运行 Cisco IOS 系统软件的 Catalyst 6500/6000 系列交换机的口令恢复过程

本文适用于Supervisor 1、Supervisor2、Supervisor 720和虚拟交换系统(VSS) 1440个基于系统。对于基于 Supervisor 720 的系统，仅当它运行 Cisco IOS 软件版本 12.2(17)SX 或更高版本时，本文档才适用。如果您的 Supervisor 720 运行的版本低于此版本，请参阅带有 Supervisor 720 且其运行的 Cisco IOS 系统软件版本低于 12.2(17)SX 的 Catalyst 6500 的口令恢复过程。

Note: 虚拟交换系统的(VSS)支持的软件1440个基于系统是Cisco IOS软件版本12.2(33)SXH1或以上。

背景

在运行 Cisco IOS 系统软件的 Catalyst 6500/6000 和 Cisco 7600 上，其启动顺序与 Cisco 7200 系列路由器有所不同，因为两者的硬件不一样。在您关机并重新开机机箱后，交换机处理器(SP)首先启动。在一小段时间（大约 25 到 60 秒）后，它将控制台所有权转交给路由处理器 (RP (MSFC))。RP 继续加载捆绑的软件映像。请务必在 SP 将控制台控制权转交给 RP 之后立即按 Ctrl-brk。如果您太早发送中断序列，则您会进入 SP 的 ROMMON 模式，这不是您想要的模式。请在控制台上显示以下消息后发送中断序列：

00:00:03: %OIR-6-CONSOLE: Changing console ownership to route processor

在这之后，口令恢复过程与普通路由器一样。

Note: 从此时起，运行 Cisco IOS 系统软件的 Catalyst 6000 系列交换机称为路由器。

Conventions

有关文档规则的详细信息，请参阅 Cisco 技术提示规则。

逐步程序

由于交换机上运行的操作系统，交换机的配置方式与路由器相同。口令恢复过程的步骤与 Cisco 7200 系列路由器基本相同，唯一的不同是在开始中断序列之前，您必须等待大约 25 到 60 秒。

附加终端或PC有终端仿真的路由器的控制台端口。使用以下终端设置：
```
9600 baud rate 
No parity 
8 data bits 
1 stop bit 
No flow control 
```
所需的控制台电缆规格在电缆规格文件描述。有关如何连接到控制台端口的说明，请参阅模块安装指南。连接到控制台端口 - 仅 Supervisor 引擎部分提供了有用的信息。
如果仍然访问路由器，请发出show version命令，并且记录配置寄存器的设置。它通常是0x2102或0x102。点击此处发现输出的show version命令。
如果您无权访问路由器（由于丢失登录或 TACACS 口令），则您的配置寄存器被设置为 0x2102。
请使用电源开关关闭并重新打开该路由器。
警告： 只有在 RP 获得控制台端口的控制权后才能启动中断序列。

在 RP 获得控制台端口的控制权后，立即按终端键盘上的 Break。在运行 Cisco IOS 软件的 Catalyst 6500 上，SP 将首先启动。在它启动后，会将控制权转交给 RP。在 RP 获得控制权后，启动中断序列。在显示此消息时，RP 已获得控制台端口的控制权。(请勿起动中断序列，直到您看到此消息) ：
```
00:00:03: %OIR-6-CONSOLE: Changing console ownership to route processor
```
从这时起，密码恢复流程是相同的象为其他路由器。如果中断序列不起作用，请参阅口令恢复过程中的标准break键序列组合，获取其他键组合。
键入confreg 0x2142在rommon1>提示从闪存引导，无需装载配置。
键入重置在rommon 2>提示。

路由器重新启动。但是，它会忽略已保存的配置。
在每设置问题以后键入不或按Ctrl-C跳到最初的设置步骤。
键入enable (event)在Router>提示。

您处于启用模式下，并且会看到 Router# 提示。
重要信息：发出 configure memory 或 copy start running 命令，将非易失性 RAM (NVRAM) 复制到内存中。请不要发出 configure terminal 命令。
发出write terminal or show running命令。

show running和write terminal show命令路由器的配置。在此配置中，shutdown 命令显示在所有接口下面。这意味着所有接口当前已关闭。此外，口令都采用加密或未加密格式。
发出 configure terminal 命令以进入全局配置模式并进行更改。

