Huawei S5700 Factory Reset and Password Recovery (BootROM Guide)

2026年8月31日 LOG admin

Factory resetting a Huawei S5700 or S5735 is a task every network engineer eventually faces — forgotten password, decommissioning, or a config so broken it is easier to start over. Unlike Cisco IOS, Huawei’s VRP gives you two different reset commands with different scopes, and password recovery requires the BootROM menu rather than a config register trick. This field-tested guide covers CLI reset, BootROM password recovery, and the physical-button options, plus the security steps you must take after the reset.

Scope: Which Models and Command Sets This Applies To

The procedures below apply to the VRP-based S-series access and aggregation switches — S5700, S5720, S5735, S5731 and their siblings — and to the S6700/S7700/S9700 with the caveats noted. Two things vary between models and firmware versions and are worth confirming before you start: the ability to interrupt the boot sequence with Ctrl+B, and the exact BootROM menu numbering. The menu is almost always numbered the same way on S-series hardware, but the option that clears the console password is sometimes replaced by Clear User Password and sometimes sits under a submenu, so read the screen rather than trusting a screenshot from a different model.

It also helps to know which of the three recovery paths you actually need. If you can still log in (console, Telnet or SSH) you need a reset command. If you cannot log in but the switch boots normally, you need BootROM password recovery. If the switch does not finish booting, or the boot file itself is damaged, you need the BootLoad menu or a USB/TFTP reinstall — a different procedure with a different recovery image.

Before You Start: Back Up What Still Works

Even a switch that is about to be wiped may carry a configuration worth keeping: VLANs, ACLs, SNMP communities, and the exact interface descriptions that took two years to get right. Capture the configuration while you still can, and copy it off the device with TFTP or FTP rather than leaving it on flash.

display current-configuration
display saved-configuration
display startup
save
tftp 192.168.1.100 put vrpcfg.zip backup_s5700.zip

If the switch is part of a stack, note the stack ID and priority of every member, the stacking port assignments, and the MAD configuration before resetting anything — those details do not appear in a single display current-configuration output and are extremely tedious to reconstruct. Our guide to save and reset on Huawei switches walks through the startup file layout if you want to understand what vrpcfg.zip actually contains before you delete it.

Part 1: Factory Reset via CLI

If you still have console, Telnet or SSH access, back up the current configuration first:

display current-configuration

Then choose the right reset command:

reset factory-configuration     # full reset to factory defaults
reset saved-configuration       # clear stored startup config only
reset saved-configuration all   # clears additional related config files

The difference matters more than the similar names suggest. reset saved-configuration deletes the startup configuration file only: the running configuration stays live until the next reboot, and if you decline the save prompt, the switch comes back with an empty startup configuration while the flash file system — including files you uploaded, such as images or certificates — is otherwise untouched. reset factory-configuration is the full factory reset: it restores default settings, clears the startup configuration, and removes the user-created files that VRP considers part of the configuration state. On stack members there is reset factory-configuration per member, and on some platforms the command takes a slot argument so you can reset a single member of a stack.

Reboot to apply the reset — and when asked “Save the current configuration? [Y/N]”, answer N, or you will overwrite the startup config and undo the reset.

reboot
display startup
display saved-configuration

After the reboot, display startup should show no next-startup configuration file (or the default file only), and display saved-configuration should report that no configuration is present. If the old configuration is still there, you answered Y at the save prompt, and the reset was effectively cancelled.

Part 2: BootROM Password Recovery

Connect via console cable (9600 baud) and power-cycle the switch.
When “Press Ctrl+B to enter Boot Menu” appears, press Ctrl+B.
Enter the BootROM password (defaults: Admin@huawei.com or huawei depending on model/version).
Select “Clear password for console user” (menu option 7 on many S-Series models), confirm with Y, and reboot.
Log in without a password, then run the reset commands above if you need a full factory state.

Two details decide whether this works. First, the Ctrl+B window is short — a second or two after the memory self-test — so open a terminal session with logging enabled before you power the switch, and keep pressing Ctrl+B rather than waiting for the prompt to be readable. Second, if the switch boots from a saved configuration too quickly, Ctrl+B may be ignored; on the S5700 you can raise the chance of catching the window by rebooting from the console rather than pulling power.

Once you are in the BootROM menu, the option you want is the one that clears the console (and, on most S-series firmware, the boot password as well). Some firmware offers Modify BootROM password so you can change rather than clear it. Do not confuse this menu with Clear the config file, which is the BootROM equivalent of a factory reset and wipes everything — useful when the configuration is the problem, dangerous when only the password is.

