A firmware upgrade by TFTP has three acts: get the genuine image, prove it arrived bit-perfect, and only then tell the switch to boot it. Skip the middle act and you are gambling a switch on a silent corruption. Here is the whole job, in the safe order.
Switches and routers accept firmware images over TFTP because their boot code speaks nothing else. The transfer itself is simple — the same server setup as the config-backup job. What separates a routine upgrade from a bricked switch is everything around the transfer: the image came from the vendor's official site for your exact model, its checksum matched the vendor's published value before the switch ever saw it, the old image stayed on the device as the way back, and the configuration was backed up first. This guide walks that order and explains what each check is really protecting you from.
Firmware is model-specific to a degree that surprises people: the same product family can have different images per hardware revision, and an image for the wrong model at best refuses and at worst disables the device. Download from the switch maker's official support site, matching the exact model number on the device's label, and note the checksum (MD5 or SHA) the vendor publishes beside the file. Images from forums, file-sharing links and "driver" sites are how compromised firmware enters networks — there is no legitimate reason to source one anywhere else.
Before the file goes near the switch, prove the download is bit-perfect. On Windows:
certutil -hashfile ios-image-v15.bin MD5 (use the file's real name, and SHA256 instead if that is what the vendor publishes)An upgrade that boots perfectly can still change defaults or behaviour. Take the config backup first — copy running-config tftp: as covered in this series — and record the currently running version from the device's version command. If the upgrade disappoints, you now hold both the old configuration and the knowledge of exactly which image the switch ran before.
Place the verified image in the TFTP root folder, then copy it onto the device — on Cisco IOS class switches the documented direction is copy tftp: flash: with the server address and file name. Two disciplines matter here:
Transfer over any network can corrupt silently, so verify a second time, now on the device itself. Cisco IOS provides the documented command verify /md5 flash:ios-image-v15.bin — compare with the vendor's value again. Only after it matches do you point the boot at the new image (on IOS class, the boot system configuration) and reload in a planned window. If the checksum fails on the device, delete that copy and transfer again — the file on your PC is already proven good, so the fault is in transit, not in the image.
When the switch returns, verify the running version is the new one, check the interfaces and a known service, and watch it through a normal working period. Keep the old image and the pre-upgrade config backup until the new version has earned trust — days, not minutes. Only then tidy up. An upgrade project ends with documentation: model, old version, new version, checksum verified, date. The next engineer's troubleshooting starts there.
The full TFTP server setup — installation, root folder, firewall and a live transfer — is shown step by step in the video.
▶️ Watch Full VideoTwo different enemies. On the PC, it proves your download is complete and is the vendor's genuine file — not truncated by a bad connection and not substituted by a fake download site. On the device, it proves the network transfer copied those exact bits. A single wrong bit in a firmware image can mean a switch that never boots, so both checks exist for a reason.
Nothing is broken — you compared two different kinds of fingerprint. A file has one MD5 value and a different SHA256 value; each only matches the same kind. Run certutil with the algorithm the vendor published for that file (certutil -hashfile file.bin SHA256) and compare like with like.
Only if you have no other choice, and understand what you are giving up: the old image is your instant way back if the new version misbehaves. Prefer deleting log files and genuinely obsolete files first. If the old image truly must go, keep a copy of it on the PC via TFTP before deleting — the file costs a few megabytes of disk and buys a complete retreat route.