Hands-On Lab: Password Recovery on a Cisco Router

Lab Objective

Simulate a lost enable secret on a router, perform password recovery using ROMMON mode and the configuration register, reset the password, and confirm the router's original configuration (aside from the password) remains fully intact afterward.

Lab Purpose

Physical access to a router's console port allows password recovery specifically because this procedure requires no prior authentication — a deliberate design choice balancing legitimate recovery needs against the risk that anyone with physical console access can reset any device's password, which is exactly why physical security of network equipment matters as much as any remote-access control.

Lab Topology

R1 with a console cable connected
Enable secret is set but has been forgotten

Task 1: Confirm the Password Is Unknown

Attempt to enter privileged EXEC mode with an incorrect password and confirm access is denied.

Task 2: Reload and Interrupt the Boot Process

Power cycle or reload the router, and send a break sequence during the first 60 seconds of boot to enter ROMMON mode.

Task 3: Change the Configuration Register to Skip the Startup Config

From ROMMON, modify the configuration register to boot without loading the saved startup configuration.

Task 4: Reload and Enter Privileged Mode Without a Password

Reload the router, and confirm privileged EXEC mode can now be entered without any password, since the startup configuration (containing the enable secret) was skipped.

Task 5: Copy the Startup Config Into Running Config

Load the actual startup configuration into the running configuration to restore the router's real settings, now accessible in privileged mode.

Task 6: Set a New Password and Restore the Configuration Register

Set a new enable secret, restore the configuration register to its normal value, and save the configuration.

Solution and Verification

R1> enable
Password: [incorrect guess]
% Access denied
-- Confirms the password is genuinely unknown,
-- not simply mistyped once

-- Reload the router, then send the break
-- sequence (typically Ctrl+Break in most
-- terminal programs) within the first 60
-- seconds of boot

rommon 1 >

rommon 1 > confreg 0x2142

-- 0x2142 tells the router to boot while
-- IGNORING the startup configuration --
-- the default is normally 0x2102

rommon 2 > reset

-- After reload:

Router> enable
Router#
-- No password was required, since the
-- startup config (containing the enable
-- secret) was never loaded at all

Router# copy startup-config running-config

-- This loads the ACTUAL configuration
-- (hostname, interfaces, routing, etc.) into
-- the running config, now that we already
-- have privileged access -- everything
-- except needing the old password is restored

Router(config)# enable secret NewPassword2026
Router(config)# config-register 0x2102

-- Restoring the register to its normal value
-- ensures the router boots normally, loading
-- the startup config (with the NEW password)
-- on every subsequent reload

Router(config)# end
Router# copy running-config startup-config

R1# reload

-- After reload, confirming normal behavior:
R1> enable
Password: NewPassword2026
R1#
-- Password recovery complete, and the router
-- boots normally with all original settings
-- (hostname, interfaces, etc.) intact

Key Takeaway

The critical, easy-to-forget final step is restoring the configuration register to 0x2102 and saving the configuration — skipping this leaves the router permanently ignoring its startup configuration on every future boot, silently discarding any configuration changes made after this recovery unless explicitly saved and the register is properly restored.