运行 Cisco IOS 系统软件的 Catalyst 6500/6000 系列交换机的口令恢复过程

Introduction

本文档描述如何在运行 Cisco IOS® 系统软件的 Catalyst 6500/6000 系列交换机和 Cisco 7600 系列路由器上恢复口令。

Prerequisites

Requirements

There are no specific requirements for this document.

Components Used

本文适用于Supervisor 1、Supervisor2、Supervisor 720和虚拟交换系统(VSS) 1440个基于系统。对于基于 Supervisor 720 的系统，仅当它运行 Cisco IOS 软件版本 12.2(17)SX 或更高版本时，本文档才适用。如果您的 Supervisor 720 运行的版本低于此版本，请参阅带有 Supervisor 720 且其运行的 Cisco IOS 系统软件版本低于 12.2(17)SX 的 Catalyst 6500 的口令恢复过程。

Note: 虚拟交换系统的(VSS)支持的软件1440个基于系统是Cisco IOS软件版本12.2(33)SXH1或以上。

背景

在运行 Cisco IOS 系统软件的 Catalyst 6500/6000 和 Cisco 7600 上，其启动顺序与 Cisco 7200 系列路由器有所不同，因为两者的硬件不一样。在您关机并重新开机机箱后，交换机处理器(SP)首先启动。在一小段时间（大约 25 到 60 秒）后，它将控制台所有权转交给路由处理器 (RP (MSFC))。RP 继续加载捆绑的软件映像。请务必在 SP 将控制台控制权转交给 RP 之后立即按 Ctrl-brk。如果您太早发送中断序列，则您会进入 SP 的 ROMMON 模式，这不是您想要的模式。请在控制台上显示以下消息后发送中断序列：

00:00:03: %OIR-6-CONSOLE: Changing console ownership to route processor

在这之后，口令恢复过程与普通路由器一样。

Note: 从此时起，运行 Cisco IOS 系统软件的 Catalyst 6000 系列交换机称为路由器。

Conventions

有关文档规则的详细信息，请参阅 Cisco 技术提示规则。

逐步程序

由于交换机上运行的操作系统，交换机的配置方式与路由器相同。口令恢复过程的步骤与 Cisco 7200 系列路由器基本相同，唯一的不同是在开始中断序列之前，您必须等待大约 25 到 60 秒。

1. 附加终端或PC有终端仿真的路由器的控制台端口。使用以下终端设置：

   9600 baud rate 
   No parity 
   8 data bits 
   1 stop bit 
   No flow control 

   所需的控制台电缆规格在电缆规格文件描述。有关如何连接到控制台端口的说明，请参阅模块安装指南。连接到控制台端口 - 仅 Supervisor 引擎部分提供了有用的信息。

2. 如果仍然访问路由器，请发出show version命令，并且记录配置寄存器的设置。它通常是0x2102或0x102。点击此处发现输出的show version命令。

3. 如果您无权访问路由器（由于丢失登录或 TACACS 口令），则您的配置寄存器被设置为 0x2102。

4. 请使用电源开关关闭并重新打开该路由器。

5. 警告： 只有在 RP 获得控制台端口的控制权后才能启动中断序列。

   在 RP 获得控制台端口的控制权后，立即按终端键盘上的 Break。在运行 Cisco IOS 软件的 Catalyst 6500 上，SP 将首先启动。在它启动后，会将控制权转交给 RP。在 RP 获得控制权后，启动中断序列。在显示此消息时，RP 已获得控制台端口的控制权。(请勿起动中断序列，直到您看到此消息) ：

   00:00:03: %OIR-6-CONSOLE: Changing console ownership to route processor

   从这时起，密码恢复流程是相同的象为其他路由器。如果中断序列不起作用，请参阅口令恢复过程中的标准break键序列组合，获取其他键组合。

6. 键入confreg 0x2142在rommon1>提示从闪存引导，无需装载配置。

7. 键入重置在rommon 2>提示。

   路由器重新启动。但是，它会忽略已保存的配置。

8. 在每设置问题以后键入不或按Ctrl-C跳到最初的设置步骤。

9. 键入enable (event)在Router>提示。

   您处于启用模式下，并且会看到 Router# 提示。

10. 重要信息：发出 configure memory 或 copy start running 命令，将非易失性 RAM (NVRAM) 复制到内存中。请不要发出 configure terminal 命令。

