Cisco

Cisco ISR and ASR Router Password Recovery

Recover a lost enable password on Cisco ISR and ASR routers using the config-register 0x2142 procedure over the console port.

Overview

This guide provides step-by-step instructions for resetting lost or forgotten administrative passwords on enterprise networking hardware. Follow the procedure below carefully to regain access while preserving your device configuration.

Prerequisites

Before proceeding with password recovery, ensure you have a console cable, terminal emulation software configured to 9600 baud, and physical access to the device.

Step 1: Establish Console Connection

Connect your terminal cable to the console port of the device and open your serial terminal session.

Step 2: Interrupt the Boot Sequence

Power cycle the hardware and issue a Break key sequence during initial system startup to enter ROMMON mode.

Step 3: Reset Password & Configuration

Bypass startup configuration loading, boot into system software, set your new credentials, and save changes back to non-volatile memory.

Overview

ISR and ASR platforms use the standard Cisco IOS/IOS-XE password-recovery procedure: interrupt the boot before IOS finishes loading, boot with the configuration register set so the router ignores its startup configuration, set a new password, then restore the original configuration.

Prerequisites

Direct console connection (RJ-45 rollover to serial/USB, or the mini-USB console on ISR 4000 / ASR 1000) with the terminal at 9600 8-N-1, no flow control.
Physical access to the router: the boot must be interrupted with a power cycle at the switch.
A terminal emulator that can send a break signal (see the break sequences below).
Before you start: if the boot log warns that no service password-recovery is configured, stop. Recovery is disabled on that router and the next break erases the configuration.

Recovery Steps

Connect the console and power-cycle the router.
Interrupt the boot with a break signal to reach the rommon 1 > prompt. The break sequences are defined in detail below.
Bypass the startup configuration:
rommon 1 > confreg 0x2142
rommon 2 > reset
After boot, answer no to the setup dialog, then merge the saved configuration back:
Router> enable
Router# copy startup-config running-config
Set the new password:
Router(config)# enable secret <new-password>
Restore the register, save and reload:
Router(config)# config-register 0x2102
Router(config)# end
Router# write memory
Router# reload

Step 2 in detail: the possible break sequences

The break has to land after POST completes and just before IOS/IOS-XE finishes loading, not at power-on. For the ISR G2 (1900/2900/3900), ISR 1000, ISR 4000 (4321 to 4461) and ASR 1000 families, Cisco documents that you must send the break repeatedly through the boot window until the boot aborts. One well-timed press is often not enough.

PuTTY: Ctrl+Break, or the window menu → Special Command → Break. This is the exact path Cisco documents. On a keyboard with no Break key, the menu is the only way to send it.
Keyboard with a Break key: press Break. On laptop keyboards that is usually Fn+Break.
Windows HyperTerminal: Ctrl+Break.
SecureCRT and similar emulators: the emulator's Send Break action (SecureCRT: Ctrl+Break, or the Send Break button on the toolbar).
telnet to a console server: press Ctrl+], type send break, then Enter. Note that a terminal server on the console port is not a supported path for this procedure and may not pass the break at all; a direct console cable is recommended.
USB console port (ISR 4000 / ASR 1000): the same break sent over the mini-USB console, useful when the RJ-45 console adapter refuses to pass it.

If the break does not register

Send it several times across the whole boot. The window opens only after POST, so a single early press is ignored.
Confirm the terminal is 9600 8-N-1 with no flow control. These routers do not use 115200 on the console.
Switch methods: physical Break key, then Ctrl+Break, then Special Command → Break.
Some USB-to-serial adapters do not pass a break signal at all. Try a different adapter, or a machine with a real COM port.
If you miss the window, power-cycle and try again. The break window repeats on every boot, so nothing is lost.

You are in ROMMON when the boot stops like this

Current image running: Boot ROM1
Last reset cause: LocalSoft
ISR4331/K9 platform with 4194304 Kbytes of main memory
........
Located isr4300-universalk9.16.12.04.SPA.bin
##############################################
Failed to boot file bootflash:isr4300-universalk9.16.12.04.SPA.bin
.......
rommon 1 >

At the rommon 1 > prompt continue with step 3 above.

Note

On IOS-XE platforms that load packages.conf, use boot flash:packages.conf at the rommon prompt if a plain reset does not boot the router.