Cisco Certified Network Associate (CCNA) 200-301 · Free study guide

Objective 4.9 — Describe TFTP and FTP capabilities

TFTP and FTP move files, but their connection models, authentication, and operational risks differ. Neither ordinary protocol provides modern encrypted file transfer.

TFTP

Trivial File Transfer Protocol uses UDP and a simple request/data/acknowledgment exchange. It has no native user login, directory browsing in the ordinary model, or confidentiality. Its simplicity has made it common for controlled bootstrap, configuration, and image workflows. Server file permissions and network policy become important because the protocol supplies little identity context.

TFTP begins with a well-known server port and then uses transfer identifiers for the exchange. Firewalls and NAT devices must understand or permit the resulting flow appropriately.

FTP

File Transfer Protocol uses TCP, authenticates a user, and separates a control connection from data connections. Active and passive data modes differ in which side initiates the data path, affecting firewall and NAT behavior. Ordinary FTP sends credentials and content without encryption, so authentication alone does not make it secure.

FTP supports directory and file operations beyond TFTP's minimal design.

Network device use

Both protocols can copy configurations or software images between a network device and a server. Before a transfer, verify storage capacity, filename, image compatibility, server reachability, source interface, and integrity information. A successful copy does not prove an image is approved or bootable.

Protect the management segment and prefer secure alternatives such as SCP or SFTP where the workflow permits, even though this objective asks specifically about TFTP and FTP capabilities.

Worked scenario

A branch behind strict NAT can establish the FTP control session but directory listing fails. The separate data connection is being blocked or translated incorrectly. Choose a supported mode and firewall handling rather than changing the username repeatedly. For a simple TFTP image pull, a timeout can reflect UDP policy, server path permissions, or wrong source routing.

Verification

Confirm DNS or server address, route, source interface, protocol reachability, credentials for FTP, server directory permissions, device storage, transferred byte count, and checksum or signed-image validation where supplied. Record the source and destination filenames precisely.

Common traps

• Saying TFTP uses TCP.
• Calling FTP encrypted because it authenticates.
• Forgetting FTP's separate data connection.
• Treating successful transfer as integrity verification.
• Exposing a TFTP server broadly.

Readiness checklist

• I can compare transport and authentication behavior.
• I understand FTP control and data sessions.
• I can name safe pre- and post-transfer checks.
• I recognize when secure alternatives are required.