提示当前是hostname(config)-。
在全局配置模式下发出 enable secret < password > 命令以更改启用口令。
发出config-register 0x2102命令或者您在第2步在全局配置模式的值(Router(config)-)下记录送回配置值到其最初值。

更改虚拟终端口令（如果存在）：

Router(config)#line vty 0 4
Router(config-line)#password cisco
Router(config-line)#^Z
Router#

在正常使用的每个接口上发出 no shutdown 命令。发出 show ip interface brief 命令查看接口及其当前状态的列表。您必须是在执行show ip interface brief命令的特权模式(Router-)。这是一个接口的一个示例：

Router#show ip interface brief
Interface                  IP-Address      OK? Method Status                Prol
Vlan1                      172.17.10.10    YES TFTP   administratively down dow 
Vlan10                     10.1.1.1        YES TFTP   administratively down dow 
GigabitEthernet1/1         unassigned      YES unset  administratively down dow 
GigabitEthernet1/2         unassigned      YES TFTP   administratively down dow 
GigabitEthernet2/1         unassigned      YES TFTP   administratively down dow 
GigabitEthernet2/2         unassigned      YES TFTP   administratively down dow 
FastEthernet3/1            172.16.84.110   YES TFTP   administratively down dow 
<snip>...

Router#configure terminal
Enter configuration commands, one per line.  End with CNTL/Z.
Router(config)#interface fastEthernet 3/1
Router(config-if)#no shutdown 
Router(config-if)#exit
Router(config)# <do other interfaces as necessary...>

按Ctrl-z离开配置模式。

提示当前是主机名。
发出 write memory 或 copy running startup 命令以提交更改。

输出示例:

此处的示例显示一个实际口令恢复过程。本示例是在 Catalyst 6000 系列交换机上创建的。首先发出 show version 和 show module 命令查看本示例中使用的组件。

Press RETURN to get started.

Router>enable
Password: 

Router#show version
Cisco Internetwork Operating System Software 
IOS (tm) c6sup1_rp Software (c6sup1_rp-JSV-M), Version 12.1(6)E, EARLY DEPLOYME)
TAC Support: http://www.cisco.com/cgi-bin/ibld/view.pl?i=support
Copyright (c) 1986-2001 by cisco Systems, Inc.
Compiled Sat 17-Mar-01 00:14 by eaarmas
Image text-base: 0x60020950, data-base: 0x6165E000

ROM: System Bootstrap, Version 12.0(3)XE, RELEASE SOFTWARE 
BOOTFLASH: MSFC Software (C6MSFC-BOOT-M), Version 12.1(6)E, EARLY DEPLOYMENT RE)

Router uptime is 14 minutes
System returned to ROM by power-on (SP by reload)
System image file is "sup-bootflash:c6sup11-jsv-mz.121-6.E"

Cisco Catalyst 6000 (R5000) processor with 114688K/16384K bytes of memory.
Processor board ID SAD04281AF6
R5000 CPU at 200Mhz, Implementation 35, Rev 2.1, 512KB L2 Cache
Last reset from power-on
Bridging software.
X.25 software, Version 3.0.0.
SuperLAT software (copyright 1990 by Meridian Technology Corp).
TN3270 Emulation software.
24 Ethernet/IEEE 802.3 interface(s)
2 Virtual Ethernet/IEEE 802.3  interface(s)
48 FastEthernet/IEEE 802.3 interface(s)
4 Gigabit Ethernet/IEEE 802.3 interface(s)
381K bytes of non-volatile configuration memory.
4096K bytes of packet SRAM memory.

