTP, or RCP server to the running configuration or startup

configuration of the switch. You might want to perform this for one of these reasons:

To restore a backed-up configuration file.

To use the configuration file for another switch. For example, you might add another switch to your network and want

it to have a configuration similar to the original switch. By copying the file to the new switch, you can change the

relevant parts rather than recreating the whole file.

1042

Working with the Cisco IOS File System, Configuration Files, and Software Images

Working with Configuration Files

To load the same configuration commands on all the switches in your network so that all the switches have similar

configurations.

You can copy (upload) configuration files from the switch to a file server by using TFTP, FTP, or RCP. You might perform

this task to back up a current configuration file to a server before changing its contents so that you can later restore the

original configuration file from the server.

The protocol you use depends on which type of server you are using. The FTP and RCP transport mechanisms provide

faster performance and more reliable delivery of data than TFTP. These improvements are possible because FTP and

RCP are built on and use the TCP/IP stack, which is connection-oriented.

Guidelines for Creating and Using Configuration Files

Creating configuration files can aid in your switch configuration. Configuration files can contain some or all of the

commands needed to configure one or more switches. For example, you might want to download the same configuration

file to several switches that have the same hardware configuration.

Use these guidelines when creating a configuration file:

We recommend that you connect through the console port for the initial configuration of the switch. If you are

accessing the switch through a network connection instead of through a direct connection to the console port, keep

in mind that some configuration changes (such as changing the switch IP address or disabling ports) can cause a

loss of connectivity to the switch.

If no password has been set on the switch, we recommend that you set one by using the enable secret

secret-password global configuration command.

Note: The copy {ftp: | rcp: | tftp:} system:running-config privileged EXEC command loads the configuration files on the

switch as if you were entering the commands at the command line. The switch does not erase the existing running

configuration before adding the commands. If a command in the copied configuration file replaces a command in the

existing configuration file, the existing command is erased. For example, if the copied configuration file contains a

different IP address in a particular command than the existing configuration, the IP address in the copied configuration

is used. However, some commands in the existing configuration might not be replaced or negated. In this case, the

resulting configuration file is a mixture of the existing configuration file and the copied configuration file, with the copied

configuration file having precedence.

To restore a configuration file to an exact copy of a file stored on a server, copy the configuration file directly to the startup

configuration (by using the copy {ftp: | rcp: | tftp:} nvram:startup-config privileged EXEC command), and reload the

switch.

Configuration File Types and Location

Startup configuration files are used during system startup to configure the software. Running configuration files contain

the current configuration of the software. The two configuration files can be different. For example, you might want to

change the configuration for a short time period rather than permanently. In this case, you would change the running

configuration but not save the configuration by using the copy running-config startup-config privileged EXEC

command.

The running configuration is saved in DRAM; the startup configuration is stored in the NVRAM section of flash memory.

Creating a Configuration File By Using a Text Editor

When creating a configuration file, you must list commands logically so that the system can respond appropriately. This

is one method of creating a configuration file:

1. Copy an existing configuration from a switch to a server.

1043

Working with the Cisco IOS File System, Configuration Files, and Software Images

Working with Configuration Files

For more information, see Downloading the Configuration File By Using TFTP, page 1044, the Downloading a

Configuration File By Using FTP, page 1046, or Downloading a Configuration File By Using RCP, page 1049.

2. Open the configuration file in a text editor, such as vi or emacs on UNIX or Notepad on a PC.

3. Extract the portion of the configuration file with the desired commands, and save it in a new file.

4. Copy the configuration file to the appropriate server location. For example, copy the file to the TFTP directory on the

workstation (usually /tftpboot on a UNIX workstation).

5. Make sure the permissions on the file are set to world-read.

Copying Configuration Files By Using TFTP

You can configure the switch by using configuration files you create, download from another switch, or download from

a TFTP server. You can copy (upload) configuration files to a TFTP server for storage.

Preparing to Download or Upload a Configuration File By Using TFTP

Before you begin downloading or uploading a configuration file by using TFTP, do these tasks:

Ensure that the workstation acting as the TFTP server is properly configured. On a Sun workstation, make sure that

the /etc/inetd.conf file contains this line:

tftp dgram udp wait root /usr/etc/in.tftpd in.tftpd -p -s /tftpboot

Make sure that the /etc/services file contains this line:

tftp 69/udp

You must restart the inetd daemon after modifying the /etc/inetd.conf and /etc/services files. To restart the

daemon, either stop the inetd process and restart it, or enter a fastboot command (on the SunOS 4.x) or a reboot

command (on Solaris 2.x or SunOS 5.x). For more information on the TFTP daemon, see the documentation for

your workstation.

