Password Recovery on Cisco routers

2011-01-05

It’s not often you may need to configure a Cisco router, but when the day comes, you wouldn’t want to stand there with your pants down just because you forgot the password. This article describes a common practice to restore the password on several models of Cisco routers. To reset a password on a Cisco machine is usually somethings that you can only do if you have physical access to the machine. It requires that there is some sort of connection between a computer and the router when it starts up. This is usually done by connecting a console cable from the router’s console port to a PC COM port. For the connection to work properly, the following terminal settings are used: 9600 baud rate, no parity, eight data bits, one stop bit and no flow control. These settings are used in a terminal application, such as Windows HyperTerminal and Putty. For computers that don’t have a COM port, there are USB accessories that provides such a port.

Start by connecting the router to your computer and start the terminal application. Then restart the router. During startup you should press [Break] or [Ctrl + Break] in the terminal program to stop the router in a state where the boot settings can be changed. It seems that these key combinations are used in most cases to interrupt the boot process. When the router is ready, you will be greeted by a prompt that looks something like the following: rommon 1>. There, the following command should be entered:

rommon 1> confreg 0x2142

Then use the following command to restart the router:

rommon 2> reset

0x2142 tells the router to boot up without loading the saved startup configuration. When the router is started, type the following command to enter configuration mode and load the saved startup configuration:

Router> enable
Router# copy startup-config running-config

Remember not to overwrite the saved configuration with the empty configuration that is running from the beginning. Now that the saved configuration is loaded you can change the password with the following commands:

Routernamn# configure terminal
Routernamn(config)# enable secret <new_password>

For the router to revert to booting from the saved configuration and not with an empty, you can restore the configuration you made in rommon mode. It is done with the following command which is used from the terminal configuration mode on the router:

Routernamn(config)# config-register 0x2102

Now the router will boot with your new password the next time you restart it. This is something I’ve tried on a few different routers in the 2600 series, a couple of different models of the 2800 Series and 800 Series. This method can differ among different types of routers and switches from Cisco. It could also be different depending on which version of IOS that is running on the machine. If this method is not working, you can check how this is done for your specific model on Cisco’s site for password reset.