TFTP Server Setup - Easy GUI Tool

The Security Truth First

TFTP (Trivial File Transfer Protocol) is the small, old file-transfer protocol that network devices still depend on. Switches, routers, IP phones and PXE boot systems use it because it is tiny enough to live inside device firmware - a switch that needs its configuration backed up, or a router that needs a firmware file, often speaks only TFTP.

What You Need Before Starting

Keep four things ready - nothing here costs money, and skipping one is what causes most failed first transfers:

1. A Windows PC on the same LAN and subnet as the switch, router or phone you will transfer with.
2. A fixed IP address on that PC for the duration of the job (in the video the PC is 192.168.1.10) - the device sends files to this address, so it must not change mid-transfer.
3. A free GUI TFTP server tool downloaded from its official site only - this class of tool is a favourite target for fake download sites.
4. Administrator rights on the PC, because binding to UDP port 69 and the firewall rule both need elevation.

Create One Clean Root Folder

The root folder is the only folder the server can see. Every file a device downloads must sit in it, and every file a device uploads will land in it. A TFTP server has no browsing and no search - a device asks for a file name, and the server looks in exactly this one place. Make the path short and simple, with no spaces:

C:\TFTP-Root

Put the firmware file or empty target file for today's job inside it, and keep nothing else there. File names are literal - the name typed on the device must match the file in this folder character for character, including the extension and capitalisation.

Install the Tool and Point It at the Folder

Install the free GUI tool and open its settings before you start the server. The popular free tools in this class - Tftpd64 and SolarWinds TFTP Server are the common names - all follow the same layout, so the steps stay valid whichever one you use. Two settings decide almost everything:

1. Root / base directory: point it at the folder you just created, C:\TFTP-Root.
2. Server interface / bind address: choose the LAN adapter's IP address (for example 192.168.1.10), not a virtual adapter or a VPN address - a very common cause of "device cannot reach the server".

Then start the server and run it as administrator. The status should change to running / listening on UDP port 69. Prove it before blaming the network - on the PC, open Command Prompt and run:

netstat -an | findstr :69

A UDP ... :69 line means the tool owns the port and is listening. No line at all means the server is not really running yet - a firewall rule will not help until it is.

Allow UDP Port 69 in Windows Firewall

TFTP fails quietly - there is no friendly error on the PC; the device just retries and reports a timeout. If the tool's first-run firewall popup was dismissed, add the rule manually: open Windows Defender Firewall with Advanced Security → Inbound Rules → New Rule, choose Port → UDP → Specific local ports: 69, allow the connection, and tick the Private profile only (and Domain in an office) - leave Public unticked. Name it honestly, for example TFTP Server UDP 69, so you know later why it exists.

First Transfer - Back Up the Switch Configuration

Now run the first real transfer: copying the switch's running configuration to the PC. On the switch console, run the copy command and answer the two prompts with the PC's IP address and the destination file name:

copy running-config tftp:
Address or name of remote host []? 192.168.1.10
Destination filename [running-config]? switch-config.cfg

Watch both ends: the tool's log pane should show the transfer arriving from the switch, and the file switch-config.cfg should appear inside C:\TFTP-Root. If the switch reports a timeout and the log stays empty, the request never arrived - go back to the firewall rule and the bind address, in that order.

Verify, Move the Backup Out and Stop the Server

Open the received file and confirm it is a complete configuration, not an empty or cut-off file. Then move it the same day into your real backup system - a dated folder on the file server or backup drive, under whatever access control that system has. A switch configuration typically contains local password hashes, SNMP community strings, VPN details and a complete map of your network, so it should never sit in an open folder.