Ensure that the switch has a route to the TFTP server. The switch and the TFTP server must be in the same

subnetwork if you do not have a router to route traffic between subnets. Check connectivity to the TFTP server by

using the ping command.

Ensure that the configuration file to be downloaded is in the correct directory on the TFTP server (usually /tftpboot

on a UNIX workstation).

For download operations, ensure that the permissions on the file are set correctly. The permission on the file should

be world-read.

Before uploading the configuration file, you might need to create an empty file on the TFTP server. To create an

empty file, enter the touch filename command, where filename is the name of the file you will use when uploading

it to the server.

During upload operations, if you are overwriting an existing file (including an empty file, if you had to create one) on

the server, ensure that the permissions on the file are set correctly. Permissions on the file should be world-write.

Downloading the Configuration File By Using TFTP

To configure the switch by using a configuration file downloaded from a TFTP server, follow these steps:

1. Copy the configuration file to the appropriate TFTP directory on the workstation.

1044

Working with the Cisco IOS File System, Configuration Files, and Software Images

Working with Configuration Files

2. Verify that the TFTP server is properly configured by referring to the Preparing to Download or Upload a Configuration

File By Using TFTP, page 1044.

3. Log into the switch through the console port or a Telnet session.

4. Download the configuration file from the TFTP server to configure the switch.

Specify the IP address or hostname of the TFTP server and the name of the file to download.

Use one of these privileged EXEC commands:

copy tftp:[[[//location]/directory]/filename] system:running-config

copy tftp:[[[//location]/directory]/filename] nvram:startup-config

The configuration file downloads, and the commands are executed as the file is parsed line-by-line.

This example shows how to configure the software from the file tokyo-confg at IP address 172.16.2.155:

Switch# copy tftp://172.16.2.155/tokyo-confg system:running-config

Configure using tokyo-confg from 172.16.2.155? [confirm] y

Booting tokyo-confg from 172.16.2.155:!!! [OK - 874/16000 bytes]

Uploading the Configuration File By Using TFTP

To upload a configuration file from a switch to a TFTP server for storage, follow these steps:

1. Verify that the TFTP server is properly configured by referring to the Preparing to Download or Upload a Configuration

File By Using TFTP, page 1044.

2. Log into the switch through the console port or a Telnet session.

3. Upload the switch configuration to the TFTP server. Specify the IP address or hostname of the TFTP server and the

destination filename.

Use one of these privileged EXEC commands:

copy system:running-config tftp:[[[//location]/directory]/filename]

copy nvram:startup-config tftp:[[[//location]/directory]/filename]

The file is uploaded to the TFTP server.

This example shows how to upload a configuration file from a switch to a TFTP server:

Switch# copy system:running-config tftp://172.16.2.155/tokyo-confg

Write file tokyo-confg on host 172.16.2.155? [confirm] y

Writing tokyo-confg!!! [OK]

Copying Configuration Files By Using FTP

You can copy configuration files to or from an FTP server.

The FTP protocol requires a client to send a remote username and password on each FTP request to a server. When you

copy a configuration file from the switch to a server by using FTP, the Cisco IOS software sends the first valid username

in this list:

The username specified in the copy command if a username is specified.

1045

Working with the Cisco IOS File System, Configuration Files, and Software Images

Working with Configuration Files

The username set by the ip ftp username username global configuration command if the command is configured.

Anonymous.

The switch sends the first valid password in this list:

The password specified in the copy command if a password is specified.

The password set by the ip ftp password password global configuration command if the command is configured.

The switch forms a password named username@switchname.domain. The variable username is the username

associated with the current session, switchname is the configured hostname, and domain is the domain of the

switch.

The username and password must be associated with an account on the FTP server. If you are writing to the server, the

FTP server must be properly configured to accept your FTP write request.

Use the ip ftp username and ip ftp password commands to specify a username and password for all copies. Include

the username in the copy command if you want to specify only a username for that copy operation.