16384K bytes of Flash internal SIMM (Sector size 256K).
Configuration register is 0x2102

Router#
Router#show module
Slot Ports Card Type                                 Model                 Serial Number
---- ----- ----------------------------------------- --------------------- -----------
 1     2   Cat 6000 sup 1 Enhanced QoS (active)      WS-X6K-SUP1A-2GE      SAD043301JS   
 2     2   Cat 6000 sup 1 Enhanced QoS (standby)     WS-X6K-SUP1A-2GE      SAD03510114   
 3    48   48 port 10/100 mb RJ45                    WS-X6348-RJ-45        SAD04230FB6   
 6    24   24 port 10baseFL                          WS-X6024-10FL-MT      SAD03413322   

Slot MAC addresses                      Hw    Fw           Sw
---- ---------------------------------- ----- ------------ ----------
 1   00d0.c0d2.5540 to 00d0.c0d2.5541   3.2   unknown      6.1(0.105)OR
 2   00d0.bcf1.9bb8 to 00d0.bcf1.9bb9   3.2   unknown      6.1(0.105)OR
 3   0002.7ef1.36e0 to 0002.7ef1.370f   1.1   5.3(1) 1999- 6.1(0.105)OR
 6   00d0.9738.5338 to 00d0.9738.534f   0.206 5.3(1) 1999- 6.1(0.105)OR

Router#
Router#reload
Proceed with reload? [confirm]


!--- Here you turn off the power and then turn it back on. !--- Here it is done with a reload instead of a hard power-cycle.


00:15:28: %SYS-SP-3-LOGGER_FLUSHING: System pausing to ensure console debugging.

00:15:27: %C6KPWR-SP-4-DISABLED: power to module in slot 2 set off (admin reque)
00:15:28: %C6KPWR-SP-4-DISABLED: power to module in slot 3 set off (admin reque)
00:15:28: %C6KPWR-SP-4-DISABLED: power to module in slot 6 set off (admin reque)
00:15:28: %OIR-SP-6-CONSOLE: Changing console ownership to switch processor

00:15:28: %SYS-SP-3-LOGGER_FLUSHED: System was paused for 00:00:00 to ensure co.

00:15:30: %SYS-SP-3-LOGGER_FLUSHING: System pausing to ensure console debugging.

***
*** --- SHUTDOWN NOW ---
***

00:15:30: %SYS-SP-5-RELOAD: Reload requested
00:15:30: %OIR-SP-6-CONSOLE: Changing console ownership to switch processor


00:15:30: %SYS-SP-3-LOGGER_FLUSHED: System was paused for 00:00:00 to ensure co.

00:15:31: %OIR-SP-6-REMCARD: Card removed from slot 1, interfaces disabled


!--- First, the switch processor comes up.


System Bootstrap, Version 5.3(1)
Copyright (c) 1994-1999 by cisco Systems, Inc.
c6k_sup1 processor with 65536 Kbytes of main memory

Autoboot executing command: "boot bootflash:c6sup11-jsv-mz.121-6.E"

Self decompressing the image : ################################################]

              Restricted Rights Legend

Use, duplication, or disclosure by the Government is
subject to restrictions as set forth in subparagraph
(c) of the Commercial Computer Software - Restricted
Rights clause at FAR sec. 52.227-19 and subparagraph
(c) (1) (ii) of the Rights in Technical Data and Computer
Software clause at DFARS sec. 252.227-7013.

           Cisco Systems, Inc.
           170 West Tasman Drive
           San Jose, California 95134-1706

Cisco Internetwork Operating System Software 
IOS (TM) c6sup1_sp Software (c6sup1_sp-SPV-M), Version 12.1(6)E, EARLY DEPLOYME)
TAC Support: http://www.cisco.com/cgi-bin/ibld/view.pl?i=support
Copyright (c) 1986-2001 by cisco Systems, Inc.
Compiled Sat 17-Mar-01 00:52 by eaarmas
Image text-base: 0x60020950, database: 0x605FC000

Start as Primary processor

00:00:03: %SYS-3-LOGGER_FLUSHING: System pausing to ensure console debugging ou.

00:00:03: %OIR-6-CONSOLE: Changing console ownership to route processor


!--- The RP now has control of the console. !--- This is when you send the break sequence.


