Cisco IOS Password Recovery Procedure: Step-by-Step

2026年8月30日 LOG admin

Losing the enable password on a Cisco device is a rite of passage for every network engineer - and it is recoverable on most IOS platforms without factory-resetting the device. The procedure works by interrupting the boot, changing the configuration register so the startup configuration is ignored, and then re-setting the password from the running configuration. This guide walks through the classic 12-step IOS password recovery, explains the config-register values, and notes the platform differences (ISR G2 vs Catalyst switches) that trip people up.

Why Password Recovery Works: The Boot Sequence Behind It

Every Cisco IOS device makes a decision in the first seconds after power-on: which configuration file should it load? That decision is encoded in a 16-bit value held in non-volatile memory called the configuration register. Bit 6 of that register controls whether the device reads the startup configuration from NVRAM or ignores it entirely and boots as though it were fresh from the factory. Password recovery exploits that single bit. Rather than attacking the stored credential — enable secrets are kept as MD5, SHA-256 or scrypt hashes and are not practically reversible — the engineer simply persuades the device to boot without the configuration that contains the password, then pastes that configuration back into a running system where it can be edited. Nothing is cracked. The old hash is overwritten once the configuration is restored. That is why the procedure is officially documented and supported by Cisco, and why it works the same way in ROMMON, in the bootstrap image, and in a full IOS image.

It is worth understanding the three phases of the boot process, because each one gives you a different place to intervene:

ROMmon / bootstrap. The very first code that runs. It has no passwords at all and offers the confreg command. If you can interrupt boot and reach this prompt, recovery is straightforward.
Boot loader / mini-IOS. Some platforms (Catalyst 2960/3560/3750, older ISR) drop into a Switch: or router(boot)> prompt instead of ROMmon. Here you manipulate the flash filesystem directly.
Full IOS. The normal operating system. If the configuration register is already set to ignore NVRAM, IOS starts with a factory-default configuration and no password prompts.

Before You Start: Prerequisites and Cautions

Password recovery is a disruptive operation. Treat it as a maintenance-window task and read this list before touching a production device:

You need physical or console access. Recovery cannot be performed over SSH, Telnet, SNMP or any in-band management path, because the whole point is to bypass authentication. A console server or a laptop with a USB-to-serial adapter and a rollover cable is mandatory.
Terminal settings. 9600 baud, 8 data bits, no parity, 1 stop bit, no flow control. The vast majority of IOS devices use these defaults; a few legacy platforms and some ROMMON prompts use 115200.
The device will reboot at least twice. Every interface, routing adjacency and VPN tunnel on the box drops. Plan for an outage.
Back up the configuration first if you can. If you still have read access via TACACS/RADIUS or a lower privilege level, capture show running-config to a TFTP server, USB stick or your terminal buffer. Once the device boots with a default config, its old NVRAM contents are what you restore — if you make a mistake and save, you have permanently lost the original configuration.
Do not save the running configuration until step 12 is complete. Saving too early commits a password-less configuration to NVRAM and turns a recoverable problem into a rebuild.
Know your recovery status. On newer platforms the no service password-recovery command permanently disables the ROMmon break sequence. Run show version and look for the recovery line before you promise anyone a fix.

Detailed Timing: Capturing the Break

The single most common reason recovery fails is that the engineer misses the break window. The break must land after the boot banner appears but before IOS starts loading. Because that window can be under a second on fast platforms, use these techniques:

Open the terminal session before powering the device on, and start sending the break sequence continuously as soon as power is applied.
In PuTTY, the break sequence is Ctrl+Break; many laptops have no Break key, so use Ctrl+Fn+B, Ctrl+Fn+F11 or the PuTTY menu option Special Command → Break.
On macOS Terminal use screen /dev/tty.usbserial* 9600 and send Ctrl+A then Ctrl+B; with minicom use Ctrl+A then F.
On Catalyst switches the trigger is not a keystroke at all — hold the Mode button on the front panel while the switch boots until the Switch: prompt appears.
If the device reaches IOS, let it boot completely and try again rather than fighting the console. Slower is more reliable than guessing.

Troubleshooting the Recovery Itself

Once you are in ROMmon the rest is mechanical, but these failure modes show up regularly:

confreg 0x2142 is rejected. Usually a typo or a platform that expects only confreg followed by interactive prompts (older 2500/4000 series). Run confreg alone and answer the questions.
The device still asks for a password after reset. The configuration register change did not take. Verify with show version and confirm the last line reads Configuration register is 0x2142. If it still shows 0x2102, you are editing the wrong register or the value was lost before reset.
copy startup-config running-config fails with "Cannot open" or an NVRAM error. NVRAM is corrupt or empty. On IOS you can sometimes recover by copying from a TFTP backup instead: copy tftp: running-config.
The restored config immediately re-locks you out. On IOS XR routers (ASR 9000, NCS) the equivalent of ROMMON recovery uses a different flow, and on some platforms the generated .cfg file in the bootflash must be used. Check the platform-specific guide.
Interface shutdowns reappear. The configuration you restored contains shutdown statements on interfaces you want up. After copy startup-config running-config, run show ip interface brief and issue no shutdown where needed before saving.

