Cisco Router Password Recovery
There are times when you need to recover Cisco Router password. This tutorial shows how to do it in few simple and detailed steps. Depending on the router model, the configuration might be slightly different, but the concept remains same (check Summarized Steps)
Although it is possible to bypass router password feature, but it is not possible to recover encrypted passwords. Plain text passwords can be viewed from saved configuration but the encrypted passwords must be changed to a new password.
Summarized Steps
- Connect to router console port using terminal or PC using terminal emulation with appropriate settings.
- (Optional) Find configuration register
- Enter ROMMON mode
- Change the configuration register
- Recover or change passwords
- Change back the configuration register
Connect to Router
Attach a PC with terminal emulation to the console port of the router using the following settings
- 9600 baud rate
- No parity
- 8 data bits
- 1 stop bit
- No flow control
Make sure to use rollover cable for connection
(Optional) Find configuration register
Use the following command to check configuration register.
Router>show version
...
DRAM configuration is 64 bits wide with parity enabled.
55K bytes of NVRAM.
16384K bytes of ATA System CompactFlash (Read/Write)
Configuration register is 0x2102
Router>
Configuration register is at the end of the output.
Entering ROMMON mode
Power cycle the router. Turn it off using power switch and turn the router back on.
Within 60 seconds press Break in terminal to enter ROMMON mode
Note : The break sequence is different in every terminal emulation software (usually it is Ctrl+Break), check the documentation for details.
Here are the few common standard break key combination
Hyperterminal : Ctrl + Break
Putty : Ctrl + Break
Telnet : Ctrl + ], then type “send brk”
Configuration Register
By default the configuration register is set to 0×2102. In order to bypass the router password, the configuration register has to be changed to 0×2142.
Under ROMMON mode enter the following command
rommon 1>confreg 0x2142 rommon 2>reset
reset command will reboot the router
Recovering passwords
When the router reboots, it will not prompt for password because of the configuration register. The router will be loaded from flash, so the configuration (NVRAM) will be blank.
Important : Do not type “copy running-config startup-config”. This will overwrite the startup config with blank configuration file.
Copy the configuration to the running-config
Router#copy startup-config running-config
Thats it. Now all you have to do is reassign the password if it is encrypted, or recover from running-config if it is unencrypted.
Revert Configuration Register
After everything is done, set the configuration register back to 0×2102 (or whatever value was at the beginning of password recovery process)
Router(config)#config-register 0x2102
Save the configuration file to commit all the changes.
Summary
Depending on the router model there might be minor differences in setting configuration register. Check Cisco documentation for details.
Extra Reading : Disable Password Recovery
| This entry was posted by Arsalan A. Suzuki on August 24, 2010 at 7:33 pm, and is filed under Cisco, IOS, Security. Follow any responses to this post through RSS 2.0. You can leave a response or trackback from your own site. |
