Cisco

Cisco C9300-48T Password Recovery

Step-by-step password recovery for the Cisco C9300-48T (Catalyst 9300 (IOS-XE)). Console access required.

Overview

This guide provides step-by-step instructions for resetting lost or forgotten administrative passwords on enterprise networking hardware. Follow the procedure below carefully to regain access while preserving your device configuration.

Prerequisites

Before proceeding with password recovery, ensure you have a console cable, terminal emulation software configured to 9600 baud, and physical access to the device.

Step 1: Establish Console Connection

Connect your terminal cable to the console port of the device and open your serial terminal session.

Step 2: Interrupt the Boot Sequence

Power cycle the hardware and issue a Break key sequence during initial system startup to enter ROMMON mode.

Step 3: Reset Password & Configuration

Bypass startup configuration loading, boot into system software, set your new credentials, and save changes back to non-volatile memory.

Overview

This procedure recovers administrator access to the Cisco Catalyst C9300-48T (Catalyst 9000 family, IOS-XE) when the enable secret or local user passwords are lost. The startup configuration is preserved (renamed, not erased).

Prerequisites

Console cable (RJ-45 or USB-C console on newer 9300X/9500 models) with a terminal session at 9600 baud, 8N1. Physical access to power-cycle the switch and press the Mode button on the front panel.

Recovery Procedure — Mode Button Method

Connect the console cable and open a terminal session (9600 8N1).
Power-cycle the switch (unplug power, wait 5 seconds, replug).
Within 15 seconds of power-on, press and HOLD the Mode button on the front panel (right side). Keep holding until the system LED turns solid amber (about 10–15 seconds). Do not release early — a brief press does nothing.
Release the Mode button. The switch enters ROMMON and shows the boot loader prompt: switch:.
Initialize flash: flash_init
List the flash contents: dir flash: — locate the configuration file. On a standalone unit it is config.text; on a stack it is per-member (config.text-1, config.text-2, ...).
Rename the configuration so the switch boots without it: rename flash:config.text flash:config.text.old (use the correct per-member name if stacking).
Boot the switch: boot — if the boot image is not auto-discovered, use boot flash:packages.conf (the IOS-XE package file on Catalyst 9300/9500).
The switch boots to the CLI with an empty configuration. Enter enable (no password required).
Restore the saved configuration: copy flash:config.text.old system:running-config — when prompted for the source filename, enter flash:config.text.old.
Enter configuration mode: configure terminal.
Set a new enable secret: enable secret <new-password>.
Set line passwords: line vty 0 15 → password <new-password> → login; repeat for line console 0. If local users exist, reset them: username <name> privilege 15 secret <new-password>.
Exit and save: end, then write memory.
Reload and verify: reload. Log in with the new credentials.

Recovery Procedure — ROMMON Break Method (alternative)

If the Mode button is inaccessible (rack-mounted without front access), use the ROMMON break method:

Connect the console cable (9600 8N1) and power-cycle the switch.
Within 60 seconds of power-on, send the break sequence (Ctrl+Break on most terminal emulators) repeatedly until you reach the rommon 1> prompt.
Set the configuration register to skip the startup config: confreg 0x2142
Boot the switch: reset (or boot).
The switch boots with an empty configuration. Enter enable, then restore: copy startup-config running-config.
Set the enable secret and line passwords as in the Mode button method.
Restore the normal config register: configure terminal → config-register 0x2102.
Save: write memory, then reload.

Important Notes

The configuration is not erased — it is renamed (Mode button) or bypassed via the config register (ROMMON). Always restore and re-save it.
On a Catalyst 9000 stack, each member stores its own config (config.text-1, config.text-2, ...); show switch shows member numbers.
Catalyst 9300X and 9500 series use a USB-C console port — an appropriate USB-C console cable/adapter is required.
If no service password-recovery is present, neither method bypasses the config; only write erase (destructive factory reset) remains. Restore from a TFTP/USB backup afterwards.
Some IOS-XE releases show the boot loader prompt as switch(boot)# — the same commands apply.
Baud rate is 9600 — do not use 115200 on Catalyst 9000.

Protecting Your Configuration

Before any recovery, back up the running config: copy running-config usbflash0: or copy running-config tftp://<server>/<filename>. After recovery, verify show startup-config contains the expected config and re-save with write memory.