If the server has a directory structure, the configuration file is written to or copied from the directory associated with the

username on the server. For example, if the configuration file resides in the home directory of a user on the server, specify

that user's name as the remote username.

For more information, see the documentation for your FTP server.

Preparing to Download or Upload a Configuration File By Using FTP

Before you begin downloading or uploading a configuration file by using FTP, do these tasks:

Ensure that the switch has a route to the FTP server. The switch and the FTP server must be in the same subnetwork

if you do not have a router to route traffic between subnets. Check connectivity to the FTP server by using the ping

command.

If you are accessing the switch through the console or a Telnet session and you do not have a valid username, make

sure that the current FTP username is the one that you want to use for the FTP download. You can enter the show

users privileged EXEC command to view the valid username. If you do not want to use this username, create a new

FTP username by using the ip ftp username username global configuration command during all copy operations.

The new username is stored in NVRAM. If you are accessing the switch through a Telnet session and you have a valid

username, this username is used, and you do not need to set the FTP username. Include the username in the copy

command if you want to specify a username for only that copy operation.

When you upload a configuration file to the FTP server, it must be properly configured to accept the write request

from the user on the switch.

For more information, see the documentation for your FTP server.

Downloading a Configuration File By Using FTP

Beginning in privileged EXEC mode, follow these steps to download a configuration file by using FTP:

1046

Working with the Cisco IOS File System, Configuration Files, and Software Images

Working with Configuration Files

Command

Purpose

Verify that the FTP server is properly configured by

referring to the Preparing to Download or Upload a

Configuration File By Using FTP, page 1046.

Log into the switch through the console port or a

Telnet session.

configure terminal

Enters global configuration mode on the switch.

This step is required only if you override the default remote

username or password (see Steps 4, 5, and 6).

ip ftp username username

(Optional) Changes the default remote username.

ip ftp password password

(Optional) Changes the default password.

end

Returns to privileged EXEC mode.

copy

Using FTP, copies the configuration file from a network

ftp:[[[//[username[:password]@]location]/directory]/f

server to the running configuration or to the startup

ilename] system:running-config

configuration file.

copy

ftp:[[[//[username[:password]@]location]/directory]/f

ilename] nvram:startup-config

This example shows how to copy a configuration file named host1-confg from the netadmin1 directory on the remote

server with an IP address of 172.16.101.101 and to load and run those commands on the switch:

Switch# copy ftp://netadmin1:mypass@172.16.101.101/host1-confg system:running-config

Configure using host1-confg from 172.16.101.101? [confirm]

Connected to 172.16.101.101

Loading 1112 byte file host1-confg:![OK]

Switch#

%SYS-5-CONFIG: Configured from host1-config by ftp from 172.16.101.101

This example shows how to specify a remote username of netadmin1. The software copies the configuration file

host2-confg from the netadmin1 directory on the remote server with an IP address of 172.16.101.101 to the switch

startup configuration.

Switch# configure terminal

Switch(config)# ip ftp username netadmin1

Switch(config)# ip ftp password mypass

Switch(config)# end

Switch# copy ftp: nvram:startup-config

Address of remote host [255.255.255.255]? 172.16.101.101

Name of configuration file[rtr2-confg]? host2-confg

Configure using host2-confg from 172.16.101.101?[confirm]

Connected to 172.16.101.101

Loading 1112 byte file host2-confg:![OK]

[OK]

Switch#

%SYS-5-CONFIG_NV:Non-volatile store configured from host2-config by ftp from 172.16.101.101

Uploading a Configuration File By Using FTP

Beginning in privileged EXEC mode, follow these steps to upload a configuration file by using FTP:

1047

Working with the Cisco IOS File System, Configuration Files, and Software Images

Working with Configuration Files

Command

Purpose

Verify that the FTP server is properly configured by

referring to the Preparing to Download or Upload a

Configuration File By Using FTP, page 1046.

Log into the switch through the console port or a

Telnet session.

configure terminal

Enters global configuration mode.

