Trivial File Transport Protocol

The Trivial File Transport Protocol (TFTP) is often used to transfer software images (for system upgrades) and configuration files from a central storage location to a networking device. Because it is so useful in that regard ( especially because of its low overheadit runs over UDP over IP and actually has a message-confirmation process, although it is not as sophisticated as that of TCP), Cisco does not recommend not using it. However, no usernames and passwords are required between a TFTP server and client, and the information is sent in the clearwhich could potentially expose your configuration files to a packet sniffer en route.

Normally, TFTP uses UDP port 69 along with UDP ports greater than 1023 for the data stream itself. These ports, too, are well known to hackers, along with the typical uses of TFTP in the network. Therefore, Cisco recommends that TFTP sessions be run through IPSec tunnels whenever possible. The payload should be encrypted in the tunnel.