I am trying the below Extended ACLs to restrict TFTP but still I am able to upload files to the router using tftp. Not sure, what is wrong, can you all help?

Approach 1:

permit udp host <ip> any eq 69
deny udp any any eq 69
permit ip any any 


ip access-group <ACL name> out

Even deny udp host any any eq 69 does not work.

With registering with inbound (in), I lose access to SSH with the follwoing error:packet_write_wait: Connection to port 22: Broken pipe

  • 1
    Generally, you should apply ACLs on ingress. That works more predictably/reliably and ensures the earliest possible filtering. Don't forget about the implied deny any any entry, so applying an empty rule denies all traffic.
    – Zac67
    Oct 21 '19 at 11:57
  • We need to see the rest of the ACL and the config for the interface you're applying it to, to know whether "out" or "in" is the correct direction. It depends on the type of interface you're applying it to.
    – Jesse P.
    Nov 20 '19 at 14:21
  • Are you doing a "copy tftp: flash:" on the router or are you on a remote system pushing files to the router via tftp? Dec 6 '19 at 20:40
  • Did any answer help you? If so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you can provide and accept your own answer.
    – Ron Maupin
    Dec 15 '19 at 19:40

Your Approach 1 should work, provided it is applied to the interface towards the server (allow only host IP to use TFTP).

If you apply that ACL on the ingress interfaces, towards the clients, it should work as well. Applying ACL for ingress traffic should always be preferred.

Note that you do need a permit ip any any at the end for an ACL to not drop all traffic (but the explicitly permitted) when applied - do not apply an empty or halfway done ACL to a live interface.

  • Sadly, Not working :/
    – Blake
    Oct 21 '19 at 13:02
  • The trick I use... 1 permit any any do my changes, and then no 1. (or remove the acl from the interface first...)
    – Ricky
    Oct 21 '19 at 15:19

Unfortunately, due to the fact that this traffic destined to the device/treated as management plane traffic, I don't think a regular ACL on the input interface will do the job. You must probably need to use a COPP (control-plane policy) to protect the device from unwanted traffic destined to port 69. Below is an example of this config:

ip access-l ex tftp 
 permit udp any any eq 69 
 permit udp any eq 69 any 
class match-all tftp 
 match access-group tftp 
policy-map tftp 
 class tftp 
 service-policy input tftp
  • Just in any case, be careful with the copp configuration, because it affects various traffic that is destined and generated by the device.



Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.