Cisco IOS Survival: Password Recovery, ROMMON, and SSH
Every network engineer eventually meets a router they can't log into, or one that won't boot. These aren't disasters — they're routine maintenance if you understand the boot process and the configuration register. This is the field-tested survival kit: recover a lost password, rescue a router with no valid image, and leave SSH configured so you never take console-cable risks again.
How a Cisco router boots (and why it matters)
On power-up, a router runs its bootstrap from ROM, reads the configuration register (a hex value like 0x2102) to decide where to find its OS, loads IOS from flash, then loads the startup configuration from NVRAM into running memory. The recovery tricks all work by interrupting or altering this sequence — usually by changing that config register.
Password recovery: skip the startup config
The premise: you have physical/console access but not the password. The move is to tell the router to ignore its startup configuration on boot, log in freely, then copy the real config back — preserving it — and reset the password.
! 1. Console in, power-cycle, send BREAK within ~60s to enter ROMMON
rommon 1 > confreg 0x2142 ! set register to IGNORE startup-config (NVRAM)
rommon 2 > reset ! reboot; router comes up with a blank config
! 2. It boots with no config -> skip setup wizard, go enable
Router> enable
Router# copy startup-config running-config ! LOAD the real config (don't erase!)
Router# configure terminal
Router(config)# enable secret NEW-STRONG-SECRET
Router(config)# interface ... / no shutdown ! interfaces load 'shut'; bring up as needed
! 3. Restore normal boot behavior, then save
Router(config)# config-register 0x2102
Router(config)# end
Router# copy running-config startup-configThe single most common mistake: copying running into startup while the config is still blank — that erases the real configuration. Always copy startup-config running-config first to pull the real config in.
No valid IOS image: recover from ROMMON
If flash is corrupt or empty, the router drops to ROMMON and can't boot. Two rescue paths. If a valid image still lives in flash, just point the router at it:
rommon 1 > dir flash: ! is there an image?
rommon 2 > boot flash:c2900-universalk9-mz.SPA.binIf flash is empty, use ROMMON's minimal TFTP client (xmodem over console is the last resort for tiny images):
rommon 1 > set IP_ADDRESS=10.0.0.2
rommon 2 > set IP_SUBNET_MASK=255.255.255.0
rommon 3 > set DEFAULT_GATEWAY=10.0.0.1
rommon 4 > set TFTP_SERVER=10.0.0.1
rommon 5 > set TFTP_FILE=c2900-universalk9-mz.SPA.bin
rommon 6 > tftpdnld ! pulls the image over the mgmt linkConfigure SSH so you never console in again
Telnet sends everything in cleartext and has no place on a modern network. Once you have access, set up SSH properly — it takes six lines and requires a hostname, a domain, and RSA keys (the domain feeds the key's fully-qualified name):
Router(config)# hostname R1
R1(config)# ip domain-name lab.example
R1(config)# crypto key generate rsa modulus 2048 ! 2048-bit minimum
R1(config)# ip ssh version 2 ! v2 only; v1 is broken
R1(config)# username admin privilege 15 secret STRONG-SECRET
R1(config)# line vty 0 4
R1(config-line)# transport input ssh ! SSH only, no telnet
R1(config-line)# login local
R1(config-line)# exec-timeout 10 0Add an ACL on the VTY lines to restrict management access to your jump host, and you've turned a console-cable-dependent box into one you can safely reach — and only from where you should.
The mental model to keep
- Config register controls boot behavior —
0x2102normal,0x2142ignore-NVRAM (recovery). - ROMMON is the rescue shell — reachable via BREAK at boot; it can set the register, boot a specific image, or TFTP a new one.
- Preserve, don't erase — load the real config before you change anything.
- Leave it better — SSHv2, strong secrets, VTY ACL, no Telnet.
A router you can't log into or won't boot is a config-register and boot-sequence puzzle, not a brick. Interrupt the boot, load the real config, fix what's wrong — and leave SSH behind so the console cable stays in the drawer.