How to Reset a Cisco Switch to Factory Defaults Safely

By Stackvora Team · 2026-08-21 · 8 min read

Resetting a Cisco switch sounds trivial until you discover the VLAN database survived, the switch still boots an old image, or you locked yourself out because console access was never tested. This is the safe procedure, including what most guides forget.

Before you touch anything

• Save the current config off-box. copy running-config tftp: or capture the console session to a file. You will want it.
• Confirm physical console access. A reset removes management IPs and SSH keys. If your only path is remote, do not proceed until someone can reach the console port.
• Note the IOS version and boot statement. show version and show boot.
• Check stack membership. Resetting a stack member changes switch numbering and priorities.

Standard reset on Catalyst IOS / IOS-XE

enable
write erase
delete flash:vlan.dat
delete /force /recursive flash:.rollback_timer
reload

When prompted to save the modified configuration, answer no — saving reinstates what you just erased. The vlan.dat deletion matters: write erase does not remove the VLAN database, so a "reset" switch can come back still carrying VLANs 10–400 and a VTP domain, which then propagates into your production VTP domain the moment you plug it in.

On IOS-XE 16.x and newer you can also use the single command:

factory-reset all secure 3-pass

That wipes configuration, licences state, crash files and user data with secure overwrite. Expect it to take 20–90 minutes depending on flash size, and never run it on a switch you do not have console access to.

Small-business (CBS / SG series)

These run a different OS. Use Administration → File Management → Configuration Operations, copy the factory defaults to startup, then reboot — or hold the physical Reset button for 15–20 seconds while powered on. The CLI equivalent is:

delete startup-config
reload

Password recovery when you cannot log in

If the enable secret is unknown, break into ROMMON. Power-cycle the switch and hold the Mode button until the SYST LED blinks, then:

switch: flash_init
switch: dir flash:
switch: rename flash:config.text flash:config.old
switch: boot

The switch boots without a configuration. Enter privileged mode, rename the file back if you want to keep the config, set a new secret, and save. On some platforms the equivalent is setting the config register to 0x2142:

confreg 0x2142
reset
! after boot
copy startup-config running-config
enable secret NewStrongSecret
config-register 0x2102
write memory

After the reset — a sane rebuild baseline

hostname ACC-SW-01
no ip domain-lookup
ip domain-name example.com
crypto key generate rsa modulus 2048
username admin privilege 15 secret <strong-password>
line vty 0 15
 transport input ssh
 login local
service password-encryption
vtp mode transparent
spanning-tree mode rapid-pvst
spanning-tree portfast bpduguard default

Setting VTP to transparent on a freshly reset switch is a cheap insurance policy: it prevents an accidental VLAN database overwrite of the rest of the campus.

Common mistakes

Verification checklist

1. show running-config shows a default configuration.
2. show vlan brief lists only VLAN 1 and the default reserved VLANs.
3. show vtp status shows revision 0.
4. show version confirms the intended image is running.
5. Management access works over SSH from the new baseline.

Resetting a stack member

Stacks add complexity that catches people out. Resetting the active switch triggers a re-election and a brief control-plane disruption for the whole stack, so schedule it accordingly. Before removing or resetting a member, record the current numbering and priorities with show switch detail, because a reset member rejoins with default priority and can take over the active role on the next reload. Renumber deliberately after the reset:

switch 2 renumber 2
switch 1 priority 15
switch 2 priority 14
reload slot 2

Also confirm the software version on the reset member matches the stack. A mismatched image puts the member into version-mismatch state and it will not join until auto-upgrade completes — which can take fifteen minutes and looks like a failed reset if you are not expecting it.

Decommissioning versus repurposing

If the switch is leaving your organisation, a configuration erase is not enough. Use factory-reset all secure 3-pass so credentials, certificates, licence state and crash dumps are overwritten rather than merely unlinked, and record the serial number and completion time for your asset-disposal evidence.

Follow this order and a factory reset is a five-minute, low-risk operation. Paste your show version and show vtp status output into Stackvora AI if a reset behaves unexpectedly, and browse the knowledge base for stack and ROMMON specifics.