11. 发出write terminal or show running命令。

    show running和write terminal show命令路由器的配置。在此配置中，shutdown 命令显示在所有接口下面。这意味着所有接口当前已关闭。此外，口令都采用加密或未加密格式。

12. 发出 configure terminal 命令以进入全局配置模式并进行更改。

    提示当前是hostname(config)-。

13. 在全局配置模式下发出 enable secret < password > 命令以更改启用口令。

14. 发出config-register 0x2102命令或者您在第2步在全局配置模式的值(Router(config)-)下记录送回配置值到其最初值。

15. 更改虚拟终端口令（如果存在）：

    Router(config)#line vty 0 4
    Router(config-line)#password cisco
    Router(config-line)#^Z
    Router# 

16. 在正常使用的每个接口上发出 no shutdown 命令。发出 show ip interface brief 命令查看接口及其当前状态的列表。您必须是在执行show ip interface brief命令的特权模式(Router-)。这是一个接口的一个示例：

    Router#show ip interface brief
    Interface                  IP-Address      OK? Method Status                Prol
    Vlan1                      172.17.10.10    YES TFTP   administratively down dow 
    Vlan10                     10.1.1.1        YES TFTP   administratively down dow 
    GigabitEthernet1/1         unassigned      YES unset  administratively down dow 
    GigabitEthernet1/2         unassigned      YES TFTP   administratively down dow 
    GigabitEthernet2/1         unassigned      YES TFTP   administratively down dow 
    GigabitEthernet2/2         unassigned      YES TFTP   administratively down dow 
    FastEthernet3/1            172.16.84.110   YES TFTP   administratively down dow 
    <snip>...
    
    Router#configure terminal
    Enter configuration commands, one per line.  End with CNTL/Z.
    Router(config)#interface fastEthernet 3/1
    Router(config-if)#no shutdown 
    Router(config-if)#exit
    Router(config)# <do other interfaces as necessary...>

17. 按Ctrl-z离开配置模式。

    提示当前是主机名。

18. 发出 write memory 或 copy running startup 命令以提交更改。

输出示例:

此处的示例显示一个实际口令恢复过程。本示例是在 Catalyst 6000 系列交换机上创建的。首先发出 show version 和 show module 命令查看本示例中使用的组件。

Press RETURN to get started.

Router>enable
Password: 

Router#show version
Cisco Internetwork Operating System Software 
IOS (tm) c6sup1_rp Software (c6sup1_rp-JSV-M), Version 12.1(6)E, EARLY DEPLOYME)
TAC Support: http://www.cisco.com/cgi-bin/ibld/view.pl?i=support
Copyright (c) 1986-2001 by cisco Systems, Inc.
Compiled Sat 17-Mar-01 00:14 by eaarmas
Image text-base: 0x60020950, data-base: 0x6165E000

ROM: System Bootstrap, Version 12.0(3)XE, RELEASE SOFTWARE 
BOOTFLASH: MSFC Software (C6MSFC-BOOT-M), Version 12.1(6)E, EARLY DEPLOYMENT RE)

Router uptime is 14 minutes
System returned to ROM by power-on (SP by reload)
System image file is "sup-bootflash:c6sup11-jsv-mz.121-6.E"

Cisco Catalyst 6000 (R5000) processor with 114688K/16384K bytes of memory.
Processor board ID SAD04281AF6
R5000 CPU at 200Mhz, Implementation 35, Rev 2.1, 512KB L2 Cache
Last reset from power-on
Bridging software.
X.25 software, Version 3.0.0.
SuperLAT software (copyright 1990 by Meridian Technology Corp).
TN3270 Emulation software.
24 Ethernet/IEEE 802.3 interface(s)
2 Virtual Ethernet/IEEE 802.3  interface(s)
48 FastEthernet/IEEE 802.3 interface(s)
4 Gigabit Ethernet/IEEE 802.3 interface(s)
381K bytes of non-volatile configuration memory.
4096K bytes of packet SRAM memory.