This step is required only if you override the default remote

username or password (see Steps 4, 5, and 6).

ip ftp username username

(Optional) Changes the default remote username.

ip ftp password password

(Optional) Changes the default password.

end

Returns to privileged EXEC mode.

copy system:running-config

Using FTP, copies the switch running or startup

ftp:[[[//[username[:password]@]location]/directory]/f

configuration file to the specified location.

ilename]

copy nvram:startup-config

ftp:[[[//[username[:password]@]location]/directory]/f

ilename]

This example shows how to copy the running configuration file named switch2-confg to the netadmin1 directory on the

remote host with an IP address of 172.16.101.101:

Switch# copy system:running-config ftp://netadmin1:mypass@172.16.101.101/switch2-confg

Write file switch2-confg on host 172.16.101.101?[confirm]

Building configuration...[OK]

Connected to 172.16.101.101

Switch#

This example shows how to store a startup configuration file on a server by using FTP to copy the file:

Switch# configure terminal

Switch(config)# ip ftp username netadmin2

Switch(config)# ip ftp password mypass

Switch(config)# end

Switch# copy nvram:startup-config ftp:

Remote host[]? 172.16.101.101

Name of configuration file to write [switch2-confg]?

Write file switch2-confg on host 172.16.101.101?[confirm]

![OK]

Copying Configuration Files By Using RCP

The RCP provides another method of downloading, uploading, and copying configuration files between remote hosts and

the switch. Unlike TFTP, which uses User Datagram Protocol (UDP), a connectionless protocol, RCP uses TCP, which is

connection-oriented.

To use RCP to copy files, the server from or to which you will be copying files must support RCP. The RCP copy

commands rely on the rsh server (or daemon) on the remote system. To copy files by using RCP, you do not need to

create a server for file distribution as you do with TFTP. You only need to have access to a server that supports the remote

shell (rsh). (Most UNIX systems support rsh.) Because you are copying a file from one place to another, you must have

read permission on the source file and write permission on the destination file. If the destination file does not exist, RCP

creates it for you.

1048

Working with the Cisco IOS File System, Configuration Files, and Software Images

Working with Configuration Files

The RCP requires a client to send a remote username with each RCP request to a server. When you copy a configuration

file from the switch to a server, the Cisco IOS software sends the first valid username in this list:

The username specified in the copy command if a username is specified.

The username set by the ip rcmd remote-username username global configuration command if the command is

configured.

The remote username associated with the current TTY (terminal) process. For example, if the user is connected to

the router through Telnet and was authenticated through the username command, the switch software sends the

Telnet username as the remote username.

The switch hostname.

For a successful RCP copy request, you must define an account on the network server for the remote username. If the

server has a directory structure, the configuration file is written to or copied from the directory associated with the remote

username on the server. For example, if the configuration file is in the home directory of a user on the server, specify that

user's name as the remote username.

Preparing to Download or Upload a Configuration File By Using RCP

Before you begin downloading or uploading a configuration file by using RCP, do these tasks:

Ensure that the workstation acting as the RCP server supports the remote shell (rsh).

Ensure that the switch has a route to the RCP server. The switch and the server must be in the same subnetwork if

you do not have a router to route traffic between subnets. Check connectivity to the RCP server by using the ping

command.

If you are accessing the switch through the console or a Telnet session and you do not have a valid username, make

sure that the current RCP username is the one that you want to use for the RCP download. You can enter the show

users privileged EXEC command to view the valid username. If you do not want to use this username, create a new

RCP username by using the ip rcmd remote-username username global configuration command to be used during

all copy operations. The new username is stored in NVRAM. If you are accessing the switch through a Telnet session

and you have a valid username, this username is used, and you do not need to set the RCP username. Include the

username in the copy command if you want to specify a username for only that copy operation.

When you upload a file to the RCP server, it must be properly configured to accept the RCP write request from the

user on the switch. For UNIX systems, you must add an entry to the .rhosts file for the remote user on the RCP server.

For example, suppose that the switch contains these configuration lines:

hostname Switch1

ip rcmd remote-username User0

If the switch IP address translates to Switch1.company.com, the .rhosts file for User0 on the RCP server should

contain this line:

Switch1.company.com Switch1

For more information, see the documentation for your RCP server.

Downloading a Configuration File By Using RCP

Beginning in privileged EXEC mode, follow these steps to download a configuration file by using RCP:

1049

Working with the Cisco IOS File System, Configuration Files, and Software Images

Working with Configuration Files

Command

Purpose

Verify that the RCP server is properly configured by

referring to the Preparing to Download or Upload a

Configuration File By Using RCP, page 1049.

Log into the switch through the console port or a

Telnet session.

configure terminal

Enters global configuration mode.

