Cisco Prime 3.9 TFTP Repository

[RoadRunner4k]

Hi all. 

Hope someone can help to answer this question. I need to update a webauth cert on our Aireos 5520, which seems only to support TFTP for transfer. 

Since we are in strict enviroment only place we got a TFTP service is on our Prime 3.9.

They webauth cert is uploaded in 

Directory of disk:/defaultRepo
3348480 Mar 11 2022 20:12:07 20220308-bundle.tar
2250385850 May 31 2021 13:28:45 PI-Upgrade-37x_38x_to_3.9.0.0.219.tar.gz
7751 Mar 14 2023 08:19:48 cert.pem

From the WLC can i directly get it from here? or do i need to transfer it to disk:/tftp ?

[Sandeep Choudhary]

cant you directly transfer the webauth cert from your laptop(TFTP software must be installed here) ?

Regards

Dont forget to rate helpful posts

[RoadRunner4k]

Would be the easiest way, but we don’t have that possibility   I know it should be possible to use Prime for it.

[Rich R]

Don't you have a Cisco router or switch (which the WLC is connected to) which you can copy the cert to and then use that as a TFTP server?  That's what we've done since we disabled TFTP server on our network for security reasons.

[RoadRunner4k]

we cant enable it on them either since its not allowed in our company, but i know that my previcous colleague have used prime for this, as its in the same subnet as our WLC.

[Rich R]

Ok that is probably your best option then.

[Rich R · Accepted solution]

If you really want to use Prime this answer suggests it is possible: https://community.cisco.com/t5/network-management/using-cisco-prime-as-a-scp-sftp-ftp-tftp-server-from-router/m-p/4175003/highlight/true#M136895 and explains where to put the files - in /localdisk/tftp

Remember that files need to be world readable to be accessed by TFTP clients because there's no authentication - chmod 444 cert.pem (readable - more secure) or chmod 666 cert.pem (read/write - not secure).

Using secure in the same sentence as TFTP is an oxymoron though because TFTP is inherently insecure - it was never designed to be secure in any way.  Ludicrous that AireOS doesn't support http transfer for all files but that's the way they did it and it won't change now - network/WLC security apparently wasn't high on their list of priorities.