Introduction
This document describes how to securely copy files from Cisco routers and switches to the local Windows/Linux/macOS PC.
Prerequisites
Requirements
Cisco recommends that you have knowledge of Secure Shell (SSH) reachability to the device with privilege level 15 access.
Components Used
The information in this document is based on these software and hardware versions:
- Cisco C9300-24P switch with Cisco IOS® 17.3.5
- Windows 10 OS
- RedHat Linux OS
The information in this document was created from the devices in a specific lab environment. All of the devices used in this document started with a cleared (default) configuration. If your network is live, ensure that you understand the potential impact of any command.
Background Information
The process for how to securely copy the files from Cisco routers/switches to local Windows/Linux/macOS PC without the need for any external server or software like Trivial File Transfer Protocol (TFTP), File Transfer Protocol (FTP), Secure File Transfer Protocol (SFTP), or Secure Copy Protocol (SCP) is described in this document.
Problem
Sometimes in a secure environment, it is difficult to get to a TFTP/FTP/SFTP/SCP server to copy files like pcap, crash files, and Cisco IOS images from routers and switches to external sources. There is a chance the firewall blocks the ports used by any of these previously mentioned protocols between source and destination devices.
Solution
With SCP enabled on the Cisco device, you can copy the file from devices without any server or application to your local PC.
Here is the minimum configuration required on the device.
hostname Switch
!
interface GigabitEthernet0/0
ip address 10.197.249.101 255.255.255.0
no shut
!
ip route 0.0.0.0 0.0.0.0 10.197.249.1
!
aaa new-model
!
aaa authentication login default local
aaa authorization exec default local
!
ip domain name cisco.com
!
!--- key used in this example is 1024
!
crypto key generate rsa
!
username cisco privilege 15 secret 5 <redacted>
!
line vty 0 x
transport input ssh
login local
!
ip scp server enable
!--- you can disable the above command after copy is completed
!
end
!--- optional
!
ip ssh time-out 60
ip ssh authentication-retries 5
ip ssh version 2
!
Copy the files from Cisco router/switch with the use of this command on local Windows/Mac/Linux:
scp username@<ip_address_of_the_device>:flash:/filename
Windows 10:
C:\Users\mmehtabu.CISCO>cd /
C:\>cd ios
C:\ios>dir
Volume in drive C has no label.
Volume Serial Number is xxxx-yyyy
Directory of C:\ios
05-01-2023 09.32 AM <DIR> .
05-01-2023 09.32 AM <DIR> ..
0 File(s) 0 bytes
2 Dir(s) 163,191,525,376 bytes free
C:\ios> scp cisco@10.197.249.101:flash:/mycap.pcap .
Password:
mycap.pcap 100% 33MB 105.8KB/s 05:19
Connection to 10.197.249.101 closed by remote host.
C:\ios>dir
Volume in drive C has no label.
Volume Serial Number is xxxx-yyyy
Directory of C:\ios
05-01-2023 09.39 AM <DIR> .
05-01-2023 09.39 AM <DIR> ..
05-01-2023 09.40 AM 1,606,582 mycap.pcap
1 File(s) 1,606,582 bytes
2 Dir(s) 163,182,600,192 bytes free
Linux:
[root@root0 ~]# pwd
/root
[root@root ~]# ls -l
total 1
drwxr-xr-x. 2 root root 6 Apr 6 2022 Pictures
[root@root ~]# scp cisco@10.197.249.101:flash:/mycap.pcap .
Password:
flash:/mycap.pcap 100% 45MB 2.9MB/s 00:15
[root@cpnr000 ~]# ls -l
total 1580
-rw-r--r--. 1 root root 1606582 Jan 5 09:47 mycap.pcap
drwxr-xr-x. 2 root root 6 Apr 6 2022 Pictures
The macOS has a similar command:
scp username@<ip_address_of_the_device>:flash:/filename
Related Information
Feedback