How to Reset the Enable Secret Password on a Cisco Router

If we forget the Cisco router’s enable secret password, we’ll lose access to privileged EXEC mode. Without this password, we cannot access privileged commands or make configuration changes. But Cisco provides a password recovery procedure that allows us to reset the enable secret without losing the existing configuration.

In this Lab, We’ll reset a Cisco router Password in Packet Tracer using ROMMON mode and the configuration register. Before starting the reset, I want to discuss the two important registers of Cisco devices.

Understand the Configuration Register

0x2102 (Default Configuration Register)

This is the normal configuration register value on many Cisco routers. When the router starts with this value, it loads the IOS image and applies the saved startup configuration from NVRAM.

0x2142 (Ignore Startup Configuration)

This value tells the router to ignore the saved startup configuration during boot. As a result, the router starts without applying the existing configuration, allowing us to access it without entering the forgotten enable secret password.

Enter ROMMON Mode

ROMMON (ROM Monitor) is a special recovery environment available on Cisco routers. It allows us to perform recovery operations before the IOS operating system starts.

To enter ROMMON mode:

1. Connect to the router using a console cable.
2. Open a terminal application.
3. Power off the router.
4. Power it on again.
5. Immediately send a Break signal while the router is booting. (By pressing Ctrl + Break key on the keyboard)

The router should enter ROMMON mode, displaying a prompt similar to:

rommon 1 >

The method of sending a Break signal depends on your terminal application and router model.

Change the Configuration Register

From ROMMON mode, enter the following command:

rommon 1 > confreg 0x2142

This changes the configuration register so that the router ignores the saved startup configuration during its next boot.

Now, restart the router:

rommon 2 > reset

The router will restart without loading the saved configuration.

When the initial configuration dialog appears, enter no:

Would you like to enter the initial configuration dialog? [yes/no]: no

Press Enter to continue.

Enter Privileged EXEC Mode

Now, enter privileged EXEC mode:

Router> enable
Router#

Because the router ignored the saved startup configuration, it will not ask for the old enable secret password.

Restore the Existing Configuration

Although the router ignored the startup configuration during boot, the original configuration is still saved in NVRAM.

We need to load it into the running configuration.

Router# copy startup-config running-config

When prompted for the destination filename, press Enter.

The router will now load its previous configuration, including its hostname, interface settings, routing configuration, and other settings.

Configure a New Enable Secret Password

Now, enter global configuration mode:

Router# configure terminal

Configure a new enable secret:

Router(config)# enable secret newpassword123

This will set this new password.

Restore the Default Configuration Register

We previously changed the configuration register to 0x2142. Now, we need to restore its normal value.

Enter:

Router(config)# config-register 0x2102

This ensures that the router will load its saved startup configuration during normal boot.

Save the Configuration

Finally, save the updated configuration:

Router# copy running-config startup-config

Wait for the confirmation message:

Building configuration...
[OK]

Verify the New Enable Secret Password

Restart the router:

Router# reload

After the router restarts, it should load the saved configuration normally.

Now, enter privileged EXEC mode:

Router> enable
Password:

Enter your new enable secret password.

If you successfully reach the privileged EXEC prompt, the password recovery process is complete!

Router#

Conclusion

Resetting a forgotten enable secret password on a Cisco router can be done without deleting the existing configuration. The process involves entering ROMMON mode and changing the configuration register to a specific value. This adjustment allows the router to bypass its saved configuration during startup. After that, you can restore the original configuration, set a new enable secret password, and then return the configuration register to its original setting.