Disabling Tftp And Auto-Tftp For Enhanced Security - HP Aruba JL253A Management And Configuration Manual

Procedure
1. Open an SSH session as you normally would to establish a secure encrypted tunnel between your computer
and the switch.
For more detailed directions on how to open an SSH session, see "Configuring secure shell (SSH)" in the
access security guide for your switch. Please note that this is a one-time procedure for new switches or
connections. If you have already done it once you should not need to do it a second time.
2. To enable secure file transfer on the switch (once you have an SSH session established between the switch
and your computer), open a terminal window and enter the following command:
switch(config)# ip ssh filetransfer
For information on disabling TFTP and auto-TFTP, see Disabling TFTP and auto-TFTP for enhanced security
on page 350.

Disabling TFTP and auto-TFTP for enhanced security

Using the ip ssh filetransfer command to enable SFTP automatically disables TFTP and auto-TFTP (if
either or both are enabled), as shown below.
Switch configuration with SFTP enabled
switch(config)# ip ssh filetransfer
Tftp and auto-tftp have been disabled.
switch(config)# sho run
Running configuration:
; J9091A Configuration Editor; Created on release #xx.15.xx
hostname "Switch"
module 1 type J8702A
module 2 type J702A
vlan 1
name "DEFAULT_VLAN"
untagged A1-A24,B1-B24
ip address 10.28.234.176 255.255.240.0
exit
ip ssh filetransfer
no tftp-enable
password manager
password operator
1
Enabling SFTP automatically disables TFTP and auto-tftp and displays this message.
2
Viewing the configuration shows that SFTP is enabled and TFTP is disabled.
If you enable SFTP and then later disable it, TFTP and auto-TFTP remain disabled unless they are explicitly re-
enabled.
Operating rules are:
• The TFTP feature is enabled by default, and can be enabled or disabled through the CLI or an SNMP
application. Auto-TFTP is disabled by default and must be configured through the CLI.
• While SFTP is enabled, TFTP and auto-TFTP cannot be enabled from the CLI. Attempting to enable either
non-secure TFTP option while SFTP is enabled produces one of the following messages in the CLI:
350
2
Aruba 2930F / 2930M Management and Configuration Guide
1
for ArubaOS-Switch 16.08