Cisco IOS 4 - reset, password recovery

Reset to Factory Settings

There are many reasons why we might need to reset a device (its configuration) to factory settings. For switches, we have two methods available: hardware (requiring physical access to the switch) and software (requiring login with sufficient permissions).

Note: Before resetting switches, it is recommended to back up the configuration. I would also recommend making a backup of the IOS for each switch (or rather product line) as described in the second part.

Hardware Method

I would recommend this method; it seems simpler to me.

1. Press and hold the MODE button on the switch. After about 3 seconds, the LED lights will start flashing.
2. After about 7 seconds, the lights will stop flashing, release the button, and the switch will restart.
3. After starting, the configuration is erased.

Software Method

To reset the switch, we need to delete its configuration. It is stored in NVRAM memory in startup-config, plus VLAN information is stored in the vlan.dat file. Deletion can be done in several ways, considering what we want to delete.

To delete files in flash memory (file system), use the delete command. To delete the file system, use the erase command, which can delete bootflash:, flash:, or nvram:.

Note: When deleting files, they are only marked as deleted and can be recovered with the undelete command, or permanently deleted with the squeeze command. However, after using the erase command, everything is permanently deleted.

Previously, these two commands were used:

SWITCH#erase startup-config // deletes only the startup configuration
SWITCH#write erase // deletes NVRAM memory

They are still functional but have been replaced by the command:

SWITCH#erase nvram: // deletes NVRAM memory

With the erase command, we can also delete flash memory, where the IOS and VLAN configuration are stored. There are few situations where this is necessary. I warn again that using the following command will delete the IOS, and the switch will boot only into the limited RxBoot environment after a restart!

SWITCH#erase flash: // complete deletion of flash memory

If needed, we can delete the VLAN configuration from flash memory:

SWITCH#delete vlan.dat // deletes the vlan.dat file

After deleting the switch configuration, we need to restart it. This can be done with the command:

SWITCH#reload // restart the switch

Note: If the system asks whether to save changes to the configuration during reload, you must choose no. Otherwise, the current running configuration would be saved to the startup configuration.

Password Recovery - Lost Password

It may happen that we forget the password to the switch and need to log in. Of course, we do not want to lose the current configuration. The following procedure is for the Catalyst series 2900, 3500, 3700 (but may work elsewhere). We need physical access to the switch.

The principle is:

• Start the switch without the startup configuration
• Log in to privileged mode (without a password)
• Copy our original configuration to the running configuration
• Set the password
• Save the configuration

Here is the detailed procedure:

1. Connect to the switch via console (serial cable)
2. Disconnect the power from the switch
3. Press and hold the MODE button
4. Reconnect the power
5. The switch will stop at the beginning of the boot process
6. Then enter these commands

SWITCH:flash_init
SWITCH:load_helper
SWITCH:dir flash: // list memory
SWITCH:rename flash:config.text flash:config.old // rename the startup configuration
SWITCH:boot // boot
SWITCH>enable // started without password and config, privileged mode
SWITCH#rename flash:config.old flash:config.text // rename back
SWITCH#copy flash:config.text system:running-config // copy to running configuration (append)
Switch#configure terminal
Switch(config)#no enable secret // remove the password (or password)
Switch(config)#enable secret Cisco // set a new one
Switch(config)#exit
Switch#copy running-config startup-config // save the configuration

From a security perspective, we may want to disable this password recovery option. In newer IOS versions, this is possible with the command:

Switch(config)#no service password-recovery

Then, if someone attempts the password recovery procedure, the memory will be erased.