16384K bytes of Flash internal SIMM (Sector size 256K).
Configuration register is 0x2102

Router#
Router#show module
Slot Ports Card Type                                 Model                 Serial Number
---- ----- ----------------------------------------- --------------------- -----------
 1     2   Cat 6000 sup 1 Enhanced QoS (active)      WS-X6K-SUP1A-2GE      SAD043301JS   
 2     2   Cat 6000 sup 1 Enhanced QoS (standby)     WS-X6K-SUP1A-2GE      SAD03510114   
 3    48   48 port 10/100 mb RJ45                    WS-X6348-RJ-45        SAD04230FB6   
 6    24   24 port 10baseFL                          WS-X6024-10FL-MT      SAD03413322   

Slot MAC addresses                      Hw    Fw           Sw
---- ---------------------------------- ----- ------------ ----------
 1   00d0.c0d2.5540 to 00d0.c0d2.5541   3.2   unknown      6.1(0.105)OR
 2   00d0.bcf1.9bb8 to 00d0.bcf1.9bb9   3.2   unknown      6.1(0.105)OR
 3   0002.7ef1.36e0 to 0002.7ef1.370f   1.1   5.3(1) 1999- 6.1(0.105)OR
 6   00d0.9738.5338 to 00d0.9738.534f   0.206 5.3(1) 1999- 6.1(0.105)OR

Router#
Router#reload
Proceed with reload? [confirm]


!--- Here you turn off the power and then turn it back on. !--- Here it is done with a reload instead of a hard power-cycle.


00:15:28: %SYS-SP-3-LOGGER_FLUSHING: System pausing to ensure console debugging.

00:15:27: %C6KPWR-SP-4-DISABLED: power to module in slot 2 set off (admin reque)
00:15:28: %C6KPWR-SP-4-DISABLED: power to module in slot 3 set off (admin reque)
00:15:28: %C6KPWR-SP-4-DISABLED: power to module in slot 6 set off (admin reque)
00:15:28: %OIR-SP-6-CONSOLE: Changing console ownership to switch processor

00:15:28: %SYS-SP-3-LOGGER_FLUSHED: System was paused for 00:00:00 to ensure co.

00:15:30: %SYS-SP-3-LOGGER_FLUSHING: System pausing to ensure console debugging.

***
*** --- SHUTDOWN NOW ---
***

00:15:30: %SYS-SP-5-RELOAD: Reload requested
00:15:30: %OIR-SP-6-CONSOLE: Changing console ownership to switch processor


00:15:30: %SYS-SP-3-LOGGER_FLUSHED: System was paused for 00:00:00 to ensure co.

00:15:31: %OIR-SP-6-REMCARD: Card removed from slot 1, interfaces disabled


!--- First, the switch processor comes up.


System Bootstrap, Version 5.3(1)
Copyright (c) 1994-1999 by cisco Systems, Inc.
c6k_sup1 processor with 65536 Kbytes of main memory

Autoboot executing command: "boot bootflash:c6sup11-jsv-mz.121-6.E"

Self decompressing the image : ################################################]

              Restricted Rights Legend

Use, duplication, or disclosure by the Government is
subject to restrictions as set forth in subparagraph
(c) of the Commercial Computer Software - Restricted
Rights clause at FAR sec. 52.227-19 and subparagraph
(c) (1) (ii) of the Rights in Technical Data and Computer
Software clause at DFARS sec. 252.227-7013.

           Cisco Systems, Inc.
           170 West Tasman Drive
           San Jose, California 95134-1706

Cisco Internetwork Operating System Software 
IOS (TM) c6sup1_sp Software (c6sup1_sp-SPV-M), Version 12.1(6)E, EARLY DEPLOYME)
TAC Support: http://www.cisco.com/cgi-bin/ibld/view.pl?i=support
Copyright (c) 1986-2001 by cisco Systems, Inc.
Compiled Sat 17-Mar-01 00:52 by eaarmas
Image text-base: 0x60020950, database: 0x605FC000

Start as Primary processor

00:00:03: %SYS-3-LOGGER_FLUSHING: System pausing to ensure console debugging ou.

