| Lab 8.1.2 Router password recovery - Overview Estimated time: 15 min. Objectives: To learn the recovery procedure when a password is forgotten. Background: There will be circumstances where the password for a router needs to be reset. The password may have been forgotten or the network administrator may have left the company. The password recovery procedure requires physical access to the router because a directly connected console cable is used. Since password recovery methods are published on the Internet and in books, routers need to be in a secure location with physical access limited to authorized staff. The version of HyperTerminal provided with Windows 95, 98, NT and 2000 was developed for Microsoft by Hilgraeve. This version does not issue a "break" sequence as required for the Cisco router password recovery technique. An upgrade, known as HyperTerminal Private Edition (PE) is available free of charge to personal and educational use. Commercial use of the program requires registration with Hilgraeve. The program may be downloaded from the Hilgraeve web site listed in Web Site Resources below. Tools / Preparation: Prior to starting this lab you should have the equipment for the standard 5-router lab available. The NVRAM of the router you will be configuring should be erased. Before beginning the lab, the instructor or lab assistant should login to each router, enter the privileged EXEC mode, issue the erase startup-config command, and then issue the reload command. This will force the routers to come up with a blank configuration. The answer section includes examples of the detailed command sets that the students will have to master. The instructor will review the router configuration when finished. Prior to starting this lab you will need to connect a PC workstation (with the HyperTerminal PE program loaded) to a router using the router's console interface with a roll-over (console) cable. All lab work is done through the HyperTerminal PE program that is configured to connect to the router. You may want to review Chapter 13 in the Cisco Networking Academy First-Year Companion Guide. Work individually or in teams. Be familiar with the following commands: config-register show version configure terminal enable secret Resources Required: PC connected to the router console port with a roll-over cable Windows operating system (Win 95, 98, NT or 2000) installed on PC HyperTerminal PE program configured for router console access PC connected to the router console port with a roll-over cable Websites Sites Required: Routing basics General information on routers 2500 series routers 1600 series routers Terms and acronyms IP routing protocol IOS command summary Hilgraeve HyperTerminal PE download IOS password encryption facts Notes: Step 1 - Login to a router. Explanation: Connect to the router and login. Enter the password cisco if prompted. Step 2 - Record the configuration register setting. Task: Enter the command show version (abbreviated show ver). Explanation: This displays the current configuration register setting, along with other information. 1. What is the current configuration register setting? Step 3 - Restart the router. Task: Turn off the router for a short period of time and turn it back on again. Explanation: When the router is restarting, the boot up sequence can be interrupted. Step 4 - Interrupt the boot up sequence. Task: Within 60 seconds of turning the router back on, press and hold the Control key, then press the Break key. Explanation: A break character is sent to the router, interrupting the boot up sequence. Step 5 - Change the configuration register. Task: Enter the commands to change the configuration register. Explanation: The configuration register is changed to tell the router to ignore the configuration file in NVRAM on the next startup. The procedure varies depending on the model of router. A. 2500 series router: The prompt will be > with no router name. Type o/r 0x2142 and press enter (lower case letter o, slash, lower case r, space, zero, lower case x, four, two). Type i and press enter to reload the router. Wait until the router has rebooted. Type n when prompted to enter initial configuration. Press enter to see the router> prompt. B. 1600 series router: The prompt will be rommon 1>. Type confreg and type Y when asked to change the configuration. Type N to all questions except ignore system config info. When you complete responding to the questions, you will be prompted to change the configuration again. Type N, then type reset to reload the router. Wait until the router has rebooted. Type N when prompted to enter initial configuration. Press enter to see the router> prompt. Step 6 - Enter the privileged EXEC mode. Task: From user EXEC mode, enter privileged EXEC mode using the enable command. Explanation: Enter the enable mode from the user EXEC mode. 2. Why was no password required? Step 7 - Examine the configuration the router is using. Task: Enter the command show running-config (abbreviated: sh run). Explanation: Since the configuration registers were set to ignore the configuration file in step 5, the router has a minimal configuration. Step 8 - Load the router configuration file. Task: Type the command copy startup-config running-config (abbreviated: copy start run). Explanation: The configuration file is loaded from NVRAM into RAM. This will allow us to view and/or modify the router passwords. 3. How does your router prompt change? Step 9 - Look at passwords. Task: Enter the command show running-config (abbreviated: sh run). Explanation: Passwords that have been encrypted with the enable secret command show up as a series of letters, numbers and symbols. (e.g. $1$miYV$i9OOuSBQBde5fzgS3tn8T0). Non-encrypted passwords are in plain text. 4. What passwords do you see? Step 10 - Change passwords. Task: Enter the commands to change the appropriate passwords. Explanation: Passwords set using the enable secret command cannot be decrypted even with third-party software. The only option you have is to change the password to another value. Go into global configuration mode by entering the command configure terminal (abbreviated: config t). Enter the command enable secret mynewpassword. Press and hold the Control key and press Z to exit out of global config mode. Type the command show running-config (abbreviated: sh run). 5. What passwords do you now see? 6. Has the encrypted password changed from the value in step 9? Note: For purposes of this lab, we will not be saving the router configuration with the new password. We need to change the password back to the value class. Enter global config mode by entering the command config t. Enter the command enable secret class, then press Control Z to exit global configuration mode. Save the new configuration by entering the command copy running-config startup-config (abbreviated: copy run start). Step 11 - Change the configuration register. Task: Examine the current status of the configuration register and change it back to its original value. Explanation: The configuration register is still set to ignore the startup configuration contained in NVRAM. You need to change it back to its original value. Enter the command show version (abbreviated sh ver). 7. What is the value of the configuration register? Enter global config mode by typing the command config t. Enter global config mode by typing the command config terminal (abbreviated: config t). Enter the command config-register 0x2102. (Note: use the original value you recorded in step 2). Press Control Z to exit global config mode. Enter the command sh ver to see the new value of the configuration register. 8. What is the new value of the configuration register? Step 12 - Verify new password. Task: a. Enter the command reload. b. Enter Y if prompted to save new configuration, and to proceed with reload. Explanation: You need to verify that the new password you created in step 10 works. Enter privileged EXEC mode by entering the command enable (abbreviated: ena). Enter the password class. If you properly set the enable password, you should see the router prompt change. View the status of the configuration register by entering the command show version (abbreviated: sh ver). 9. Has the configuration register changed back to its original value you recorded in step 2?