Cisco

Cisco ASA5520 Password Recovery

Step-by-step password recovery for the Cisco ASA5520 (ASA 5505-5585 (classic)). Console access required.

Overview

This guide provides step-by-step instructions for resetting lost or forgotten administrative passwords on enterprise networking hardware. Follow the procedure below carefully to regain access while preserving your device configuration.

Prerequisites

Before proceeding with password recovery, ensure you have a console cable, terminal emulation software configured to 9600 baud, and physical access to the device.

Step 1: Establish Console Connection

Connect your terminal cable to the console port of the device and open your serial terminal session.

Step 2: Interrupt the Boot Sequence

Power cycle the hardware and issue a Break key sequence during initial system startup to enter ROMMON mode.

Step 3: Reset Password & Configuration

Bypass startup configuration loading, boot into system software, set your new credentials, and save changes back to non-volatile memory.

Overview

This procedure recovers administrator access to the Cisco ASA 5520 when the enable password is lost. The ASA loads with an empty configuration via ROMMON and the configuration register (confreg 0x41), then the config is restored — nothing is erased.

Prerequisites

Console cable (RJ-45 to DB-9 or USB) with a terminal session at 9600 baud, 8N1. Physical or remote power access to reboot the ASA. Break-signal capability (Ctrl+Break) from the terminal emulator.

Recovery Procedure

Connect the console cable and open a terminal session (9600 8N1).
Power-cycle the ASA (or issue reload).
Within 60 seconds of power-on, send the break sequence (Ctrl+Break) repeatedly until the ROMMON prompt appears: rommon #>.
Set the configuration register to skip the startup config: confreg 0x41 (0x41 = ignore the startup configuration; 0x1 = load normally).
Boot the ASA: boot (or boot disk0:/asa<version>.bin if prompted).
The ASA boots with an empty configuration. At the Type help or '?' for a list of available commands prompt, you are in privileged mode automatically (the prompt ends with #).
Restore the startup configuration: copy startup-config running-config (if the startup config exists; it does — it was only skipped).
Enter configuration mode: configure terminal.
Remove the existing enable password: no enable password, then set a new one: enable password <new-password>. Also reset the login password if one was configured: password <new-password> (applies to console/SSH login).
Restore the normal configuration register: config-register 0x1.
Exit and save: end, then write memory.
Reboot to verify: reload. Confirm the ASA boots with the restored config and the new passwords work.

Important Notes

The ASA configuration is not erased — it is skipped via confreg 0x41 and restored in step 7. Never skip the config-register 0x1 step, or the ASA will keep booting with an empty config.
On ASA 5505–5585, ROMMON is reached via Ctrl+Break during boot. On ASA 5506-X/5508-X/5516-X, ROMMON is reached by pressing Esc during boot (they have no break-to-ROMMON) — see the separate guide for those models.
If the ASA has no password-recovery enabled in its config, the ROMMON bypass is blocked and the config can only be wiped — check with show running-config | include password-recovery before you need this.
ASDM access also uses the enable password — this procedure restores both CLI and ASDM access.

Protecting Your Configuration

Before recovery, back up the config: copy running-config tftp://<server>/<filename> or copy running-config disk0:. After recovery, verify show running-config and show version (config register 0x1).