Cisco

Cisco Catalyst 9000 Series Switch Password Recovery

Recover a lost enable password on Catalyst 9200/9300/9400/9500/9600 switches over the console port using ROMMON and the startup-config bypass.

Overview

This guide provides step-by-step instructions for resetting lost or forgotten administrative passwords on enterprise networking hardware. Follow the procedure below carefully to regain access while preserving your device configuration.

Prerequisites

Before proceeding with password recovery, ensure you have a console cable, terminal emulation software configured to 9600 baud, and physical access to the device.

Step 1: Establish Console Connection

Connect your terminal cable to the console port of the device and open your serial terminal session.

Step 2: Interrupt the Boot Sequence

Power cycle the hardware and issue a Break key sequence during initial system startup to enter ROMMON mode.

Step 3: Reset Password & Configuration

Bypass startup configuration loading, boot into system software, set your new credentials, and save changes back to non-volatile memory.

Overview

Catalyst 9000 series switches run IOS-XE. A lost enable (privileged EXEC) password is recovered by interrupting the boot into ROMMON, telling the switch to ignore the saved startup configuration, then copying that configuration back and setting a new password. The saved configuration is preserved.

Prerequisites

Recovery Steps

  1. Connect the console cable, open the terminal, then power-cycle the switch.
  2. Interrupt the boot: hold the Mode button on the front panel during power-up, or send a Break sequence from the terminal. You are aiming for the rommon 1 > prompt.
  3. At ROMMON, tell the switch to ignore the startup configuration:
    switch: SWITCH_IGNORE_STARTUP_CFG=1
  4. Boot the system:
    switch: boot flash:packages.conf
  5. Once the switch has booted, enter privileged EXEC (enable) — no password is required at this point — then merge the saved configuration back into the running one:
    Switch# copy startup-config running-config
  6. Set the new password:
    Switch(config)# enable secret <new-password>
  7. Stop ignoring the startup configuration:
    Switch(config)# no system ignore startupconfig  (or set SWITCH_IGNORE_STARTUP_CFG=0 in ROMMON)
  8. Save and reload:
    Switch(config)# end
    Switch# write memory
    Switch# reload

If the switch does not reach ROMMON

Confirm the console terminal is at 9600 8-N-1 and that you are on the correct port. On stacked or dual-supervisor systems, always recover on the supervisor that will be active.

Related

See also the Catalyst 3650/3850 guide — the procedure is identical.