00:00:03: %OIR-6-CONSOLE: Changing console ownership to route processor


!--- The RP now has control of the console. !--- This is when you send the break sequence.


System Bootstrap, Version 12.0(3)XE, RELEASE SOFTWARE 
Copyright (c) 1998 by cisco Systems, Inc.

*** Address Error (Load/Fetch) Exception ***
Access address = 0x5e
PC = 0x5e, Cause = 0x10, Status Reg = 0x3040d003
ROM Monitor Can Not Recover From Exception
A Board Reset Is Issued

*** Software NMI ***
PC = 0xbfc0b6b0, SP = 0x00002a90
Cat6k-MSFC platform with 131072 Kbytes of main memory

Self decompressing the image : ################################################]

*** System received an abort due to Break Key ***
signal= 0x3, code= 0x0, context= 0x6049ed68
PC = 0x601011ac, Cause = 0x20, Status Reg = 0x34008002


!--- You are now in ROMMON mode on the RP. Continue the password !--- recovery procedure just as on any router. Changing the configuration !--- register from 0x2102 to 0x2142 causes the router to ignore the existing !--- configuration. You want it to be ignored because it has passwords that you do not !--- know.


rommon 1 > confreg 0x2142

You must reset or power cycle for new config to take effect
rommon 2 > reset 

System Bootstrap, Version 12.0(3)XE, RELEASE SOFTWARE 
Copyright (c) 1998 by cisco Systems, Inc.
Cat6k-MSFC platform with 131072 Kbytes of main memory


Self decompressing the image : ################################################]

Attempt to download 'sup-bootflash:c6sup11-jsv-mz.121-6.E' ... okay
Starting download of 'sup-bootflash:c6sup11-jsv-mz.121-6.E': 8722810 bytes!!!!!!
Chksum: Verified!
Self decompressing the image : ################################################]

              Restricted Rights Legend

Use, duplication, or disclosure by the Government is
subject to restrictions as set forth in subparagraph
(c) of the Commercial Computer Software - Restricted
Rights clause at FAR sec. 52.227-19 and subparagraph
(c) (1) (ii) of the Rights in Technical Data and Computer
Software clause at DFARS sec. 252.227-7013.

           Cisco Systems, Inc.
           170 West Tasman Drive
           San Jose, California 95134-1706

Cisco Internetwork Operating System Software 
IOS (TM) c6sup1_RP Software (c6sup1_rp-JSV-M), Version 12.1(6)E, EARLY DEPLOYME)
TAC Support: http://www.cisco.com/cgi-bin/ibld/view.pl?i=support
Copyright (c) 1986-2001 by Cisco Systems, Inc.
Compiled Sat 17-Mar-01 00:14 by eaarmas
Image text-base: 0x60020950, database: 0x6165E000

Cisco Catalyst 6000 (R5000) processor with 114688K/16384K bytes of memory.
Processor board ID SAD04281AF6
R5000 CPU at 200Mhz, Implementation 35, Rev 2.1, 512KB L2 Cache
Last reset from power-on
Bridging software.
X.25 software, Version 3.0.0.
SuperLAT software (copyright 1990 by Meridian Technology Corp).
TN3270 Emulation software.
24 Ethernet/IEEE 802.3 interface(s)
1 Virtual Ethernet/IEEE 802.3  interface(s)
48 FastEthernet/IEEE 802.3 interface(s)
4 Gigabit Ethernet/IEEE 802.3 interface(s)
381K bytes of nonvolatile configuration memory.
4096K bytes of packet SRAM memory.

16384K bytes of Flash internal SIMM (Sector size 256K).

         --- System Configuration Dialog ---

Would you like to enter the initial configuration dialog? [yes/no]: n


!--- The router ignores the saved configuration and enters !--- the initial configuration mode.


Press RETURN to get started!

00:00:03: %SYS-3-LOGGER_FLUSHED: System was paused for 00:00:00 to ensure conso.

