Back to All Scenarios
PASSEDnetwork / tftp_config_backup_failure
TFTP Server Unreachable — Switch Config Backup Failing
The TFTP server used for automated network device configuration backups becomes unreachable after a server migration. Nightly configuration backups for 80 network devices have not run for 7 days, leaving no recent configuration recovery point.
Pattern
CONNECTION_REFUSED
Severity
CRITICAL
Confidence
85%
Remediation
Auto-Heal
Test Results
| Metric | Expected | Actual | Result |
|---|---|---|---|
| Pattern Recognition | CONNECTION_REFUSED | CONNECTION_REFUSED | |
| Severity Assessment | CRITICAL | CRITICAL | |
| Incident Correlation | Yes | 4 linked | |
| Cascade Escalation | N/A | No | |
| Remediation | — | Auto-Heal — Corax resolves autonomously |
Scenario Conditions
TFTP server migrated to new IP without updating network device backup scripts. 80 switches and routers with nightly config backup to TFTP. 7 days of missed backups. No alerting on backup failures. Last known-good configs are 7 days stale.
Injected Error Messages (1)
TFTP server unreachable for network device config backups — connection refused on 10.10.10.30:69 after server migration, 80 network devices failing nightly configuration backup for 7 days, no recent config recovery points available, connection refused from all network devices attempting TFTP upload, last successful backup: 7 days ago
Neural Engine Root Cause Analysis
The TFTP server service on tftp01 (10.10.10.30) is not running or listening on port 69, evidenced by consistent connection refused errors from all 80 network devices for 7 days. This failure coincided with a server migration event, suggesting the TFTP daemon was not properly started or configured on the migrated infrastructure. The connection refused error specifically indicates the port is not bound, meaning the service is down rather than a network connectivity issue.
Remediation Plan
1. Deploy Corax agent to tftp01 server to verify TFTP service status 2. Attempt automatic service restart of TFTP daemon (likely tftpd or atftpd) 3. Verify service is listening on port 69 via netstat/ss 4. Test connectivity from a network device to confirm backup functionality 5. If service restart fails, escalate to human operator for manual configuration review and potential reinstallation
Tested: 2026-03-30Monitors: 1 | Incidents: 1Test ID: cmnck2irk06a3obqehlvcyzl3