Introduction
This document describes the recovery procedure to be followed when the admin password is lost.
Prerequisites
Requirements
Cisco recommends that you have knowledge of these topics:
- Cisco Firepower FXOS
- Password-recovery requires serial console access and the ability to power-on the FPR 2100 device.
Components Used
The information in this document is based on FPR 2100 series version 1.0.00 or higher.
The information in this document was created from the devices in a specific lab environment. All of the devices used in this document started with a cleared (default) configuration. If your network is live, ensure that you understand the potential impact of any command.
Background Information
The current Firepower Extensible Operating System (FXOS) version reimages the box when this flow is invoked. All configuration data can be lost. To factory reset the device, connect to FXOS and local-mgmt and issue erase configuration.
Procedure
Step 1. Power-cycle the Firepower21xx device. You have 10 seconds to interrupt the ROMMON default boot sequence with a press of the ESC key.
*******************************************************************************
Cisco System ROMMON, Version 1.0.00, RELEASE SOFTWARE
Copyright (c) 1994-2017 by Cisco Systems, Inc.
Compiled Tue 01/03/2017 23:55:11.41 by builder
*******************************************************************************
Current image running: Boot ROM0
Last reset cause: ResetRequest
DIMM_1/1 : Present
DIMM_2/1 : Present
Platform FPR-2130 with 32768 MBytes of main memory
BIOS has been successfully locked !!
MAC Address: 0c:75:bd:08:c8:00
Use BREAK or ESC to interrupt boot.
Use SPACE to begin boot immediately.
Boot interrupted.
rommon 1 >
Step 2. Invoke the password_reset ROMMON command.
Warning: This command performs a reimage on the Firepower 21xx appliance, and erases the ASA configuration.
rommon 1 > password_reset
WARNING: User configurations can be lost with this operation
Are you sure ? yes/no [no]: yes
Enabling password reset..
Please continue to boot the image !
rommon 2 >
Tip: For ROMMON version 1.0.04 and earlier, use the password_reset command. This command was changed to factory-reset in later versions.
To validate your actual ROMMON version, use this command:
rommon 1 > show info
Cisco System ROMMON, Version 1.0.06, RELEASE SOFTWARE
Copyright (c) 1994-2018 by Cisco Systems, Inc.
Compiled Wed 11/01/2018 18:38:59.66 by builder
Step 3. Boot the device and invoke the boot command. You can use the default image or specify a different image to boot.
Note: It can take about 20-40 minutes (depends on the model) to complete the process.
rommon 3 > boot
Located '.boot_string' @ cluster 648129.
#
Located 'installables/switch/fxos-k8-fp2k-lfbff.2.2.1.29.SPA' @ cluster 404198.
################################################################################
################################################################################
<skipped>
INIT: version 2.88 booting
Starting udev
Configuring network interfaces... done.
Populating dev cache
Starting Power Off Shutdown Handler (poshd)
poshd: using FPGA version 1.0.00 and PSEQ version 2.11
Primary SSD discovered
eMMC Flash not detected; retrying
eMMC Flash not detected; retrying
eMMC Flash not detected; retrying
Rommon requested SSD reformat
Formating SSD...
Creating config partition: START: 1MB END: 1001MB
mke2fs 1.42.8 (20-Jun-2013)
Discarding device blocks: done
Filesystem label=
OS type: Linux
Block size=4096 (log=2)
Fragment size=4096 (log=2)
Stride=0 blocks, Stripe width=0 blocks
61056 inodes, 244224 blocks
12211 blocks (5.00%) reserved for the super user
First data block=0
Maximum filesystem blocks=251658240
8 block groups
32768 blocks per group, 32768 fragments per group
7632 inodes per group
Superblock backups stored on blocks:
32768, 98304, 163840, 229376
.
.
.
.
.
.
.
[/sbin/fsck.vfat (1) -- /dev/sdc1] fsck.vfat -a /dev/sdc1
dosfsck 2.11, 12 Mar 2005, FAT32, LFN
/dev/sdc1: 47 files, 616932/1937459 clusters
fsck(/dev/sdc1) returned 0
Running postinst /etc/rpm-postinsts/100-apache2...
Running postinst /etc/rpm-postinsts/101-syslog-ng...
Running postinst /etc/rpm-postinsts/102-bind...
INIT: Entering runlevel: 3un-postinsts exists during rc.d purge
Starting system message bus: dbus.
Starting OpenBSD Secure Shell server: sshd
done.
Starting rpcbind daemon...done.
starting statd: done
Starting Advanced Configuration and Power Interface daemon: acpid.
acpid: starting up
After the appliance is rebooted, use the default credentials admin/Admin123 to connect, once the log in prompt is available. The same credentials can be used once Firepower Device Manager (FDM) and Firepower Chassis Manager (FCM) are ready.
Feedback