This step is required only if you override the default remote

username (see Steps 4 and 5).

ip rcmd remote-username username

(Optional) Specifesthe remote username.

end

Returns to privileged EXEC mode.

copy

Using RCP, copies the configuration file from a network

rcp:[[[//[username@]location]/directory]/filename]

server to the running configuration or to the startup

system:running-config

configuration file.

copy

rcp:[[[//[username@]location]/directory]/filename]

nvram:startup-config

This example shows how to copy a configuration file named host1-confg from the netadmin1 directory on the remote

server with an IP address of 172.16.101.101 and load and run those commands on the switch:

Switch# copy rcp://netadmin1@172.16.101.101/host1-confg system:running-config

Configure using host1-confg from 172.16.101.101? [confirm]

Connected to 172.16.101.101

Loading 1112 byte file host1-confg:![OK]

Switch#

%SYS-5-CONFIG: Configured from host1-config by rcp from 172.16.101.101

This example shows how to specify a remote username of netadmin1. Then it copies the configuration file host2-confg

from the netadmin1 directory on the remote server with an IP address of 172.16.101.101 to the startup configuration:

Switch# configure terminal

Switch(config)# ip rcmd remote-username netadmin1

Switch(config)# end

Switch# copy rcp: nvram:startup-config

Address of remote host [255.255.255.255]? 172.16.101.101

Name of configuration file[rtr2-confg]? host2-confg

Configure using host2-confg from 172.16.101.101?[confirm]

Connected to 172.16.101.101

Loading 1112 byte file host2-confg:![OK]

[OK]

Switch#

%SYS-5-CONFIG_NV:Non-volatile store configured from host2-config by rcp from 172.16.101.101

Uploading a Configuration File By Using RCP

Beginning in privileged EXEC mode, follow these steps to upload a configuration file by using RCP:

1050

Working with the Cisco IOS File System, Configuration Files, and Software Images

Working with Configuration Files

Command

Purpose

Verify that the RCP server is properly configured by

referring to the Preparing to Download or Upload a

Configuration File By Using RCP, page 1049.

Log into the switch through the console port or a

Telnet session.

configure terminal

Enters global configuration mode.

This step is required only if you override the default remote

username (see Steps 4 and 5).

ip rcmd remote-username username

(Optional) Specifies the remote username.

end

Returns to privileged EXEC mode.

copy system:running-config

Using RCP, copies the configuration file from a switch

rcp:[[[//[username@]location]/directory]/filename]

running or startup configuration file to a network server.

copy nvram:startup-config

rcp:[[[//[username@]location]/directory]/filename]

This example shows how to copy the running configuration file named switch2-confg to the netadmin1 directory on the

remote host with an IP address of 172.16.101.101:

Switch# copy system:running-config rcp://netadmin1@172.16.101.101/switch2-confg

Write file switch-confg on host 172.16.101.101?[confirm]

Building configuration...[OK]

Connected to 172.16.101.101

Switch#

This example shows how to store a startup configuration file on a server:

Switch# configure terminal

Switch(config)# ip rcmd remote-username netadmin2

Switch(config)# end

Switch# copy nvram:startup-config rcp:

Remote host[]? 172.16.101.101

Name of configuration file to write [switch2-confg]?

Write file switch2-confg on host 172.16.101.101?[confirm]

![OK]

Clearing Configuration Information

You can clear the configuration information from the startup configuration. If you reboot the switch with no startup

configuration, the switch enters the setup program so that you can reconfigure the switch with all new settings.

Clearing the Startup Configuration File

To clear the contents of your startup configuration, use the erase nvram: or the erase startup-config privileged EXEC

command.

Caution: You cannot restore the startup configuration file after it has been deleted.

1051

Working with the Cisco IOS File System, Configuration Files, and Software Images

Working with Configuration Files

Deleting a Stored Configuration File

To delete a saved configuration from flash memory, use the delete flash:filename privileged EXEC command. Depending

on the setting of the file prompt global configuration command, you might be prompted for confirmation before you

delete a file. By default, the switch prompts for confirmation on destructive file operations. For more information about

the file prompt command, see the Cisco IOS Command Reference for Release 12.2.

Caution: You cannot restore a file after it has been deleted.

