Cisco Catalyst 2950 Password Recovery: Step-by-Step Guide

Sooner or later you will pick up a second-hand Catalyst 2950 for your home lab, or inherit one at work, and find that nobody remembers the e...

Sooner or later you will pick up a second-hand Catalyst 2950 for your home lab, or inherit one at work, and find that nobody remembers the enable password. In this guide I walk you through the full recovery process on real hardware: connecting the console cable, interrupting the boot with the MODE button, hiding the saved configuration, and then setting a new secret while keeping the existing VLANs and port settings intact.

The whole job takes about 15 minutes once you have the right cable. Please read the warning section first if the switch is carrying live traffic.

Before You Start: Read This If the Switch Is in Production

This procedure requires power-cycling the switch. Every device plugged into it loses its link while it reboots, and the switch boots twice before you are finished. Plan for roughly 10 minutes of downtime and do it inside a maintenance window.

A few other points to keep in mind:

• You need physical access. The procedure only works from the console port with your hand on the MODE button. That is by design: anyone who can physically touch the switch can reset it, which is exactly why network closets should be locked and access controlled.
• Only do this on equipment you are authorized to manage. In a company, log a change request so nobody mistakes the reboot for a fault or an attack.
• The switch will not forward traffic normally during recovery. While the configuration file is renamed, the switch boots with factory defaults: every port in VLAN 1, no trunks, no port security. If other switches are connected, consider unplugging the uplinks first to avoid a temporary loop or mixed VLANs.
• Recovery can be turned off. Some later IOS releases for this family support no service password-recovery. If a previous administrator set it, the boot loader will refuse to show you the flash files, and your only option is to return the switch to factory defaults, which erases the configuration.

Packet Tracer does not simulate the MODE button on switches, so this is a real-hardware exercise only.

What You Need

Item	Details
Switch	Cisco Catalyst 2950 (for example WS-C2950-24 or WS-C2950T-24)
Console cable	Cisco light-blue rollover cable: RJ-45 into the switch console port, DB-9 at the PC end (use a USB-to-serial adapter if your laptop has no serial port)
Terminal software	PuTTY, Tera Term, SecureCRT, or old HyperTerminal
Access to the switch	You must be standing next to it to hold the MODE button

Figure: Console connection used for password recovery on a Catalyst 2950.

Step 1: Set Up the Console Connection (9600 8N1)

Connect the rollover cable from the switch's console port to your PC. Open your terminal program and configure the serial line with the classic Cisco console settings:

Bits per second: 9600
Data bits:       8
Parity:          None
Stop bits:       1
Flow control:    None

That combination is usually written 9600 8N1. The one setting people get wrong is flow control: leave it as None. On old HyperTerminal the default was Hardware (RTS/CTS) flow control, which can make the console appear frozen. In PuTTY, choose the Serial connection type, enter your COM port (check Windows Device Manager under Ports), set the speed to 9600, and set Flow control to None under Connection > Serial.

Step 2: Enter the Boot Loader with the MODE Button

This is the part that actually interrupts the switch. On a 2950 there is no "send break" trick like on a router; you use the physical MODE button on the front panel.

1. Unplug the switch power cord. (The 2950 has no power switch.)
2. Press and hold the MODE button on the front of the switch.
3. While still holding MODE, plug the power cord back in.
4. Keep holding MODE until the LED above Port 1x goes out, then release it.

You should now see the boot loader message and prompt on your terminal:

The system has been interrupted prior to initializing the
flash filesystem.  The following commands will initialize
the flash filesystem, and finish loading the operating
system software:

    flash_init
    load_helper
    boot

switch:

If the switch instead boots all the way to the normal IOS prompt, you released MODE too early (or were not holding it when power was applied). Unplug and try again, holding MODE until the Port 1x LED goes out.

Step 3: Initialize Flash

At the switch: prompt, prepare the flash file system:

switch: flash_init
switch: load_helper

flash_init initializes the flash file system so you can read and rename files on it. If flash was already initialized the command returns quickly; that is fine. load_helper loads any helper images needed to run commands such as file operations from the boot loader. On many 2950 images load_helper reports that no helper files are present, which is also fine.

