How to Copy an IOS Image to a Cisco Switch or Router

Loading a new IOS image onto a Cisco device is a four-step job: get the file onto flash, verify it, set the boot variable, and reload. Skipping the verification step is how devices end up in ROMMON.

Before You Start

Switch# show version
Switch# show flash:
Switch# dir flash:

Check three things:

1. Free space. The image is typically 30–150 MB. If flash is nearly full you will need to delete the old image first — which means you have no fallback, so make sure you can recover.
2. The correct image for this model. The exact platform and feature set matter. Loading the wrong one produces a device that boots into ROMMON.
3. A current configuration backup. Always, before any upgrade.

Switch# copy running-config tftp:

Method 1 — TFTP

The traditional method. It needs a TFTP server reachable from the device.

Switch# copy tftp: flash:
Address or name of remote host []? 10.10.10.50
Source filename []? c2960-lanbasek9-mz.152-7.E3.bin
Destination filename [c2960-lanbasek9-mz.152-7.E3.bin]?

Accessing tftp://10.10.10.50/c2960-lanbasek9-mz.152-7.E3.bin...
Loading c2960-lanbasek9-mz.152-7.E3.bin from 10.10.10.50 (via Vlan1): !!!!!!!!
[OK - 17530368 bytes]

If it fails, work through these in order:

Method 2 — USB (fastest, when the device has a port)

Switch# dir usbflash0:
Switch# copy usbflash0:c2960-lanbasek9-mz.152-7.E3.bin flash:

The USB stick must be FAT16 or FAT32 — NTFS and exFAT are not recognised. This is the quickest method for a large image and needs no network at all.

Method 3 — SCP (the right choice in production)

Encrypted, authenticated, and considerably faster than TFTP.

! Enable the SCP server on the device
Switch(config)# ip scp server enable
Switch(config)# aaa new-model
Switch(config)# aaa authentication login default local
Switch(config)# aaa authorization exec default local
Switch(config)# username admin privilege 15 secret StrongPassword

Then push from your workstation:

scp c2960-lanbasek9-mz.152-7.E3.bin [email protected]:flash:/

Or pull from the device:

Switch# copy scp: flash:

Verify the Image — Do Not Skip This

A truncated or corrupted image will not boot, and you will discover that after the reload, remotely, with no working device.

Switch# verify /md5 flash:c2960-lanbasek9-mz.152-7.E3.bin
........................Done!
verify /md5 (flash:c2960-lanbasek9-mz.152-7.E3.bin) = 8f14e45fceea167a5a36dedd4bea2543

Compare that against the MD5 hash published on Cisco’s download page. If it does not match exactly, delete the file and transfer again — do not reload.

Switch# verify flash:c2960-lanbasek9-mz.152-7.E3.bin

This also checks the embedded image signature on platforms that support it.

Set the Boot Variable and Reload

Switch(config)# boot system flash:c2960-lanbasek9-mz.152-7.E3.bin
Switch(config)# end
Switch# show boot
Switch# write memory
Switch# reload

Two points here:

• Boot statements are tried in order. Leaving the old image as a second boot system line gives you an automatic fallback if the new one fails — worth doing if you have the flash space.
• Save before reloading. The boot variable is configuration; unsaved, the device comes back on the old image.

After the reload:

Switch# show version | include image|System image
Switch# show flash:

Recovering a Device With No Usable Image

If the device drops to rommon 1>, it could not load an image. You have two options.

ROMMON with TFTP (fast — use this if the device has an Ethernet management port that works in ROMMON)

rommon 1 > set IP_ADDRESS=10.10.10.1
rommon 2 > set IP_SUBNET_MASK=255.255.255.0
rommon 3 > set DEFAULT_GATEWAY=10.10.10.254
rommon 4 > set TFTP_SERVER=10.10.10.50
rommon 5 > set TFTP_FILE=c2960-lanbasek9-mz.152-7.E3.bin
rommon 6 > sync
rommon 7 > tftpdnld

Xmodem over console (slow — hours for a large image)

rommon 1 > xmodem -c c2960-lanbasek9-mz.152-7.E3.bin

Then send the file from your terminal program using Xmodem. Raising the console speed to 115200 first makes a substantial difference — at 9600 baud a 50 MB image is not a realistic transfer.

rommon 1 > confreg 0x2101
rommon 2 > set BAUD=115200

Remember to set the console speed back afterwards.

Switch Stacks

Every member must run the same image or it will not join the stack. On a stack, copy to all members:

Switch# copy tftp: flash1:
Switch# copy tftp: flash2:

! Or use the archive command, which handles distribution
Switch# archive download-sw /overwrite /reload tftp://10.10.10.50/image.tar

Newer platforms use the install model instead:

Switch# install add file flash:image.bin activate commit

Sensible Practice

• Back up the configuration first. Every time.
• Verify the MD5 hash before setting the boot variable.
• Keep the previous image on flash as a fallback boot statement where space allows.
• Have console access available — if the upgrade goes wrong, the network path is gone. Dedicated out-of-band management exists precisely for this.
• Read the release notes. Some upgrades change default behaviour or deprecate commands you rely on.
• Upgrade one device at a time in a redundant pair, and confirm the first is healthy before touching the second.
• Do it in a maintenance window. Boot times of five minutes or more are normal on larger platforms.

Frequently Asked Questions

Why does my TFTP transfer fail partway through?

Usually insufficient flash space, a UDP 69 block partway along the path, or an MTU problem. Check free space with show flash: and confirm you can ping the server from the device first.

How do I check an IOS image is not corrupted?

verify /md5 flash:<filename> and compare the result against the hash published on Cisco’s download page. Do this before reloading, not after.

Can I delete the old image?

Yes, once the new one is verified and confirmed working after a reload. Keeping it until then gives you a fallback, so delete it only if flash space forces the issue.

What is the boot variable?

The boot system configuration telling the device which image to load. Multiple statements are tried in order, which is how you configure a fallback.

My device booted into ROMMON — what now?

It could not load a valid image. Recover by transferring one with tftpdnld if the ROMMON Ethernet port works, or with Xmodem over console if not. Then set the boot variable and reload.

Does the device need to reload to use the new image?

Yes on classic IOS. Platforms supporting ISSU or Cisco StackWise can upgrade with minimal disruption, but a standard switch or router requires a reload. See running vs startup configuration for what survives it.