How to Copy IOS Image from One Cisco Router to Another Using TFTP

Last updated: 26-06-2026

Overview

When replacing a faulty Cisco router, one of the most important steps before connecting any production cables is ensuring the replacement unit is running the exact same IOS image as the original. A software mismatch at cutover can cause unexpected behavior, feature gaps, or compatibility issues with the rest of the network.

This guide covers how to copy a Cisco IOS image directly from one router to another using the router's built-in TFTP server capability — no external TFTP server required. The same procedure applies whether you are working on a bench with console-only access or in a live environment where both routers can already reach each other over the network.

This procedure works on all Cisco IOS and IOS XE routers. Commands are identical regardless of model. The only difference between platforms is the storage location name — some routers use flash: and others use bootflash:. Both are covered throughout this guide.

flash: vs bootflash: — Know Your Router's Storage

Before running any commands, identify which storage name your router uses. This affects every copy, verify, dir, and boot system command in this guide.

  • flash: — Used on most older ISR G2 routers (1900, 2900, 3900 series) and some compact platforms.
  • bootflash: — Used on ISR 4000 series (4321, 4331, 4351, 4431, 4451), ASR 1000 series, and most newer IOS XE platforms.

Run the following command to confirm which storage your router uses:

Router# show file systems

Look for the entry marked * (default) with type disk. That is the storage name you will use throughout this procedure. Example output from an ISR 4000 series router:

File Systems:

     Size(b)       Free(b)      Type  Flags  Prefixes
           -             -    opaque     rw   archive:
           -             -    opaque     rw   system:
           -             -    opaque     rw   tmpsys:
*  3,697,541,120  2,900,000,000      disk     rw   bootflash:
           -             -    opaque     rw   null:

If your router uses bootflash:, replace every occurrence of flash: in the commands below with bootflash:. Do not mix them — the commands will fail or point to the wrong location.

Which Scenario Applies to You?

This procedure covers two common situations. The steps are nearly identical — the only difference is how connectivity is established between the two routers.

  • Scenario A — Out-of-production / bench setup: Neither router has an IP address. You have console access only. You will connect the two routers with a direct Ethernet cable and assign temporary IPs before the transfer.
  • Scenario B — Production routers: Both routers are live, can already ping each other, and TFTP traffic (UDP port 69) is permitted between them. You can skip the cabling and IP assignment steps and go straight to enabling the TFTP server on the source router.

Follow Steps 1 through 5 for Scenario A. For Scenario B, complete Step 1 to record the source image MD5, then skip to Step 4 to enable the TFTP server and proceed from there.

What You Will Need

  • Console cable and terminal software (PuTTY, SecureCRT, or similar) — required for Scenario A; recommended for Scenario B
  • One straight-through or crossover Cat5e/Cat6 Ethernet cable — required for Scenario A only
  • Source router: the working router with the correct IOS image in storage
  • Destination router: the replacement or target router
  • Enough free storage on the destination router — at minimum equal to the image file size

Step 1 — Confirm the Image on the Source Router

Connect to the source router via console or SSH. Confirm the image is present in storage and calculate its MD5 checksum. You do not need to compare the MD5 here — you just need to record the value. The actual integrity check is done on the destination router after the transfer, where it matters most.

List the contents of storage:

SourceRouter# dir bootflash:

You should see the IOS image listed with its file size. Note the exact filename — you will need it precisely as shown, including capitalisation and file extension.

Calculate the MD5 checksum. This may take 1–3 minutes depending on the image size:

SourceRouter# verify /md5 bootflash:<image-filename.bin>

Example:

SourceRouter# verify /md5 bootflash:isr4300-universalk9.17.12.07b.SPA.bin

verify /md5 (bootflash:isr4300-universalk9.17.12.07b.SPA.bin) = 9bc35e12bae261c8668903bac90edaba

Note down the MD5 value printed in the output — for example, 9bc35e12bae261c8668903bac90edaba. You will use this value in Step 6 to confirm the copied image on the destination router is identical. If you already have the MD5 from the Cisco software download page, you can use that instead.

Step 2 — Check Free Storage on the Destination Router

Connect to the destination (replacement) router and check available storage space: 

NewRouter# dir bootflash:

The last line of the output shows total and free space. You need free space at least equal to the size of the image you are copying. If the router shipped with a factory default IOS image, both images can coexist in storage as long as there is enough room. If space is tight, you can delete the factory image after the transfer is verified.

Example output:

Directory of bootflash:/

  1    498073600  Jan 01 2000 00:00:00 +00:00  isr4300-universalk9.16.09.06.SPA.bin
  2        10537  Jan 01 2000 00:00:00 +00:00  packages.conf

3,697,541,120 bytes total (3,180,000,256 bytes free)

In this example, approximately 2.96 GB is free — sufficient for most IOS XE images which typically range from 400 MB to 700 MB.

