Reset a Cisco Switch Password Without Losing the Config

When administrative access to a Cisco Catalyst switch is lost due to forgotten passwords, regaining control without erasing the entire configuration is…

When administrative access to a Cisco Catalyst switch is lost due to forgotten passwords, regaining control without erasing the entire configuration is critical for maintaining network uptime and minimizing reconfiguration efforts. This procedure leverages the switch's ROMmon mode to bypass the stored configuration, allowing for password reset and configuration recovery.

This guide specifically covers Cisco Catalyst 2960, 3560, 3750, and similar series switches running Cisco IOS. While the core principles apply broadly, command syntax and button locations may vary slightly on newer Catalyst 9000 series or Nexus devices.

Preparation and Initial Access

Before beginning, ensure you have a console cable (RJ-45 to DB-9 or USB-C to USB-A depending on your switch model) and a terminal emulator configured for the correct serial port settings (typically 9600 baud, 8 data bits, no parity, 1 stop bit, no flow control). Physical access to the switch is mandatory.

Connect the Console Cable: Attach the console cable from your management workstation to the switch's console port.
Open Terminal Emulator: Launch your terminal emulator (e.g., PuTTY, SecureCRT, Tera Term) and configure the serial connection.
Power Cycle the Switch: Disconnect the power cord from the switch, wait 10-15 seconds, then reconnect it.
Enter ROMmon Mode: As soon as the switch powers on, look for the "Mode" button on the front panel. Press and hold this button. On many Catalyst 2960 models, the "Mode" button is near the system status LEDs. Continue holding until the SYST LED blinks amber, then release it. You should see the switch: prompt in your terminal. If you miss this window, the switch will boot normally, and you'll need to power cycle and try again.

Bypassing the Stored Configuration

In ROMmon mode, the switch operates with a minimal set of instructions and does not load the full Cisco IOS or its saved configuration by default. We need to initialize the flash file system and then rename the startup configuration file to prevent the switch from loading it.

switch: flash_init
Initializing Flash...
flashfs[0]: 373 files, 2 directories
flashfs[0]: 0 orphaned files, 0 orphaned directories
flashfs[0]: Total bytes: 33554432
flashfs[0]: Bytes available: 20038656
flashfs[0]: flashfs fsck took 1 seconds.
... done initializing flash.
switch: rename flash:config.text flash:config.old
switch: boot

Explanation of commands:

flash_init: Initializes the flash file system, making it accessible for file operations. This is crucial before attempting to rename files.
rename flash:config.text flash:config.old: This command renames the default startup configuration file (config.text or sometimes config.txt on older platforms) to config.old. By doing so, the switch will not find a valid startup configuration during the boot process. It will instead boot into a factory-default state, effectively bypassing all passwords and configuration settings.
boot: Instructs the switch to proceed with the normal boot sequence. Since config.text is renamed, it will load the Cisco IOS image but without any saved configuration.

The switch will now boot up. You will see typical boot messages, and eventually, the switch will prompt you to enter the initial configuration dialog (Would you like to enter the initial configuration dialog? [yes/no]:). Enter no at this prompt.

Accessing and Recovering the Configuration

After booting without the configuration, the switch will be in a factory-default state with no passwords set. You'll be at the Switch> user EXEC prompt.

Enter Privileged EXEC Mode:
```
Switch> enable
Switch#
```
Since no enable password is set, you will immediately enter privileged EXEC mode.
Rename the Configuration File Back: Now, we need to restore the original configuration file so we can copy it to the running configuration.
```
Switch# rename flash:config.old flash:config.text
```
Copy Startup Configuration to Running Configuration: This command loads all settings from your saved configuration file into the switch's active memory.
```
Switch# copy flash:config.text running-config
Destination filename [running-config]? 
... (output may show lines being copied) ...
```
Press Enter when prompted for the destination filename.
Verify Configuration and Change Passwords: At this point, your switch should have its original configuration loaded. However, old passwords are still active in the running configuration. You must change them immediately.

Changing Passwords

It's crucial to update all relevant passwords to regain secure access.

Switch# configure terminal
Enter configuration commands, one per line.  End with CNTL/Z.
Switch(config)# enable secret <NEW_ENABLE_PASSWORD>
Switch(config)# line console 0
Switch(config-line)# password <NEW_CONSOLE_PASSWORD>
Switch(config-line)# login
Switch(config-line)# exit
Switch(config)# line vty 0 15
Switch(config-line)# password <NEW_VTY_PASSWORD>
Switch(config-line)# login
Switch(config-line)# exit
Switch(config)# username <NEW_USERNAME> secret <NEW_USER_PASSWORD>  (If using local authentication)
Switch(config)# exit

Notes on passwords:

enable secret: This is the preferred method for the privileged EXEC mode password. It stores the password encrypted (type 5 or 7, depending on IOS version). Use a strong, complex password.
password under line console 0: Sets the console port password.
password under line vty 0 15: Sets the Telnet/SSH access password for virtual terminal lines. For enhanced security, consider configuring SSH and disabling Telnet.
username ... secret ...: If your switch uses local authentication for login (e.g., login local under VTY/console lines), update these credentials.

Saving the New Configuration

After changing all necessary passwords, save the running configuration to the startup configuration. Otherwise, upon the next reboot, the switch will revert to the old (password-protected) configuration or the default state if you didn't successfully copy back the config.text.

Switch# write memory
Building configuration...
[OK]

Alternatively:

Switch# copy running-config startup-config
Destination filename [startup-config]? 
Building configuration...
[OK]

It's always a good practice to verify the changes by attempting to log in with the new passwords via the console, and if configured, via SSH/Telnet.

Common Pitfalls and Troubleshooting

Missing ROMmon prompt: If you consistently miss the switch: prompt, you might not be holding the Mode button long enough or releasing it too late. The timing can be tricky; a good indicator is the SYST LED blinking amber.
Flash initialization errors: If flash_init fails or reports errors, there might be an issue with the flash memory itself. This is rare but can happen. Try the command again.
config.text vs. config.txt: On some very old IOS versions or specific models, the startup configuration file might be named config.txt instead of config.text. If renaming fails, try both. You can list the flash contents with dir flash: in ROMmon to confirm the exact filename.
Incomplete configuration restore: If, after copying flash:config.text running-config, your configuration still seems incorrect, ensure you successfully renamed config.old back to config.text and that the copy command completed without errors.
Old passwords still active: This usually means you copied the old configuration back but forgot to change the passwords and save the running configuration. Always change all relevant passwords (enable, console, VTY, local user accounts) and then save.
Connectivity issues post-recovery: After the process, ensure all interfaces are up and assigned to the correct VLANs. Sometimes, specific interface states or IP addresses might appear lost if the copy running-config startup-config step was not performed correctly after loading the configuration.
Switch reboots to factory default repeatedly: This indicates that the write memory or copy running-config startup-config command was not executed or failed after you set the new passwords. The changes were only in running memory and were lost upon reboot.