System Bootstrap, Version 12.0(3)XE, RELEASE SOFTWARE 
Copyright (c) 1998 by cisco Systems, Inc.

*** Address Error (Load/Fetch) Exception ***
Access address = 0x5e
PC = 0x5e, Cause = 0x10, Status Reg = 0x3040d003
ROM Monitor Can Not Recover From Exception
A Board Reset Is Issued

*** Software NMI ***
PC = 0xbfc0b6b0, SP = 0x00002a90
Cat6k-MSFC platform with 131072 Kbytes of main memory

Self decompressing the image : ################################################]

*** System received an abort due to Break Key ***
signal= 0x3, code= 0x0, context= 0x6049ed68
PC = 0x601011ac, Cause = 0x20, Status Reg = 0x34008002


!--- You are now in ROMMON mode on the RP. Continue the password !--- recovery procedure just as on any router. Changing the configuration !--- register from 0x2102 to 0x2142 causes the router to ignore the existing !--- configuration. You want it to be ignored because it has passwords that you do not !--- know.


rommon 1 > confreg 0x2142

You must reset or power cycle for new config to take effect
rommon 2 > reset 

System Bootstrap, Version 12.0(3)XE, RELEASE SOFTWARE 
Copyright (c) 1998 by cisco Systems, Inc.
Cat6k-MSFC platform with 131072 Kbytes of main memory


Self decompressing the image : ################################################]

Attempt to download 'sup-bootflash:c6sup11-jsv-mz.121-6.E' ... okay
Starting download of 'sup-bootflash:c6sup11-jsv-mz.121-6.E': 8722810 bytes!!!!!!
Chksum: Verified!
Self decompressing the image : ################################################]

              Restricted Rights Legend

Use, duplication, or disclosure by the Government is
subject to restrictions as set forth in subparagraph
(c) of the Commercial Computer Software - Restricted
Rights clause at FAR sec. 52.227-19 and subparagraph
(c) (1) (ii) of the Rights in Technical Data and Computer
Software clause at DFARS sec. 252.227-7013.

           Cisco Systems, Inc.
           170 West Tasman Drive
           San Jose, California 95134-1706

Cisco Internetwork Operating System Software 
IOS (TM) c6sup1_RP Software (c6sup1_rp-JSV-M), Version 12.1(6)E, EARLY DEPLOYME)
TAC Support: http://www.cisco.com/cgi-bin/ibld/view.pl?i=support
Copyright (c) 1986-2001 by Cisco Systems, Inc.
Compiled Sat 17-Mar-01 00:14 by eaarmas
Image text-base: 0x60020950, database: 0x6165E000

Cisco Catalyst 6000 (R5000) processor with 114688K/16384K bytes of memory.
Processor board ID SAD04281AF6
R5000 CPU at 200Mhz, Implementation 35, Rev 2.1, 512KB L2 Cache
Last reset from power-on
Bridging software.
X.25 software, Version 3.0.0.
SuperLAT software (copyright 1990 by Meridian Technology Corp).
TN3270 Emulation software.
24 Ethernet/IEEE 802.3 interface(s)
1 Virtual Ethernet/IEEE 802.3  interface(s)
48 FastEthernet/IEEE 802.3 interface(s)
4 Gigabit Ethernet/IEEE 802.3 interface(s)
381K bytes of nonvolatile configuration memory.
4096K bytes of packet SRAM memory.

16384K bytes of Flash internal SIMM (Sector size 256K).

         --- System Configuration Dialog ---

Would you like to enter the initial configuration dialog? [yes/no]: n


!--- The router ignores the saved configuration and enters !--- the initial configuration mode.


Press RETURN to get started!

00:00:03: %SYS-3-LOGGER_FLUSHED: System was paused for 00:00:00 to ensure conso.