Step 3 — Connect the Two Routers Directly (Scenario A — bench / out-of-production only)

If both routers are already reachable over the network (Scenario B), skip this step and go to Step 4.

Plug an Ethernet cable between any available GigabitEthernet port on the source router and any available GigabitEthernet port on the destination router. Modern routers support auto-MDI/MDIX, so either a straight-through or crossover cable will work.

Assign a temporary IP address on each router using the console. Use any private range — these IPs exist only for the duration of the transfer and are removed afterward.

On the Source Router

SourceRouter# configure terminal
SourceRouter(config)# interface GigabitEthernet0/0/0
SourceRouter(config-if)# ip address 10.0.0.1 255.255.255.252
SourceRouter(config-if)# no shutdown
SourceRouter(config-if)# end

On the Destination Router

NewRouter# configure terminal
NewRouter(config)# interface GigabitEthernet0/0/0
NewRouter(config-if)# ip address 10.0.0.2 255.255.255.252
NewRouter(config-if)# no shutdown
NewRouter(config-if)# end

Verify the link is up on both sides:

SourceRouter# show interfaces GigabitEthernet0/0/0 | include line protocol
GigabitEthernet0/0/0 is up, line protocol is up

Confirm basic reachability from the destination router:

NewRouter# ping 10.0.0.1
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 10.0.0.1, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 1/1/2 ms

If the ping fails, confirm both interfaces show up/up using show interfaces GigabitEthernet0/0/0. Check that the cable is firmly seated on both ends. Do not proceed until pings are successful.

Step 4 — Enable TFTP Server on the Source Router

Cisco IOS has a built-in TFTP server. Enable it on the source router and point it at the image file in storage. This allows the destination router to pull the file directly without any external TFTP server. 

SourceRouter# configure terminal
SourceRouter(config)# tftp-server bootflash:<image-filename.bin>
SourceRouter(config)# end

Example:

SourceRouter(config)# tftp-server bootflash:isr4300-universalk9.17.12.07b.SPA.bin

Verify the TFTP server entry is active:

SourceRouter# show run | include tftp-server
tftp-server bootflash:isr4300-universalk9.17.12.07b.SPA.bin

For Scenario B (production routers): Use the source router's existing production IP address as the TFTP server address in the next step. No interface or IP changes are needed.

Step 5 — Copy the Image to the Destination Router

Before starting the transfer, increase the TFTP block size on the destination router. The default TFTP block size is 512 bytes, which results in a large number of round-trips for a file several hundred megabytes in size. Setting it to 8192 bytes significantly reduces transfer time. 

NewRouter# configure terminal
NewRouter(config)# ip tftp blocksize 8192
NewRouter(config)# end

The block size setting takes effect immediately for the next TFTP transfer. It does not require a reload. You can verify it is set with show running-config | include tftp blocksize.

Now initiate the TFTP copy. When prompted, enter the source router's IP address and the exact image filename: 

NewRouter# copy tftp: bootflash:
Address or name of remote host []? 10.0.0.1
Source filename []? isr4300-universalk9.17.12.07b.SPA.bin
Destination filename [isr4300-universalk9.17.12.07b.SPA.bin]? [press Enter]

The transfer begins immediately. Exclamation marks (!) indicate data blocks being received. With a block size of 8192, IOS XE images of 400–700 MB typically transfer in 5 to 15 minutes over a direct GigabitEthernet link — considerably faster than the default block size. 

Loading isr4300-universalk9.17.12.07b.SPA.bin from 10.0.0.1 (via GigabitEthernet0/0/0):
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
[OK - 598298624 bytes]

598298624 bytes copied in 312.540 secs (1914210 bytes/sec)

Do not reboot, power cycle, or disconnect either router during the transfer. A partial copy will leave a corrupted or incomplete file in storage, and you will need to delete it and start over.

Step 6 — Verify the Copied Image on the Destination Router

Once the transfer completes, run the MD5 verification on the destination router. Pass the expected MD5 value directly in the command so IOS gives you an immediate pass/fail result: 

NewRouter# verify /md5 bootflash:<image-filename.bin> <expected-md5-hash>

Example:

NewRouter# verify /md5 bootflash:isr4300-universalk9.17.12.07b.SPA.bin 9bc35e12bae261c8668903bac90edaba

verify /md5 (bootflash:isr4300-universalk9.17.12.07b.SPA.bin) = 9bc35e12bae261c8668903bac90edaba
Verified (bootflash:isr4300-universalk9.17.12.07b.SPA.bin) = 9bc35e12bae261c8668903bac90edaba

MD5 Hash MATCHES

MD5 Hash MATCHES confirms the copied image is bit-for-bit identical to the source. It is safe to set this as the boot image. If you see MD5 Hash DOES NOT MATCH, delete the file, confirm the source image is still healthy, and repeat the transfer.

