SCP: The Backup Server Cannot Pull the Config
SSH logins work, so SCP should too. It does not. Find the two things SCP needs that SSH does not, live, right below.
Symptom
SSH logins work and the nightly SCP backup still fails. SCP needs two things from the router that SSH does not.
Your mission
Inspect, recover, then verify
Format
Cisco IOS CLI
Investigate before you configure.
Use the CLI evidence to isolate the fault, make the smallest safe correction, then verify the network state changed.
Observe the symptom and link state.
Diagnose by comparing the protocol evidence.
Verify the expected device state and confirm the original symptom is resolved.
Console access: R1
This workspace stacks for portrait phones. Rotate to landscape for the full split-screen console.
Need a hint?
Reveal the root cause when you're ready.
Try the investigation first, then use this as your escape hatch, not a dead end.
Create a free account to open SCP: The Backup Server Cannot Pull the Config. You get the root cause and the full step-by-step fix.
No spam. The fix lands in your inbox too. Your account includes 5 guided labs free. After that, the Learning Pass unlocks every remaining lab.
Lab debrief
Turn the session into a repeatable troubleshooting pattern.
Use this reference after your attempt: first explain the symptom, then verify the evidence, then confirm the repair.
The problem
A backup server at 10.1.1.20 is meant to copy R1's configuration every night over SCP. SSH logins to R1 work, but every SCP transfer fails.
What you'll practice
- Confirm the SSH server state with show ip ssh
- Explain why SCP needs AAA exec authorization
- Enable the SCP server with ip scp server enable
- Contrast SCP (TCP 22, encrypted) with TFTP (UDP 69, unencrypted)
The topology
A single router, R1, with SSH version 2 already working and a privilege 15 local user, backup, for the backup server.
Commands to run yourself
The real diagnostic commands for this lab, copy-paste ready. Run these in the same order to reproduce the investigation on your own session.
show ip sshshow running-config | include scp|aaashow running-config | include usernameTopology diagram
Fact-checked references
The commands and behaviour in this lab were checked against these primary references.
Frequently asked
Why is SSH not enough?
SSH provides the encrypted transport. The SCP server is a separate function that has to be turned on, and it needs the user to be authorized for an exec session through AAA.
Does aaa new-model affect anything else?
Yes. It switches every line to AAA method lists. Configure the login and exec lists in the same change so that console and vty access keep working.
Can the router be the SCP client instead?
Yes. copy running-config scp:// sends the file from the router to a remote SCP server. In that case the remote server must run SCP, and the router's own SCP server is not involved.
Ready to run this lab yourself?
No setup, no image sourcing. Book a session or ask for a live demo.