00:00:04: %C6KPWR-4-PSINSERTED: power supply inserted in slot 1.
00:00:04: %C6KPWR-4-PSOK: power supply 1 turned on.
00:02:08: %SYS-SP-5-RESTART: System restarted --
Cisco Internetwork Operating System Software 
IOS (TM) c6sup1_SP Software (c6sup1_sp-SPV-M), Version 12.1(6)E, EARLY DEPLOYME)
TAC Support: http://www.cisco.com/cgi-bin/ibld/view.pl?i=support
Copyright (c) 1986-2001 by cisco Systems, Inc.
Compiled Sat 17-Mar-01 00:52 by eaarmas
00:02:13: L3-MGR: l2 flush entry installed
00:02:13: L3-MGR: l3 flush entry installed
00:02:14: %SYS-5-RESTART: System restarted --
Cisco Internetwork Operating System Software 
IOS (TM) c6sup1_RP Software (c6sup1_rp-JSV-M), Version 12.1(6)E, EARLY DEPLOYME)
TAC Support: http://www.cisco.com/cgi-bin/ibld/view.pl?i=support
Copyright (c) 1986-2001 by Cisco Systems, Inc.
Compiled Sat 17-Mar-01 00:14 by eaarmas
00:02:17: %C6KPWR-SP-4-DISABLED: power to module in slot 1 set off (admin reque)
00:02:18: %C6KPWR-SP-4-ENABLED: power to module in slot 3 set on
00:02:18: %C6KPWR-SP-4-ENABLED: power to module in slot 6 set on
00:02:28: sm_set_moduleFwVersion:  nonexistent module (1)
00:02:38: %SNMP-5-MODULETRAP: Module 1 [Up] Trap
00:02:38: %OIR-SP-6-INSCARD: Card inserted in slot 1, interfaces are now online
00:02:56: %SNMP-5-MODULETRAP: Module 6 [Up] Trap
00:02:56: %OIR-SP-6-INSCARD: Card inserted in slot 6, interfaces are now online
00:02:59: SP: SENDING INLINE_POWER_DAUGHTERCARD_MSG SCP MSG

00:02:59: %SNMP-5-MODULETRAP: Module 3 [Up] Trap
00:02:59: %OIR-SP-6-INSCARD: Card inserted in slot 3, interfaces are now online
Router>enable
Router#


!--- You go right into privilege mode without needing a password. !--- At this point, the configuration running-config is a default configuration !--- with all the ports administratively down (shutdown).


Router#copy startup-config running-config
Destination filename [running-config]? <press enter>


!--- This pulls in the original configuration. Since you are already in privilege !--- mode, the passwords in this configuration do not affect you.


4864 bytes copied in 2.48 secs (2432 bytes/sec)
Router#configure terminal
Enter configuration commands, one per line.  End with CNTL/Z.
Router(config)#enable secret < password > [Choose a strong password with at least one capital letter, one number, and one special character.]


!--- Overwrite the password that you do not know. This is your new enable password.


Router(config)#^Z
Router#
Router#show ip interface brief
Interface                  IP-Address      OK? Method Status                Prol
Vlan1                      172.17.10.10    YES TFTP   administratively down dow 
Vlan10                     10.1.1.1        YES TFTP   administratively down dow 
GigabitEthernet1/1         unassigned      YES unset  administratively down dow 
GigabitEthernet1/2         unassigned      YES TFTP   administratively down dow 
GigabitEthernet2/1         unassigned      YES TFTP   administratively down dow 
GigabitEthernet2/2         unassigned      YES TFTP   administratively down dow 
FastEthernet3/1            172.16.84.110   YES TFTP   administratively down dow 
<snip>...


!--- Issue the no shut command on all interfaces that you want to bring up.


Router#configure terminal
Enter configuration commands, one per line.  End with CNTL/Z.
Router(config)#interface fastEthernet 3/1
Router(config-if)#no shutdown 
Router(config-if)#exit


!--- Overwrite the virtual terminal passwords. 


Router(config)#line vty 0 4
Router(config-line)#password cisco
Router(config-line)#^Z
Router#


!--- Restore the configuration register to its normal state so that it !--- no longer ignores the stored configuration file.