00:00:04: %C6KPWR-4-PSINSERTED: power supply inserted in slot 1.
00:00:04: %C6KPWR-4-PSOK: power supply 1 turned on.
00:02:08: %SYS-SP-5-RESTART: System restarted --
Cisco Internetwork Operating System Software 
IOS (TM) c6sup1_SP Software (c6sup1_sp-SPV-M), Version 12.1(6)E, EARLY DEPLOYME)
TAC Support: http://www.cisco.com/cgi-bin/ibld/view.pl?i=support
Copyright (c) 1986-2001 by cisco Systems, Inc.
Compiled Sat 17-Mar-01 00:52 by eaarmas
00:02:13: L3-MGR: l2 flush entry installed
00:02:13: L3-MGR: l3 flush entry installed
00:02:14: %SYS-5-RESTART: System restarted --
Cisco Internetwork Operating System Software 
IOS (TM) c6sup1_RP Software (c6sup1_rp-JSV-M), Version 12.1(6)E, EARLY DEPLOYME)
TAC Support: http://www.cisco.com/cgi-bin/ibld/view.pl?i=support
Copyright (c) 1986-2001 by Cisco Systems, Inc.
Compiled Sat 17-Mar-01 00:14 by eaarmas
00:02:17: %C6KPWR-SP-4-DISABLED: power to module in slot 1 set off (admin reque)
00:02:18: %C6KPWR-SP-4-ENABLED: power to module in slot 3 set on
00:02:18: %C6KPWR-SP-4-ENABLED: power to module in slot 6 set on
00:02:28: sm_set_moduleFwVersion:  nonexistent module (1)
00:02:38: %SNMP-5-MODULETRAP: Module 1 [Up] Trap
00:02:38: %OIR-SP-6-INSCARD: Card inserted in slot 1, interfaces are now online
00:02:56: %SNMP-5-MODULETRAP: Module 6 [Up] Trap
00:02:56: %OIR-SP-6-INSCARD: Card inserted in slot 6, interfaces are now online
00:02:59: SP: SENDING INLINE_POWER_DAUGHTERCARD_MSG SCP MSG

00:02:59: %SNMP-5-MODULETRAP: Module 3 [Up] Trap
00:02:59: %OIR-SP-6-INSCARD: Card inserted in slot 3, interfaces are now online
Router>enable
Router#


!--- You go right into privilege mode without needing a password. !--- At this point, the configuration running-config is a default configuration !--- with all the ports administratively down (shutdown).


Router#copy startup-config running-config
Destination filename [running-config]? <press enter>


!--- This pulls in the original configuration. Since you are already in privilege !--- mode, the passwords in this configuration do not affect you.


4864 bytes copied in 2.48 secs (2432 bytes/sec)
Router#configure terminal
Enter configuration commands, one per line.  End with CNTL/Z.
Router(config)#enable secret < password > [Choose a strong password with at least one capital letter, one number, and one special character.]


!--- Overwrite the password that you do not know. This is your new enable password.


Router(config)#^Z
Router#
Router#show ip interface brief
Interface                  IP-Address      OK? Method Status                Prol
Vlan1                      172.17.10.10    YES TFTP   administratively down dow 
Vlan10                     10.1.1.1        YES TFTP   administratively down dow 
GigabitEthernet1/1         unassigned      YES unset  administratively down dow 
GigabitEthernet1/2         unassigned      YES TFTP   administratively down dow 
GigabitEthernet2/1         unassigned      YES TFTP   administratively down dow 
GigabitEthernet2/2         unassigned      YES TFTP   administratively down dow 
FastEthernet3/1            172.16.84.110   YES TFTP   administratively down dow 
<snip>...


!--- Issue the no shut command on all interfaces that you want to bring up.


Router#configure terminal
Enter configuration commands, one per line.  End with CNTL/Z.
Router(config)#interface fastEthernet 3/1
Router(config-if)#no shutdown 
Router(config-if)#exit


!--- Overwrite the virtual terminal passwords. 


Router(config)#line vty 0 4
Router(config-line)#password cisco
Router(config-line)#^Z
Router#


!--- Restore the configuration register to its normal state so that it !--- no longer ignores the stored configuration file.


