Disabling TFTP and auto-TFTP for enhanced security

Disabling TFTP and auto-TFTP

Using the ip ssh filetransfer command to enable SFTP automatically disables TFTP and auto-TFTP (if either or both are enabled), as shown in Example of switch configuration with SFTP enabled.

If you enable SFTP and then later disable it, TFTP and auto-TFTP remain disabled unless they are explicitly re-enabled.

Operating rules

Prerequisites

To enable SFTP by using an SNMP management application, you must first disable TFTP and, if configured, auto-TFTP on the switch. You can use either an SNMP application or the CLI to disable TFTP, but you must use the CLI to disable auto-TFTP. The following CLI commands disable TFTP and auto-TFTP on the switch.

Procedure

The TFTP feature is enabled by default, and can be enabled or disabled through the CLI, the Menu interface (see
Using the Menu interface to disable TFTP
), or an SNMP application. Auto-TFTP is disabled by default and must be configured through the CLI.

Using the Menu interface to disable TFTP
While SFTP is enabled, TFTP and auto-TFTP cannot be enabled from the CLI. Attempting to enable either non-secure TFTP option while SFTP is enabled produces one of the following messages in the CLI:
```
SFTP must be disabled before enabling tftp.
SFTP must be disabled before enabling auto-tftp.
```
Similarly, while SFTP is enabled, TFTP cannot be enabled using an SNMP management application. Attempting to do so generates an "inconsistent value" message. (An SNMP management application cannot be used to enable or disable auto-TFTP.)