1. IOS Backup & Password Breaking Technique of Routers & Switches Chapter 17 powered by DJ 1

2. Chapter Objectives At the end of this Chapter you will be able to:  Manage system image  Configure device configuration files  Perform Disaster Recovery  Recover Cisco IOS from tftpdnld and xmodem commands  Break password of 2500, 2600, 2800 series Routers and also 1900 & 2950 series switches powered by DJ 2

3. The Cisco IOS File System  NOTE: The Cisco IOS File System (IFS) provides a single interface to all the file systems available on a routing device, including the flash memory file system; network file systems such as TFTP, Remote Copy Protocol (RCP), and File Transfer Protocol (FTP); and any other endpoint for reading and writing data, such as NVRAM, or the running configuration. powered by DJ 3

4. Commands Cisco IOS Software CommandsIFS Commands copy tftp running-configcopy tftp: system:running-config copy tftp startup-configcopy tftp: nvram:startup-config show startup-configmore nvram:startup-config erase startup-configerase nvram: copy running-config startup-config copy system:running-config nvram:startup-config copy running-config tftpcopy system:running-config tftp: show running-configmore system:running-config powered by DJ 4

5. Backing Up Configurations to a TFTP Server #copy running-config startup- config Saves the running configuration from DRAM to NVRAM (locally). #copy running-config tftp Copies the running configuration to the remote TFTP server. Address or name of remote host[ ]? 192.168.119.20 The IP address of the TFTP server. Destination Filename [Denver- confg]? Enter The name to use for the file saved on the TFTP server. !!!!!!!!!!!!!!! Each bang symbol (!) = 1 datagram of data. 624 bytes copied in 7.05 secs # File has been transferred successfully. powered by DJ 5

6. Restoring Configurations from a TFTP Server #copy tftp running-config Copies the configuration file from the TFTP server to DRAM. Address or name of remote host[ ]? 192.168.119.20 The IP address of the TFTP server. Source filename [ ]?Denver-confg Enter the name of the file you want to retrieve. Destination filename [running- config]? R Accessing tftp://192.168.119.20/Denverconfg … Loading Denver-confg from 192.168.119.02 (via Fast Ethernet 0/0): [OK-624 bytes] 624 bytes copied in 9.45 secs !!!!!!!!!!!!!! #File has been transferred successfully. powered by DJ 6

7. Configuration Register & Password Recovery Procedure router#show version The last line of output tells you what the configuration register is set to. router#configure terminal Moves to global configuration mode. router(config)#config-register 0x2142 Changes the configuration register to 2142. powered by DJ 7

8. Register Value Bit Number HexadecimalMeaning 00–03 0x0000–0x000FBoot field 06 0x0040Ignore NVRAM contents 07 0x0080OEM bit enabled 08 0x0100Break disabled 09 0x0200 Causes system to use secondary bootstrap (typically not used). 10 0x0400IP broadcast with all 0s 5, 11, 12 0x0020, 0x0800, 0x1000 Console line speed 130x2000 Boots default ROM software if network boot fails. 140x4000IP broadcasts do not have net numbers. 150x8000 Enables diagnostic messages and ignores NVRAM powered by DJ 8

9. Password-Recovery Procedures for Cisco Routers Step2500 Series Commands1700/2600/ISR Series Commands Step 1: Boot the router and interrupt the boot sequence as soon as text appears on the screen. Press Ctrl-Break > Press Ctrl-Break rommon 1> Step 2: Change the configuration register to ignore contents of NVRAM. >o/r 0x2142 > rommon 1>confreg 0x2142 rommon 2> Step 3: Reload the router>irommon 2>reset Step 4: Enter privileged mode. (Do not enter setup mode.) Router>enable Router# Router>enable Router# Step 5: Copy the startup configuration into the running configuration. Router#copy startupconfig running-config … # Router#copy startupconfig running-config … # powered by DJ 9

10. Conti… Step 6: Change the password. #configure Terminal (config)#enable secret new (config)# #configure Terminal (config)#enable secret new (config)# Step 7: Reset the configuration register back to its default value. (config)#configregister 0x2102 (config)# (config)#configregister 0x2102 (config)# Step 8: Save the configuration. (config)#exit #copy runningconfig startup-config # (config)#exit #copy runningconfig startup-config # Step 9: Verify the configuration register. #show version … Configuration register is 0x2142 (will be 0x2102 at next reload) # #show version … … Configuration register is 0x2142 (will be 0x2102 at next reload) # Step 10: Reload the router.#reload powered by DJ 10

11. Password Recovery for 2960 Series Switches Unplug the power supply from the back of the switch. Press and hold the Mode button on the front of the switch. Plug the switch back in. Release the Mode button when the SYST LED blinks amber and then turns solid green. When you release the Mode button, the SYST LED blinks green. Issue the following commands: switch: flash_initInitializes the flash memory. switch: load_helper switch: dir flash:Do not forget the colon. This displays which files are in flash memory. switch: rename flash:config.text flash:config.old You are renaming the configuration file. The config.text file contains the password. switch: bootBoots the switch. powered by DJ 11

12. Conti.. When asked whether you want to enter the configuration dialog, enter n to exit out to the switch prompt. Takes you to user mode. switch>enableEnters privileged mode. switch#rename flash:config.old flash:config.text Renames the configuration file back to the original name. Destination filename [config.text]Press Enter switch#copy flash:config.text system:running-config Copies the configuration file into memory. 768 bytes copied in 0.624 seconds 2960Switch#The configuration file is now reloaded. Notice the new prompt. 2960Switch#configure terminalEnters global configuration mode. 2960Switch(config)# Proceed to change the passwords as needed 2900Switch(config)#exit 2900Switch#copy running-config startupconfig Saves the configuration into NVRAM with new passwords. powered by DJ 12

13. THANK YOU powered by DJ 13