10.6.13 Packet Tracer - Research and Execute Password Recovery Procedures - Physical Mode Answers
Objectives
- Part 1: Research the Configuration Register
- Part 2: Document the Password Recovery Procedure for a Specific Cisco Router
Background / Scenario
The purpose of this activity is to research the procedure for recovering or resetting the enable password on a specific Cisco router. The enable password protects access to privileged EXEC and configuration mode on Cisco devices. The enable password can be recovered, but the enable secret password is encrypted and would need to be replaced with a new password.
In order to bypass a password, a user must be familiar with the ROM monitor (ROMMON) mode, as well as the configuration register setting for Cisco routers. ROMMON is basic CLI software stored in ROM that can be used to troubleshoot boot errors and recover a router when an IOS is not found.
In this activity, you will begin by researching the purpose and settings of the configuration register for Cisco devices. You will then research and detail the exact procedure for password recovery for a specific Cisco router. Finally, using Packet Tracer, you will practice the procedure by using the configuration register to recover a password on a Cisco 2911 router.
Note: By design, the activity will open with a completion percentage of 12%.
Instructions
Part 1: Research the Configuration Register
To recover or reset an enable password, you will access the ROMMON interface to instruct the router to ignore the startup configuration when booting. When booted, access privilege EXEC mode, overwrite the running configuration with the saved startup configuration. You will then recover or reset the password and restore the boot process of the router to include the startup configuration.
The configuration register of the router plays a vital role in the process of password recovery. In the first part of this activity, you will research the purpose of the configuration register of a router and the meaning of certain configuration register values.
Answers Note: Have students visit the Use of Configuration Register on All Cisco Routers page at https://www.cisco.com/c/en/us/support/docs/routers/10000-series-routers/50421-config-register-use.html on the Cisco Website.
Step 1: Describe the purpose of the configuration register.
What is the purpose of the configuration register?
The configuration register can be used to change the way the router boots, options for booting, and console speed.
What command changes the configuration register in global configuration mode?
config-register
What command changes the configuration register in ROMMON mode?
confreg
Step 2: Determine configuration register values and their meanings.
Research and list the router behavior for the following configuration register values.
0x2102
For the configuration register value 0x2102, a router will load the IOS from flash memory and then load the start-up configuration from the NVRAM if present. If no operating system is found, the router will boot to ROMMON.
0x2142
For the configuration register value 0x2142, a router will load the IOS from flash memory, ignore the start-up configuration in NVRAM, and provide a prompt for initial configuration dialog. If no operating system is found, the router will boot to ROMMON.
What is the difference between these two configuration register values?
The 0x2102 setting is for normal router operation. The 0x2142 setting bypasses the start-up configuration allowing a user to recover or reset the enable password.
Part 2: Document the Password Recovery Procedure for a Specific Cisco Router
For Part 2, you will describe the exact procedure for recovering or resetting a password from a 2900 series Cisco router and answer questions based on your research.
Step 1: Detail the process to recover a password on a specific Cisco router.
Research and list the steps and commands to recover or reset the enable or enable secret password from your Cisco router. Summarize the steps in your own words.
To recover or reset the enable password on the Cisco 2900 series router, complete the following steps:
1.Establish a terminal connection with the router using Tera Term or other terminal emulator.
2.Boot to ROMMON by either removing flash and rebooting, or selecting Alt-b during a reboot.
3.Type confreg 0x2142 at the rommon prompt.
4.Type reset at the next rommon prompt.
5.Type no at the initial configuration dialog.
6.Type enable at the router prompt.
7.Type copy startup-config running-config to load the startup configuration.
8.Type configure terminal.
9.Record an unencrypted enable password. Reset an encrypted enable password.
10.In configuration mode, type config-register 0x2102.
11.In privileged EXEC mode, type copy running-config startup-config to save configuration.
12.Use the show version command to verify configuration register settings.