Verifying and Hardening After Recovery

Do not call the job finished when you can log in. Verify the device is genuinely healthy, then close the door you just walked through:

Router# show version
Router# show running-config | include enable|username|aaa
Router# show ip interface brief
Router# show ip route summary
Router# show ip protocols

Then apply the hardening checklist:

Set a strong enable secret — enable secret (SHA-256 or scrypt on modern IOS) rather than the weak enable password, which is stored with the trivially reversible type-7 scheme.
Replace any plaintext username X password Y lines with username X secret Y, or better, move local accounts under aaa new-model with aaa authentication login default local.
Add service password-encryption so that any remaining type-7 strings are not readable over a shoulder or in a backup file.
Restrict console and VTY access with line con 0 / line vty 0 4, login local, transport input ssh, and an access-class ACL that permits only management subnets.
Round out with login block-for 120 attempts 5 within 60 to slow down brute-force attempts against the VTY lines.
Generate RSA keys and disable Telnet entirely: crypto key generate rsa modulus 2048 and ip ssh version 2.

Finally, decide deliberately whether you want future engineers to be able to repeat this procedure. The command no service password-recovery protects a stolen device but also means that if the password is lost again, the device must be wiped and rebuilt from scratch. Many operators leave recovery enabled and rely instead on AAA, three-tier access and a documented password vault.

Password Recovery by Platform

The 12-step flow above is the canonical IOS procedure, but the mechanics differ slightly across the family:

ISR G2 / ISR 4K / ASR 1000. Classic ROMmon break, confreg 0x2142, reset. Straightforward.
Catalyst 2960 / 3560 / 3750 / 3850. Mode-button break, then rename config.text in flash.
Catalyst 9000 (IOS XE). The break sequence depends on the platform; on some models you enter the recovery image from the bootloader menu. The system config-register setting replaces the classic command in some versions.
Cisco Nexus (NX-OS). A completely different flow, using the loader> prompt and the boot kickstart/boot system commands, plus initrd recovery.
IOS XR (ASR 9000, NCS). Recovery relies on editing the boot parameters and using the ROMMON confreg or the platform's password-recovery flags.

Frequently Asked Questions

Does password recovery erase my configuration? No — if you follow the steps correctly. The startup configuration stays in NVRAM untouched while the router runs from a default configuration. Step 9 copies it back in. The risk is human error, not the procedure itself.

Can I recover a password over SSH? No. Authentication is exactly what you are bypassing, so there is no in-band path. Console access is required.

Will this void my support contract? No. Password recovery is a documented, supported Cisco procedure. What does void support entitlement is hardware modification.

How long does it take? Fifteen to forty-five minutes on a router, depending on how many interfaces need no shutdown afterwards and whether you have a configuration backup to compare against.

What if there is no console and no config backup? You are left with no service password-recovery territory: the device must be wiped. This is why a configuration archive on a TFTP/SFTP server or an Oxidized/RANCID instance is worth its cost.

Preventing the Next Recovery

Every recovered device is a documented weakness in process. Close the loop by storing enable secrets in a password manager rather than in a spreadsheet, enabling TACACS+ or RADIUS for command authorization so that lockout is a permission problem rather than a credential problem, scheduling automated configuration backups, and registering every device serial number with a break-glass procedure that names who is allowed to use the Mode button and when.

The Procedure (Classic IOS Routers)

Connect to the console port with a terminal emulator (9600 baud).
Power-cycle the router. Within 60 seconds, send Break (Ctrl+Break on most emulators) to interrupt the boot.
You should land at the ROMMON prompt: rommon 1>
Change the configuration register to ignore the startup config:
rommon 1> confreg 0x2142
Boot the router: rommon 2> reset
The router boots without the startup configuration (factory defaults, no passwords).
Answer no to the initial configuration dialog.
At the Router> prompt enter privileged mode - no password needed: enable
Load the saved configuration back:
Router# copy startup-config running-config
Set a new password:
Router(config)# enable secret NEWPASSWORD
Restore the config register:
Router(config)# config-register 0x2102
Save: Router# write memory and reload to verify.

Understanding the Config Register

0x2102 - normal boot, reads startup config (the correct final value).
0x2142 - ignore NVRAM startup config, boot to default (recovery mode).
0x2101 - boot into ROMmon (can also be used for recovery).

Check the current value with show version (last line: "Configuration register is 0x2102").

Catalyst Switch Differences

Catalyst 2960/3560/3750/9300 work the same way but the break timing is different: watch the console output during boot and press Mode button or the Break sequence when Switch: appears:

Switch: flash_init
Switch: load_helper
Switch: dir flash:
Switch: rename flash:config.text flash:config.old
Switch: boot

Renaming config.text bypasses the startup config. After boot, copy it back (copy flash:config.old flash:config.text), set a new password and save.

Important Notes

You need physical/console access - password recovery cannot be done over SSH/Telnet.
The enable secret (hashed) is in the config; after copy startup-config running-config you must overwrite it with a new secret.
On newer platforms (ISR 4K, Catalyst 9000) the procedure may use the password-recovery enable setting - check show version output for the recovery status.