Cisco

Cisco ASA 5500-X Series Firewall Password Recovery

Recover a lost ASA administrator password over the console port using ROMMON and the password-reset procedure. Requires physical access.

Overview

This guide provides step-by-step instructions for resetting lost or forgotten administrative passwords on enterprise networking hardware. Follow the procedure below carefully to regain access while preserving your device configuration.

Prerequisites

Before proceeding with password recovery, ensure you have a console cable, terminal emulation software configured to 9600 baud, and physical access to the device.

Step 1: Establish Console Connection

Connect your terminal cable to the console port of the device and open your serial terminal session.

Step 2: Interrupt the Boot Sequence

Power cycle the hardware and issue a Break key sequence during initial system startup to enter ROMMON mode.

Step 3: Reset Password & Configuration

Bypass startup configuration loading, boot into system software, set your new credentials, and save changes back to non-volatile memory.

Overview

ASA appliances store the administrator credential in the running configuration. Cisco provides a ROMMON-based password reset. Note that this procedure resets the ASA to a default configuration for the enable password and the saved configuration must be reloaded afterwards.

Prerequisites

Recovery Steps

  1. Connect the console and power-cycle the ASA.
  2. During boot, send the Break sequence (or press Esc) to enter ROMMON — rommon #0>.
  3. Set the configuration register to bypass the startup config and boot:
    rommon # > confreg 0x41
    rommon # > boot
  4. Once booted you are at an unprivileged prompt. Enter privileged EXEC with no password and load the saved configuration, or apply a new password and write it:
    ciscoasa> enable
    ciscoasa# configure terminal
    ciscoasa(config)# enable password <new-password>
    ciscoasa(config)# end
    ciscoasa# copy running-config startup-config
  5. Restore the configuration register and reload:
    ciscoasa# configure terminal
    ciscoasa(config)# config-register 0x1
    ciscoasa(config)# end
    ciscoasa# reload

Important

ASA password recovery clears the saved configuration unless you have a backup. Always take a configuration backup before starting.