IP Services Fix · Medium ~15 min · 3 devices · 5 tasks · CCNA v1.1 and v2.0

SCP config backup fails: fix routing, SSH and SCP

R1 must keep a copy of its running config on the backup server BACKUP (192.168.50.10) using SCP, and it must push the approved template branch-base.cfg from its flash into R2 flash, also over SCP. Both copies fail today. R1 cannot route to the server LAN, and R2 cannot accept SCP at all: it has no domain name, no RSA key and its SCP server is off. R2 already has AAA and the local account SCP needs. Transfers are simulated, but they only succeed when routing, SSH and the accounts would really work.

R1 Gi0/0 10.0.12.1/30 to R2 Gi0/0 10.0.12.2/30
R2 Gi0/1 192.168.50.1/24 to BACKUP 192.168.50.10/24 (SCP server, gateway 192.168.50.1)
Accounts: backup, password Bk2026 on BACKUP; admin, password Adm2026 on R2

Topology

Tasks

○R1 routes 192.168.50.0/24 through R2 and ping 192.168.50.10 succeeds
○R2 runs SSH version 2 with a 2048 bit RSA key
○R2 accepts SCP (ip scp server enable)
○The R1 running config is copied to 192.168.50.10 with SCP
○branch-base.cfg is copied from R1 flash into R2 flash with SCP

Hints (open one at a time)

Hint 1: read the error

Try the backup on R1: copy running-config scp://backup@192.168.50.10/r1-confg. Timed out means there is no working path to the server. Check show ip route on R1.

Hint 2: the route

Add ip route 192.168.50.0 255.255.255.0 10.0.12.2 on R1 and test with ping 192.168.50.10. The server already uses R2 as its gateway, so replies find their way back.

Hint 3: SSH on R2

Connection refused from R2 means nothing listens on TCP port 22. On R2 run ip domain name lab.local, then crypto key generate rsa modulus 2048, then ip ssh version 2. Check with show ip ssh.

Hint 4: SCP on R2

SCP runs over SSH but has its own switch: ip scp server enable. It also needs AAA authorization so R2 can see that admin has privilege 15, and that part is already in place.

Hint 5: the copies

Each copy asks you to confirm the host, the username and the file name. Press Enter to accept each default, then type the password. For the push use copy flash:branch-base.cfg scp://admin@10.0.12.2/branch-base.cfg and check with dir flash: on R2.

Full solution

R1# configure terminal
R1(config)# ip route 192.168.50.0 255.255.255.0 10.0.12.2
R1(config)# end
R1# ping 192.168.50.10
R1# copy running-config scp://backup@192.168.50.10/r1-confg
! press Enter three times, then type the password Bk2026

R2# configure terminal
R2(config)# ip domain name lab.local
R2(config)# crypto key generate rsa modulus 2048
R2(config)# ip ssh version 2
R2(config)# ip scp server enable
R2(config)# end

R1# copy flash:branch-base.cfg scp://admin@10.0.12.2/branch-base.cfg
! press Enter three times, then type the password Adm2026
R2# dir flash:

The engine checks the path in both directions, SSH and SCP on the far end and the account. Unlike a real console, the password you type is shown here.

Stuck on a lab, or not sure what to practice next?

Talk it through with a mentor on a free 20-minute call. We look at your lab, your exam date and your weak spots, and you leave with a plan.

Book a free session

Cisco Mentorship

CompTIA Foundation

Firewall Security

Short Courses

More

CCNA

Network+

NSE 4

CCNP

SCP config backup fails: fix routing, SSH and SCP

Stuck on a lab, or not sure what to practice next?