If the console password is the only thing you have lost, clearing it is enough: boot normally, log in with the default credentials, and use super password to set a new one. If the switch rejects the default credentials as well, go back to the BootROM menu and clear the configuration completely.

A frequently asked variant is what to do when the BootROM password itself is unknown. On Huawei S-series hardware the BootROM password can be reset with a maintenance procedure that requires assistance from Huawei/TAC or an authorised service partner, since it is tied to the boot loader rather than to the configuration. The default Admin@huawei.com is the standard value and works on the overwhelming majority of switches that were never explicitly hardened; check the console password recovery walkthrough for the menu-by-menu version of this procedure.

Part 3: Physical Button (Limited Models)

Some models include a PNP button — pressing and holding it for more than 6 seconds restores factory defaults and reboots. This is the same as reset factory-configuration and does not delete the protected directory or protected/$_default.cfg. Button behavior varies by hardware revision, so prefer BootROM for predictable results. On stacked switches, the PNP button affects the member you press it on; the rest of the stack keeps running, which is convenient when you want to remove one member but a trap when you expected the whole stack to reset. See our note on which Huawei models have a PNP button and how stacking behaves for the model-by-model breakdown.

Stack Members and Post-Reset Identity

Resetting a stack member also erases its stack settings — disconnect stacking cables first if that is not intended, or the remaining members will report a link down on the stacking ports and may elect a new master. If the switch is the master of an iStack or CSS pair, resetting it triggers an election in which one of the other members takes over, and the management IP address may move. Plan the reset as a stack event, not a single-switch event: decide in advance whether you are removing one member, rebuilding the stack, or converting a stacked pair back to standalone switches, because each path needs a different order of operations.

After the Reset: Security First

After reset, the switch loads default credentials (commonly admin / admin@huawei.com). If the switch stays connected to the network during this window it is a glaring vulnerability — disconnect it, change the password immediately with super password, re-enable SSH (stelnet server enable), patch the firmware, and only then reconnect.

system-view
aaa
local-user admin password irreversible-cipher <strong-password>
local-user admin privilege level 15
local-user admin service-type ssh terminal
stelnet server enable
user-interface vty 0 4
 authentication-mode aaa
 protocol inbound ssh
quit
undo telnet server enable
save

A minimal hardening checklist for the first fifteen minutes after a factory reset: set a strong password and remove any default accounts you do not need; restrict management access to an out-of-band VLAN or a management ACL rather than leaving VTY open to the whole network; disable Telnet and any unencrypted management protocol; configure NTP so that logs carry meaningful timestamps; add a syslog server and SNMP read-only community (or SNMPv3) so the switch is visible before it breaks; and check the firmware version against the vendor’s latest advisory, because a switch that sat in a rack for three years typically needs an upgrade.

Troubleshooting the Recovery Itself

The switch ignores Ctrl+B. The window is short and some terminal software drops characters during the boot burst. Lower the baud rate if supported, disable flow control, reboot from the CLI, and hold Ctrl+B repeatedly rather than once.
The default BootROM password is rejected. The switch was hardened at some point, or the firmware expects a different default for that model generation. Try the documented alternatives, then escalate to the vendor — brute-forcing the boot loader is not a supported path.
Console shows nothing at all. Usually a cable or terminal problem: Huawei console settings are 9600-8-N-1 with no flow control, and a rollover cable is required. If the switch never prints the boot banner, suspect the power supply or a failed boot loader.
The configuration comes back after the reset. The reboot prompt was answered Y, or a configuration file was restored automatically by a startup script or by the stack master. Answer N, and disconnect the switch from the network before rebooting.
The switch boots into a boot loop. Stop at the BootLoad menu and load a known-good image over TFTP or USB; this is an image problem, not a password problem.
The PNP button does nothing. Some models require the button to be held for the full duration while powered, and the feature may be disabled in the running configuration. Use the CLI or BootROM menu instead.

Which Method Should You Use?

If you can log in: reset saved-configuration for a quick clean start that keeps the file system, reset factory-configuration for a true factory state. If you cannot log in: BootROM menu, clear console password, then reset from the CLI if needed. If the device will not boot: BootLoad menu and a reinstall. If it is a spare being handed to a new owner: factory reset plus the hardening checklist, and confirm afterwards with display version and display current-configuration that no trace of the previous configuration remains. For a comparison of the two reset commands with examples from other models, see saved-configuration vs factory-configuration.