A possible recovery requires two things you need to be able to power cycle the device.
I'm going to be using an APC to do this so that I can power cycle the device remotely.
I'm also connected to the console of this router via a terminal server side.
Telnetting to a server and then accessing the console of the router through the terminal server in the
real world you may have to physically walk to the router and plug your laptop into the console and then
power cycle the device.
Or if you've got access to an APC and a terminal server that's giving out-of-band console access to
the device you can do what I'm doing here.
The process is the same.
The APC and terminal server only gave me the ability to access the console and power cycle the device
remotely I'm connected to the console of the router and I'm told that I need to press Return to get
started some in user mode.
I can top show version and we can see that this is a Cisco 1841 router.
We can see that the configuration register is set to 2 1 0 2 that is the default value which means that
the router will boot normally and has a console speed of 9600 bits per second startup config will be
used.
And we can change the config register if necessary as follows.
However we're not typing able.
Let's assume that I don't know what the password is
so I'm unable to access.
Privilege mode on this router.
It does seem that the secret password was set and we don't know what that password is anymore.
So what we can do is power cycle the router.
So I'm going to set the APC to do any immediate reboot on the router.
And what we will notice on the router is it's rebooting.
I'm going to send a special command which is the break to the Rodda.
And notice I am now in Ramond mode.
So through the APC are remotely re booted the router rather than physically doing it Rodda has rebooted.
And I sent a break signal to the Rodda so you could use your keyboard or your terminal emulation program
to send the break.
In this case I'm using putty and I just sent the break c'mon to the Rodda which meant that it broke
the boot process and went into Romont mode.
Question mark shows me options and Rahmon.
You'll notice that this is different to the traditional Cisco Aiwass.
This is the command that we looking for configuration register utility.
So we're going to set back to count 0 1 4 2 the possible procedure I'm using is a little bit different
to the twenty nine hundred password procedure.
But notice the same command is used the Cisco Web site will give you the details for individual routers.
So as an example for an 18 41 router the full procedure is shown here.
Just follow the procedure for the relevant device that you want to do by password recovery on that includes
both routers and switches.
So in a document like this we have highand routers LAN switches and other devices.
So confrere just set we told that we need to reset our power cycle the device command to do that is
going to be reset
and what will happen now is the will boot normally but it will bypass the startup configuration because
when setting this value to 4 6 is set which means ignore and be RAM contents so to save you some time
I'm going to speed up the boot process.
What will happen is when the router boots up it will bypass the startup configuration and ask us whether
we want to add to the initial startup dialog and noticed now that the router is prompting us with the
system configuration dialog we don't want to enter that's going to say no we're told to press Return
to get started.
And notice the name of the Rodda is router where as previously it was called C 1841 or 1.
So here's the critical piece enable.
I can move to enable mode without a password.
Show startup config shows that there is an enable secret password configured in the startup config and
we can see the hostname of the router as an example.
We can see other information such as IP addresses on serial interfaces.
We can see that OSPF was configured as part of the startup config in the running config However we don't
have the hostname configured.
We don't have a secret password.
We don't have IP addresses on our serial interfaces and we don't have be configured so to get the config
back.
I'm going to top copy startup config running config.
Notice the router name has now changed.
Show run.
Shows us the IP addresses and OSPF configuration in running config.
Now OSPF was complaining that it couldn't allocate a unique Rodda ID and that's because all interfaces
on the router are shut down so I'm going to go into serial zero slash seriously zero and no shut the
interface and do that.
On the other serial interface and notice now I always be able to allocate errata ID and then form a
neighbor relationship with a neighboring router so as an example show IP P.F. neighbor shows us that
the neighbor relationship has formed that's important to remember that we are now in privileged mode.
We enable mode but we don't know the password.
Show run shows us that the secret password is configured but we don't actually know what that password
is.
We moved from user mode to privilege mode without entering a password.
And then we copied the startup config to running config.
If we exit to privilege mode now we won't be able to get back in.
So what we need to do is change the password so change the secret password to something that we know.
So it's really important that when you do the password recovery that you go to privilege mode you enable
mode first and then copy the config from startup config to running config and then change the password
and then save your config.
So it's really important that you set the password and that you then save the configuration before continuing.
Now show version shows us that the configuration register is still to 140.
The configuration register configuration is separate to the running and startup config of Varada.
So what I'm going to do is save the config right now.
So copy running config startup config.
All right mem
at the moment the config register is 0 x 2 1 4 2.
If I rebooted the broader now it would end up booting without using the startup config again.
Now we don't want to do that.
We want to use the config register command and set it for normal boot.
So set it to 1 0 2 show version.
Notice it will be thus at next reload I can reload the Rotto without saving the configuration and it
will reboot using the previously saved config.
If you remember before I made the change I saved the config.
So thats the configuration thats going to be used.
I don't need to save the configuration again for the configuration register change to be saved it saved
independently of the running configuration on the router.
Speed up the boot process again.
So notice that we are told to press and to get started and interfaces come up and the in OSPF neighbor
relationship is formed and that's because the startup config was applied when the Rodda booted up.
Now in the top enable We can log in with the password that we configured.
In other words the reset secret password we can't see that in the upper Chiheb because it's hashed.
But this is the password of Cisco that we configure the router to use.
So that's an example of how to do Ponsford recovery.
Don't forget that on Cisco's Web site there are possible recovery procedures for various routers that
you may be using in your lab or that you may be using in the real world.
Simply follow the step by step procedures to bypass an encrypted password.
This does require physical access.
In other words you need access to the console to be able to do a password recovery.