Replacing and Rolling Back Configurations

The configuration replacement and rollback feature replaces the running configuration with any saved Cisco IOS

configuration file. You can use the rollback function to roll back to a previous configuration.

Understanding Configuration Replacement and Rollback

Archiving a Configuration

The configuration archive provides a mechanism to store, organize, and manage an archive of configuration files. The

configure replace privileged EXEC command increases the configuration rollback capability. As an alternative, you can

save copies of the running configuration by using the copy running-config destination-url privileged EXEC command,

storing the replacement file either locally or remotely. However, this method lacks any automated file management. The

configuration replacement and rollback feature can automatically save copies of the running configuration to the

configuration archive.

You use the archive config privileged EXEC command to save configurations in the configuration archive by using a

standard location and filename prefix that is automatically appended with an incremental version number (and optional

timestamp) as each consecutive file is saved. You can specify how many versions of the running configuration are kept

in the archive. After the maximum number of files are saved, the oldest file is automatically deleted when the next, most

recent file is saved. The show archive privileged EXEC command displays information for all the configuration files saved

in the configuration archive.

The Cisco IOS configuration archive, in which the configuration files are stored and available for use with the configure

replace command, is in any of these file systems: FTP, HTTP, RCP, TFTP.

Replacing a Configuration

The configure replace privileged EXEC command replaces the running configuration with any saved configuration file.

When you enter the configure replace command, the running configuration is compared with the specified replacement

configuration, and a set of configuration differences is generated. The resulting differences are used to replace the

configuration. The configuration replacement operation is usually completed in no more than three passes. To prevent

looping behavior no more than five passes are performed.

You can use the copy source-url running-config privileged EXEC command to copy a stored configuration file to the

running configuration. When using this command as an alternative to the configure replace target-url privileged EXEC

command, note these major differences:

The copy source-url running-config command is a merge operation and preserves all the commands from both the

source file and the running configuration. This command does not remove commands from the running configuration

that are not present in the source file. In contrast, the configure replace target-url command removes commands

from the running configuration that are not present in the replacement file and adds commands to the running

configuration that are not present.

You can use a partial configuration file as the source file for the copy source-url running-config command. You must

use a complete configuration file as the replacement file for the configure replace target-url command.

1052

Working with the Cisco IOS File System, Configuration Files, and Software Images

Working with Configuration Files

Rolling Back a Configuration

You can also use the configure replace command to roll back changes that were made since the previous configuration

was saved. Instead of basing the rollback operation on a specific set of changes that were applied, the configuration

rollback capability reverts to a specific configuration based on a saved configuration file.

If you want the configuration rollback capability, you must first save the running configuration before making any

configuration changes. Then, after entering configuration changes, you can use that saved configuration file to roll back

the changes by using the configure replace target-url command.

You can specify any saved configuration file as the rollback configuration. You are not limited to a fixed number of

rollbacks, as is the case in some rollback models.

Configuration Guidelines

Follow these guidelines when configuring and performing configuration replacement and rollback:

Make sure that the switch has free memory larger than the combined size of the two configuration files (the running

configuration and the saved replacement configuration). Otherwise, the configuration replacement operation fails.

Make sure that the switch also has sufficient free memory to execute the configuration replacement or rollback

configuration commands.

Certain configuration commands, such as those pertaining to physical components of a networking device (for

example, physical interfaces), cannot be added or removed from the running configuration.

— A configuration replacement operation cannot remove the interface interface-id command line from the running

configuration if that interface is physically present on the device.

— The interface interface-id command line cannot be added to the running configuration if no such interface is

physically present on the device.

When using the configure replace command, you must specify a saved configuration as the replacement

configuration file for the running configuration. The replacement file must be a complete configuration generated by

a Cisco IOS device (for example, a configuration generated by the copy running-config destination-url command).

Note: If you generate the replacement configuration file externally, it must comply with the format of files generated by

Cisco IOS devices.

Configuring the Configuration Archive

Using the configure replace command with the configuration archive and with the archive config command is optional

but offers significant benefit for configuration rollback scenarios. Before using the archive config command, you must

first configure the configuration archive. Starting in privileged EXEC mode, follow these steps to configure the

configuration archive:

Command

Purpose

configure terminal

Enters global configuration mode.

Cisco Industrial Ethernet 4000, 4010 and 5000 Switch Software. Configuration Guide (2022) - page 37