Step 7 — Set the Copied Image as the Boot Image

Configure the destination router to boot from the newly copied image. Clear any existing boot statements first to avoid conflicts: 

NewRouter# configure terminal
NewRouter(config)# no boot system
NewRouter(config)# boot system bootflash:<image-filename.bin>
NewRouter(config)# end
NewRouter# write memory

Example:

NewRouter(config)# boot system bootflash:isr4300-universalk9.17.12.07b.SPA.bin

Confirm the boot statement saved correctly:

NewRouter# show run | include boot system
boot system bootflash:isr4300-universalk9.17.12.07b.SPA.bin

Also verify the boot path in NVRAM reflects the new image:

NewRouter# show boot
BOOT path-list      : bootflash:isr4300-universalk9.17.12.07b.SPA.bin
Config file         : bootflash:/startup-config

Step 8 — Reload and Confirm the Running Version

Reload the destination router and allow 3–5 minutes for it to fully boot. Reconnect via console and verify the running version: 

NewRouter# reload
Proceed with reload? [confirm]

After boot:

NewRouter# show version
Cisco IOS XE Software, Version 17.12.07b
...

The router is now running the correct IOS version — identical to the source router. For a bench replacement scenario, you can now proceed with configuration and production cable installation.

Step 9 — Clean Up Temporary Configuration

Once the destination router is confirmed healthy, remove the temporary TFTP and interface configuration from the source router. This is especially important if the source router is in production or will be reused: 

SourceRouter# configure terminal
SourceRouter(config)# no tftp-server bootflash:<image-filename.bin>
SourceRouter(config)# end
SourceRouter# write memory

If you added temporary IPs to the source router's interface (Scenario A — bench setup only), remove those as well: 

SourceRouter# configure terminal
SourceRouter(config)# interface GigabitEthernet0/0/0
SourceRouter(config-if)# no ip address
SourceRouter(config-if)# shutdown
SourceRouter(config-if)# end
SourceRouter# write memory

On the destination router, if the factory default image is still present and storage space is needed, you can safely delete it now that the new image is verified and booted: 

NewRouter# delete bootflash:<old-factory-image.bin>
Delete filename [old-factory-image.bin]? [confirm]
Delete bootflash:old-factory-image.bin? [confirm]

On IOS XE platforms, deleted files are immediately freed — there is no need to run squeeze. On older IOS platforms using flash:, you may need to run squeeze flash: after deletion to reclaim the space.

Troubleshooting

  • Ping fails between routers (Scenario A) — Run show interfaces GigabitEthernet0/0/0 on both routers and confirm the status shows up/up. Check that the Ethernet cable is firmly seated. Also confirm you assigned IPs on the same subnet (e.g., /30 means only .1 and .2 are valid hosts).
  • TFTP times out immediately — Confirm the tftp-server entry is still in the running config of the source router with show run | include tftp. Ensure you are using the correct IP address and that the filename is typed exactly as it appears in storage, including case.
  • Transfer stalls mid-copy — TFTP uses UDP with no built-in congestion control. A flapping link will cause the transfer to stall and eventually time out. Check the cable and link status. You will need to delete the partial file and restart the copy.
  • Not enough storage space — Run dir bootflash: (or dir flash:) and identify older images or unnecessary files. Delete them with delete bootflash:filename. On older IOS platforms, follow with squeeze flash: to reclaim space.
  • MD5 mismatch after transfer — The file was corrupted during the copy. Delete the file from the destination router, verify the source image MD5 is still healthy, and repeat the transfer. Also inspect the Ethernet cable for damage.
  • Router boots into old image after reload — The boot statement was not saved. Confirm with show boot, re-enter the boot system command, run write memory, and reload again.
  • Wrong storage prefix used — If commands return errors like file not found or invalid input, verify which storage the router uses with show file systems and ensure you are using the correct prefix (flash: or bootflash:) consistently.

Summary

Copying a Cisco IOS image directly between two routers without an external TFTP server is straightforward. The source router acts as its own TFTP server using the built-in tftp-server command, and the destination router pulls the file over any available Ethernet path. The procedure is identical across router models — only the storage prefix (flash: vs bootflash:) differs by platform.

  1. Calculate the source image MD5 with verify /md5 bootflash:<image> and note the value
  2. Check available storage on the destination router
  3. Connect routers directly and assign temporary IPs (bench / out-of-production only)
  4. Enable tftp-server on the source router pointing at the image
  5. Set ip tftp blocksize 8192 on the destination router for faster transfer
  6. Run copy tftp: bootflash: from the destination router
  7. Verify the copied image MD5 on the destination router — pass the noted hash and confirm MD5 Hash MATCHES
  8. Set the boot statement and save with write memory
  9. Reload and confirm show version reflects the correct IOS version
  10. Remove temporary TFTP, blocksize, and interface config from both routers

Standardising IOS versions before a router goes into production eliminates one variable at cutover and makes troubleshooting significantly easier if issues arise after the swap.