Cisco IOS Password Recovery Procedure: Step-by-Step

Losing the enable password on a Cisco device is a rite of passage for every network engineer - and it is recoverable on most IOS platforms without factory-resetting the device. The procedure works by interrupting the boot, changing the configuration register so the startup configuration is ignored, and then re-setting the password from the running configuration. This guide walks through the classic 12-step IOS password recovery, explains the config-register values, and notes the platform differences (ISR G2 vs Catalyst switches) that trip people up.

The Procedure (Classic IOS Routers)

1. Connect to the console port with a terminal emulator (9600 baud).
2. Power-cycle the router. Within 60 seconds, send Break (Ctrl+Break on most emulators) to interrupt the boot.
3. You should land at the ROMMON prompt: rommon 1>
4. Change the configuration register to ignore the startup config:
   rommon 1> confreg 0x2142
5. Boot the router: rommon 2> reset
6. The router boots without the startup configuration (factory defaults, no passwords).
7. Answer no to the initial configuration dialog.
8. At the Router> prompt enter privileged mode - no password needed: enable
9. Load the saved configuration back:
   Router# copy startup-config running-config
10. Set a new password:
    Router(config)# enable secret NEWPASSWORD
11. Restore the config register:
    Router(config)# config-register 0x2102
12. Save: Router# write memory and reload to verify.

Understanding the Config Register

• 0x2102 - normal boot, reads startup config (the correct final value).
• 0x2142 - ignore NVRAM startup config, boot to default (recovery mode).
• 0x2101 - boot into ROMmon (can also be used for recovery).

Check the current value with show version (last line: "Configuration register is 0x2102").

Catalyst Switch Differences

Catalyst 2960/3560/3750/9300 work the same way but the break timing is different: watch the console output during boot and press Mode button or the Break sequence when Switch: appears:

Switch: flash_init
Switch: load_helper
Switch: dir flash:
Switch: rename flash:config.text flash:config.old
Switch: boot

Renaming config.text bypasses the startup config. After boot, copy it back (copy flash:config.old flash:config.text), set a new password and save.

Important Notes

• You need physical/console access - password recovery cannot be done over SSH/Telnet.
• The enable secret (hashed) is in the config; after copy startup-config running-config you must overwrite it with a new secret.
• On newer platforms (ISR 4K, Catalyst 9000) the procedure may use the password-recovery enable setting - check show version output for the recovery status.

Related: ASR 9001 password recovery and Juniper SRX configuration guide.

原文链接：https://www.cisco.com/c/en/us/support/docs/routers/1700-series-modular-access-routers/5894-conf-trouble-5894.html