Step 2: Using Packet Tracer, execute the recovery of an enable password and a secret
password on a Cisco 2911 router.
Imagine that you have just returned from a week-long conference. You try to log into the main company router but while you were away, someone changed the enable password. You are unable to log into the router.
a. From the desktop of the laptop, use the terminal mode to connect to the router. Because the passwords are unknown to you, you will not be able to log in.
b. In Physical Mode, go to the rear view of the router in the rack and switch the router off.
c. Power the router back on and quickly return to terminal mode on the laptop and enter CTRL+c before the hash loading marks (#####) have finished displaying. If you are not quick enough, power cycle the router another time. You should end up in ROMMON mode.
Note: On real equipment, you might have to type ALT-b instead of CTRL-c
rommon 1 >
Note: On real equipment, you must be physically near the router to execute this procedure. It is essential that a corporation ensure that there is strong physical security for all networking devices.
d. Change the value of the configuration register and reboot.
rommon 1 > confreg 0x2142 rommon 2 > reset
e. Ensure that you enter N to the initial configuration dialog question. You will be in user EXEC mode. Go to privileged EXEC mode.
f. Copy the startup configuration to the running configuration. The Router prompt should have changed to Main#
g. Make the following modifications to the running configuration:
1) Change the router prompt to Branch.
2) Change the secret password to branch1.
3) Change the console vty line passwords to branch2.
4) Add a banner of “Password Recovered”.
5) Verify the value of the configuration register.
6) Change the configuration register to 0x2102 in global config mode.
Branch(config)# config-register 0x2102
7) Save the running configuration to the startup configuration.
h. Reload the router and login with the new passwords.
i. Display the running configuration. Notice that the interfaces are in shutdown mode. Reactivate interfaces G0/0 and G0/2.
Step 3: Answer questions about the password recovery procedure.
Using the process for password recovery, answer the following questions.
Describe how to find the current setting for your configuration register.
The show version command will provide the current setting for the configuration register.
Describe the process for entering ROMMON mode.
A user can remove the flash memory and restart the router to boot to the ROMMON utility. A user can also boot the router and select alt+b when using Tera Term on real equipment.
What commands do you need to enter the ROMMON interface?
(2900-series) A user would need to enter confreg 0x2142 to change the configuration setting, followed by reset to restart the router.
What message would you expect to see when the router boots?
If a router does not load the startup configuration, a user would expect to see the message “Continue with configuration dialog?”
Why is it important to load the startup configuration into the running configuration?
Loading the startup configuration into the running configuration ensures that the original startup configuration remains intact if the user saves during the password recovery process.
Why is it important to change the configuration register back to the original value after recovering password?
Returning the configuration register to the original value will ensure that the router will load the startup configuration during the next reload.
Reflection Question
Why is it of critical importance that a router be physically secured to prevent unauthorized access?
Because the password recovery procedure can only be performed using a console connection, which requires direct physical access to the device, preventing unauthorized users access to the physical device is an imperative part of an overall security plan.
