topic Re: Cisco Prime 3.9 TFTP Repository in Wireless

Cisco Prime 3.9 TFTP Repository

RoadRunner4k — Tue, 14 Mar 2023 10:28:00 GMT

Hi all.

Hope someone can help to answer this question. I need to update a webauth cert on our Aireos 5520, which seems only to support TFTP for transfer.

Since we are in strict enviroment only place we got a TFTP service is on our Prime 3.9.

They webauth cert is uploaded in

Directory of disk:/defaultRepo
3348480 Mar 11 2022 20:12:07 20220308-bundle.tar
2250385850 May 31 2021 13:28:45 PI-Upgrade-37x_38x_to_3.9.0.0.219.tar.gz
7751 Mar 14 2023 08:19:48 cert.pem

From the WLC can i directly get it from here? or do i need to transfer it to disk:/tftp ?

Re: Cisco Prime 3.9 TFTP Repository

Sandeep Choudhary — Tue, 14 Mar 2023 10:46:55 GMT

cant you directly transfer the webauth cert from your laptop(TFTP software must be installed here) ?

Regards

Dont forget to rate helpful posts

Re: Cisco Prime 3.9 TFTP Repository

RoadRunner4k — Tue, 14 Mar 2023 10:58:47 GMT

Would be the easiest way, but we don’t have that possibility 😞 I know it should be possible to use Prime for it.

Re: Cisco Prime 3.9 TFTP Repository

Rich R — Tue, 14 Mar 2023 13:01:03 GMT

Don't you have a Cisco router or switch (which the WLC is connected to) which you can copy the cert to and then use that as a TFTP server? That's what we've done since we disabled TFTP server on our network for security reasons.

Re: Cisco Prime 3.9 TFTP Repository

RoadRunner4k — Tue, 14 Mar 2023 13:05:22 GMT

we cant enable it on them either since its not allowed in our company, but i know that my previcous colleague have used prime for this, as its in the same subnet as our WLC.

Re: Cisco Prime 3.9 TFTP Repository

Rich R — Tue, 14 Mar 2023 13:13:35 GMT

If you really want to use Prime this answer suggests it is possible: https://community.cisco.com/t5/network-management/using-cisco-prime-as-a-scp-sftp-ftp-tftp-server-from-router/m-p/4175003/highlight/true#M136895 and explains where to put the files - in /localdisk/tftp

Remember that files need to be world readable to be accessed by TFTP clients because there's no authentication - chmod 444 cert.pem (readable - more secure) or chmod 666 cert.pem (read/write - not secure).

Using secure in the same sentence as TFTP is an oxymoron though because TFTP is inherently insecure - it was never designed to be secure in any way. Ludicrous that AireOS doesn't support http transfer for all files but that's the way they did it and it won't change now - network/WLC security apparently wasn't high on their list of priorities.

Re: Cisco Prime 3.9 TFTP Repository

Rich R — Tue, 14 Mar 2023 13:42:58 GMT

Ok that is probably your best option then.