Router#show version
Cisco Internetwork Operating System Software 
IOS (tm) c6sup1_rp Software (c6sup1_rp-JSV-M), Version 12.1(6)E, EARLY DEPLOYME)
TAC Support: http://www.cisco.com/cgi-bin/ibld/view.pl?i=support
Copyright (c) 1986-2001 by cisco Systems, Inc.
Compiled Sat 17-Mar-01 00:14 by eaarmas
Image text-base: 0x60020950, data-base: 0x6165E000

ROM: System Bootstrap, Version 12.0(3)XE, RELEASE SOFTWARE 
BOOTFLASH: MSFC Software (C6MSFC-BOOT-M), Version 12.1(6)E, EARLY DEPLOYMENT RE)

Router uptime is 7 minutes
System returned to ROM by power-on (SP by reload)
System image file is "sup-bootflash:c6sup11-jsv-mz.121-6.E"

Cisco Catalyst 6000 (R5000) processor with 114688K/16384K bytes of memory.
Processor board ID SAD04281AF6
R5000 CPU at 200Mhz, Implementation 35, Rev 2.1, 512KB L2 Cache
Last reset from power-on
Bridging software.
X.25 software, Version 3.0.0.
SuperLAT software (copyright 1990 by Meridian Technology Corp).
TN3270 Emulation software.
24 Ethernet/IEEE 802.3 interface(s)
2 Virtual Ethernet/IEEE 802.3  interface(s)
48 FastEthernet/IEEE 802.3 interface(s)
4 Gigabit Ethernet/IEEE 802.3 interface(s)
381K bytes of non-volatile configuration memory.
4096K bytes of packet SRAM memory.

16384K bytes of Flash internal SIMM (Sector size 256K).
Configuration register is 0x2142

Router#configure terminal
Enter configuration commands, one per line.  End with CNTL/Z.
Router(config)#config-register 0x2102
Router(config)#^Z
Router#


!--- Verify that the configuration register is changed for the next reload.


Router#show version
Cisco Internetwork Operating System Software 
IOS (tm) c6sup1_rp Software (c6sup1_rp-JSV-M), Version 12.1(6)E, EARLY DEPLOYME)
TAC Support: http://www.cisco.com/cgi-bin/ibld/view.pl?i=support
Copyright (c) 1986-2001 by cisco Systems, Inc.
Compiled Sat 17-Mar-01 00:14 by eaarmas
Image text-base: 0x60020950, data-base: 0x6165E000

ROM: System Bootstrap, Version 12.0(3)XE, RELEASE SOFTWARE 
BOOTFLASH: MSFC Software (C6MSFC-BOOT-M), Version 12.1(6)E, EARLY DEPLOYMENT RE)

Router uptime is 8 minutes
System returned to ROM by power-on (SP by reload)
System image file is "sup-bootflash:c6sup11-jsv-mz.121-6.E"

Cisco Catalyst 6000 (R5000) processor with 114688K/16384K bytes of memory.
Processor board ID SAD04281AF6
R5000 CPU at 200Mhz, Implementation 35, Rev 2.1, 512KB L2 Cache
Last reset from power-on
Bridging software.
X.25 software, Version 3.0.0.
SuperLAT software (copyright 1990 by Meridian Technology Corp).
TN3270 Emulation software.
24 Ethernet/IEEE 802.3 interface(s)
2 Virtual Ethernet/IEEE 802.3  interface(s)
48 FastEthernet/IEEE 802.3 interface(s)
4 Gigabit Ethernet/IEEE 802.3 interface(s)
381K bytes of non-volatile configuration memory.
4096K bytes of packet SRAM memory.

16384K bytes of Flash internal SIMM (Sector size 256K).
Configuration register is 0x2142 (will be 0x2102 at next reload)
Router#
Router#copy running-config startup-config
Destination filename [startup-config]? <press enter>
Building configuration...
[OK]
Router#


!--- Optional: If you want to test that the router !--- operates properly and that you have changed !--- the passwords, then reload and test.


Router#reload
Proceed with reload? [confirm] <press enter>