Device Configs - Final
! ============================================================== !--- 10.6.13 Packet Tracer - Research and Execute Password Recovery Procedures - Physical !--- Mode !--- ANSWER SCRIPT FOR THE MAIN COMPANY ROUTER (hostname "Main" before recovery, renamed to !--- "Branch" as part of this procedure) !--- Usage: this lab is mostly research/short-answer (Part 1 and most of Part 2 are Q&A !--- with standard Cisco documentation answers already written out in full in the lab !--- document itself - nothing to script there). The ONLY hands-on device work is Part 2, !--- Step 2 below, which mixes ROMMON-mode commands, physical power-cycling, and normal IOS !--- config - each section is labeled since the command set and prompt differ by mode. ! ============================================================== ! -------------------------------------------------------------- !--- Part 2, Step 2a-c: PHYSICAL actions, not IOS commands - not scriptable: !--- a. Try to connect via terminal - fails (passwords unknown) !--- b. Physical tab > rear of router > power switch OFF !--- c. Power back ON, then in Terminal mode press CTRL+C before the "#####" hash marks !--- finish loading (on real hardware this is ALT-B instead). If you miss the window, !--- power-cycle again and retry. Success lands you at the "rommon 1 >" prompt. ! -------------------------------------------------------------- ! -------------------------------------------------------------- !--- Part 2, Step 2d: ROMMON mode - change the config register so the next boot skips !--- (ignores) the saved startup-config, then reset to reboot with that new setting. !--- ROMMON's own prompt numbering increments automatically with each command (1, 2, ...) - !--- this is normal, not something to type yourself. ! -------------------------------------------------------------- rommon 1 > confreg 0x2142 rommon 2 > reset ! -------------------------------------------------------------- !--- Part 2, Step 2e: on reboot, the router skips straight to user EXEC (no startup-config !--- was loaded, so no passwords are active) - decline the initial setup dialog, then raise !--- your privilege level. ! -------------------------------------------------------------- ! Would you like to enter the initial configuration dialog? [yes/no]: n enable ! -------------------------------------------------------------- !--- Part 2, Step 2f: manually load the ORIGINAL startup-config into the running-config - !--- this is what recovers all the router's other settings (interfaces, routing, etc.) !--- without touching the password yet. The prompt changes from "Router#" to "Main#" once !--- this completes, since "Main" is the hostname stored in that startup-config. ! -------------------------------------------------------------- copy startup-config running-config ! -------------------------------------------------------------- !--- Part 2, Step 2g: now in Main's running-config, make the requested changes. Password !--- and login lines are assumed to already exist from the router's original setup (this is !--- a recovery, not a fresh build), so only the password values themselves are changed here. ! -------------------------------------------------------------- configure terminal ! -------------------------------------------------------------- !--- g1: rename the router. ! -------------------------------------------------------------- hostname Branch ! -------------------------------------------------------------- !--- g2: reset the (now-unknown) enable secret to a known value. ! -------------------------------------------------------------- enable secret branch1 ! -------------------------------------------------------------- !--- g3: same for both the console and vty line passwords. ! -------------------------------------------------------------- line console 0 password branch2 exit line vty 0 4 password branch2 exit ! -------------------------------------------------------------- !--- g4: banner confirming the recovery. ! -------------------------------------------------------------- banner motd $ Password Recovered $ ! -------------------------------------------------------------- !--- g5: confirm the config register is still showing the temporary recovery value before !--- changing it back (EXEC-mode check, not itself a config change). ! -------------------------------------------------------------- ! Branch# show version ! -------------------------------------------------------------- !--- g6: restore normal boot behavior - without this, the router would boot straight to !--- ROMMON-bypass mode again on every future reload, re-ignoring the startup-config. ! -------------------------------------------------------------- config-register 0x2102 end ! -------------------------------------------------------------- !--- g7: save everything (new passwords, banner, hostname, AND the restored 0x2102 register !--- value) to NVRAM. ! -------------------------------------------------------------- copy running-config startup-config ! -------------------------------------------------------------- !--- Part 2, Step 2h: reload and confirm the new credentials work. ! -------------------------------------------------------------- ! Branch# reload ! -------------------------------------------------------------- !--- Part 2, Step 2i: the recovered startup-config leaves G0/0 and G0/2 shut down (a !--- pre-existing condition unrelated to the password recovery itself, discovered only once !--- you can log in and inspect the running-config) - bring them back up. ! -------------------------------------------------------------- configure terminal interface GigabitEthernet0/0 no shutdown exit interface GigabitEthernet0/2 no shutdown end ! ============================================================== !--- Verification: !--- Branch# show version -> Configuration register is 0x2102 (back to normal) !--- Branch# show ip interface brief -> G0/0 and G0/2 both up/up !--- Log back in with enable secret "branch1" and line password "branch2" to confirm the !--- recovery worked ! ==============================================================
