There are times when you need to recover Cisco Router password. This tutorial shows how to do it in few simple and detailed steps. Depending on the router model, the configuration might be slightly different, but the concept remains same (check Summarized Steps)

Although it is possible to bypass router password feature, but it is not possible to recover encrypted passwords. Plain text passwords can be viewed from saved configuration but the encrypted passwords must be changed to a new password.

Summarized Steps

  1. Connect to router console port using terminal or PC using terminal emulation with appropriate settings.
  2. (Optional) Find configuration register
  3. Enter ROMMON mode
  4. Change the configuration register
  5. Recover or change passwords
  6. Change back the configuration register

Connect to Router

Attach a PC with terminal emulation to the console port of the router using the following settings

  • 9600 baud rate
  • No parity
  • 8 data bits
  • 1 stop bit
  • No flow control

Make sure to use rollover cable for connection

(Optional) Find configuration register

Use the following command to check configuration register.

Router>show version
...
DRAM configuration is 64 bits wide with parity enabled.
55K bytes of NVRAM.
16384K bytes of ATA System CompactFlash (Read/Write)

Configuration register is 0x2102

Router>

Configuration register is at the end of the output.

Entering ROMMON mode

Power cycle the router. Turn it off using power switch and turn the router back on.
Within 60 seconds press Break in terminal to enter ROMMON mode
Note : The break sequence is different in every terminal emulation software (usually it is Ctrl+Break), check the documentation for details.

Here are the few common standard break key combination

Hyperterminal : Ctrl + Break
Putty : Ctrl + Break
Telnet : Ctrl + ], then type “send brk”

Configuration Register

By default the configuration register is set to 0×2102. In order to bypass the router password, the configuration register has to be changed to 0×2142.
Under ROMMON mode enter the following command

rommon 1>confreg 0x2142
rommon 2>reset

reset command will reboot the router

Recovering passwords

When the router reboots, it will not prompt for password because of the configuration register. The router will be loaded from flash, so the configuration (NVRAM) will be blank.
Important : Do not type “copy running-config startup-config”. This will overwrite the startup config with blank configuration file.

Copy the configuration to the running-config

Router#copy startup-config running-config

Thats it. Now all you have to do is reassign the password if it is encrypted, or recover from running-config if it is unencrypted.

Revert Configuration Register

After everything is done, set the configuration register back to 0×2102 (or whatever value was at the beginning of password recovery process)

Router(config)#config-register 0x2102

Save the configuration file to commit all the changes.

Summary

Depending on the router model there might be minor differences in setting configuration register. Check Cisco documentation for details.

Extra Reading : Disable Password Recovery