Network FundamentalsNetworking SecurityBeginner

The Cisco IOS file system: flash, NVRAM, copying files and the running configuration

By Mohamed Fayas 8 min readUpdated 15 October 2026

In short: Cisco IOS stores files in named locations such as flash: for software images, nvram: for the startup configuration and system: for the running configuration in RAM. The copy command moves files between them and to servers such as TFTP or SCP. Copying a file into the running configuration merges the commands; configure replace swaps the whole configuration.

Files inside a network device

A router or switch is a small computer, and like any computer it keeps files. Knowing where they live lets you upgrade software, back up configurations and recover from mistakes. IOS gives each storage area a name that ends with a colon, a bit like a drive letter.

Figure 1. IOS names each storage location with a prefix ending in a colon, so the same copy command works for local and remote files.

flash: is non-volatile storage for IOS image files and anything else you save, such as configuration backups.
nvram: holds the startup-config, the configuration loaded when the device boots.
system: holds the running-config, the live configuration in RAM. It is lost at power-off unless you save it.
tftp:, ftp:, scp: and http(s): are not local storage but remote servers you can copy to and from.

Looking around

show file systems
dir flash:
more flash:backup-2026-10.cfg
show version
verify /md5 flash:ios-image-file.bin

show file systems lists every location with its size and free space. dir lists files, and more displays a text file. show version tells you which image the device booted from. Before you boot a new image, check its hash with verify and compare it with the value published by the vendor, so you know the file is complete and genuine.

Copying files and configurations

Every copy has the same shape: copy source destination. IOS asks for missing details, such as the server address and file name.

copy running-config startup-config
copy running-config flash:backup-2026-10.cfg
copy running-config scp://[email protected]/r1.cfg
copy scp://[email protected]/new-image.bin flash:
delete flash:old-image.bin

Saving the running configuration to the startup configuration is the everyday one. The short form write memory still works on most platforms.
Prefer SCP to TFTP. TFTP has no authentication or encryption, so configurations (which contain password hashes and SNMP details) cross the network in clear text.
Check free space in flash before copying a new image, and keep the old one until the new one has proved itself.

Copying into the running configuration: merge, not replace

Figure 2. Copying a file into the running configuration merges it; configure replace swaps it completely.

This catches many people out. When you copy a file into the running configuration, for example copy flash:backup.cfg running-config or copy startup-config running-config, IOS reads the file line by line as if you typed it in configuration mode. Commands in the file are added or overwrite matching settings, but anything in the running configuration that is not mentioned in the file stays. If you added a test ACL after the backup was taken, it is still there after the "restore".

When you want the running configuration to match a file exactly, use configure replace. It compares the two, removes extra lines, adds missing ones and can roll back automatically if you do not confirm.

archive
 path flash:archive/r1-
 write-memory
!
configure replace flash:backup-2026-10.cfg list
show archive

The archive feature keeps a numbered copy each time you save, giving you a simple local history to roll back to.

Real-world example: an upgrade night at a logistics depot

An engineer at a fictional parcel depot had to upgrade the core switch during a two-hour window. Beforehand she ran show file systems to confirm there was room for the new image, copied it over SCP, checked the MD5 hash against the vendor's value and saved a configuration backup to flash and to the backup server. After the reload, one uplink came up in the wrong VLAN because a colleague had changed it after the last backup. Rather than copying the backup over the top, which would have merged and left the stray change in place, she used configure replace with the saved file, reviewed the listed differences and confirmed. The switch was back to its known state ten minutes later.

Practice

Where is the startup configuration stored, and where is the running configuration?

The startup configuration is in NVRAM (nvram:). The running configuration is in RAM, shown as system:running-config.

You run copy startup-config running-config to undo a change. Why might the change still be there?

Copying into the running configuration merges. Lines that exist only in the running configuration are not removed. Use configure replace to make it match the file exactly.

Why is SCP better than TFTP for configuration backups?

SCP authenticates the user and encrypts the transfer. TFTP has neither, so the configuration crosses the network in clear text.

Key takeaways

IOS names storage with prefixes such as flash:, nvram: and system:.
copy source destination works for local files and remote servers.
Copying into running-config merges; configure replace replaces.
Use SCP instead of TFTP, and verify image hashes before booting.
The archive feature keeps a history of saved configurations.

Tracks your learning on this device only. See your progress on the learning paths.

About the author

Mohamed Fayas

Founder of FM TecHub. CCNA certified, with a BTEC HND in Network Engineering, and BEng (Hons) in Computer Networking and Cloud Security. He writes practical, plain-English guides on networking, security and cloud.

More about the author