Router#show version
Cisco Internetwork Operating System Software 
IOS (tm) c6sup1_rp Software (c6sup1_rp-JSV-M), Version 12.1(6)E, EARLY DEPLOYME)
TAC Support: http://www.cisco.com/cgi-bin/ibld/view.pl?i=support
Copyright (c) 1986-2001 by cisco Systems, Inc.
Compiled Sat 17-Mar-01 00:14 by eaarmas
Image text-base: 0x60020950, data-base: 0x6165E000

ROM: System Bootstrap, Version 12.0(3)XE, RELEASE SOFTWARE 
BOOTFLASH: MSFC Software (C6MSFC-BOOT-M), Version 12.1(6)E, EARLY DEPLOYMENT RE)

Router uptime is 7 minutes
System returned to ROM by power-on (SP by reload)
System image file is "sup-bootflash:c6sup11-jsv-mz.121-6.E"

Cisco Catalyst 6000 (R5000) processor with 114688K/16384K bytes of memory.
Processor board ID SAD04281AF6
R5000 CPU at 200Mhz, Implementation 35, Rev 2.1, 512KB L2 Cache
Last reset from power-on
Bridging software.
X.25 software, Version 3.0.0.
SuperLAT software (copyright 1990 by Meridian Technology Corp).
TN3270 Emulation software.
24 Ethernet/IEEE 802.3 interface(s)
2 Virtual Ethernet/IEEE 802.3  interface(s)
48 FastEthernet/IEEE 802.3 interface(s)
4 Gigabit Ethernet/IEEE 802.3 interface(s)
381K bytes of non-volatile configuration memory.
4096K bytes of packet SRAM memory.

16384K bytes of Flash internal SIMM (Sector size 256K).
Configuration register is 0x2142

Router#configure terminal
Enter configuration commands, one per line.  End with CNTL/Z.
Router(config)#config-register 0x2102
Router(config)#^Z
Router#


!--- Verify that the configuration register is changed for the next reload.


Router#show version
Cisco Internetwork Operating System Software 
IOS (tm) c6sup1_rp Software (c6sup1_rp-JSV-M), Version 12.1(6)E, EARLY DEPLOYME)
TAC Support: http://www.cisco.com/cgi-bin/ibld/view.pl?i=support
Copyright (c) 1986-2001 by cisco Systems, Inc.
Compiled Sat 17-Mar-01 00:14 by eaarmas
Image text-base: 0x60020950, data-base: 0x6165E000

ROM: System Bootstrap, Version 12.0(3)XE, RELEASE SOFTWARE 
BOOTFLASH: MSFC Software (C6MSFC-BOOT-M), Version 12.1(6)E, EARLY DEPLOYMENT RE)

Router uptime is 8 minutes
System returned to ROM by power-on (SP by reload)
System image file is "sup-bootflash:c6sup11-jsv-mz.121-6.E"

Cisco Catalyst 6000 (R5000) processor with 114688K/16384K bytes of memory.
Processor board ID SAD04281AF6
R5000 CPU at 200Mhz, Implementation 35, Rev 2.1, 512KB L2 Cache
Last reset from power-on
Bridging software.
X.25 software, Version 3.0.0.
SuperLAT software (copyright 1990 by Meridian Technology Corp).
TN3270 Emulation software.
24 Ethernet/IEEE 802.3 interface(s)
2 Virtual Ethernet/IEEE 802.3  interface(s)
48 FastEthernet/IEEE 802.3 interface(s)
4 Gigabit Ethernet/IEEE 802.3 interface(s)
381K bytes of non-volatile configuration memory.
4096K bytes of packet SRAM memory.

16384K bytes of Flash internal SIMM (Sector size 256K).
Configuration register is 0x2142 (will be 0x2102 at next reload)
Router#
Router#copy running-config startup-config
Destination filename [startup-config]? <press enter>
Building configuration...
[OK]
Router#


!--- Optional: If you want to test that the router !--- operates properly and that you have changed !--- the passwords, then reload and test.


Router#reload
Proceed with reload? [confirm] <press enter>

Related Information

• LAN 交换技术支持页
• LAN 产品支持页
• Catalyst LAN 和 ATM 交换机产品支持
• Technical Support - Cisco Systems