Step 4: Find and Rename the Configuration File

List the flash contents so you can confirm the configuration file is there:

switch: dir flash:
Directory of flash:/

2    -rwx  2888547   <date>               c2950-i6q4l2-mz.121-22.EA14.bin
3    -rwx  269       <date>               env_vars
4    drwx  10176     <date>               html
6    -rwx  2163      <date>               config.text
7    -rwx  5         <date>               private-config.text
8    -rwx  736       <date>               vlan.dat

7741440 bytes total (3092480 bytes free)

You will see the IOS image plus a file called config.text, which is the switch's startup configuration (the equivalent of NVRAM on this platform). Rename it so the switch cannot read it during boot:

switch: rename flash:config.text flash:config.old

By renaming rather than deleting, you keep a safe copy of every VLAN, port assignment, and interface setting. Booting without config.text means the switch comes up with no startup configuration and therefore no enable password.

Step 5: Boot the Switch

switch: boot

The switch loads IOS normally. Because there is no startup configuration, it offers the initial setup dialog:

         --- System Configuration Dialog ---

Continue with configuration dialog? [yes/no]: n

Answer no. You will land at the user EXEC prompt:

Switch>

Step 6: Restore the Configuration and Set a New Password

Now bring the real configuration back. First move into privileged EXEC mode:

Switch> enable
Switch#

Because the switch booted with factory defaults, there is no password on enable yet, so it lets you straight in. Rename the saved file back to its original name:

Switch# rename flash:config.old flash:config.text

Copy that configuration into the running configuration so all the original settings take effect:

Switch# copy flash:config.text system:running-config
Destination filename [running-config]?
2163 bytes copied in 0.564 secs
SW1#

Press Enter to accept the default destination. The prompt changes to the switch's original hostname (SW1 in this example), and the switch now runs with its original VLANs and interfaces — and still with the old, unknown enable password, which is why the next step matters. Replace it with one you control:

SW1# configure terminal
SW1(config)# enable secret YourNewStrongPassword
SW1(config)# end

Use enable secret, not enable password. The secret is stored as a hash, while the old enable password is weakly encrypted or plain text. If the original config also had an enable password line, overwrite or remove it so the two do not conflict:

SW1(config)# no enable password

Choose a real password here, not a dictionary word. "Cisco" and "password" are the first things anyone tries. A passphrase such as Kt!Lab-2950-Sw1 is far better for a device you actually rely on.

Step 7: Save and Verify

Write the running configuration to the startup configuration so the new secret survives a reboot:

SW1# copy running-config startup-config
Destination filename [startup-config]?
Building configuration...
[OK]

You can also use the shorter write memory. Confirm the new secret is present:

SW1# show running-config | include enable
enable secret 5 $1$mERr$9cTjUIEqNU2wQcQQ...

The hash confirms the secret is set. Log out and log back in to be completely sure the new password works before you walk away:

SW1# exit
SW1> enable
Password:
SW1#

Prefer video? Watch more hands-on labs on the Technical Hakim YouTube channel.

Common Mistakes

• Wrong flow control. A frozen-looking console is almost always Xon/Xoff flow control instead of None. Fix the terminal setting, don't reboot the switch.
• Releasing MODE too late or too early. If the switch boots normally to the IOS prompt instead of switch:, you released MODE too soon or pressed it after power was applied. Hold it from the moment you plug in until the Port 1x LED goes out, then power-cycle and try again.
• Deleting instead of renaming. Never run delete flash:config.text. Rename it so you can restore it. A delete throws away the whole configuration.
• Forgetting to copy the config back. If you boot, set a new secret, and save without first copying config.text into the running configuration, you overwrite the saved config with a near-empty one and lose your VLANs. Always do the copy flash:config.text system:running-config step before saving.
• Using enable password instead of enable secret. The plain enable password is trivially reversible. Always set enable secret.
• Not saving. If you skip copy running-config startup-config, your new password disappears at the next reboot and you are back where you started.

Summary

Recovering a Catalyst 2950 comes down to six ideas: console in at 9600 8N1, break into the boot loader with the MODE button, run flash_init and load_helper, rename config.text so the switch boots clean, copy the real config back into memory, then set and save a new enable secret. Because you rename rather than delete, you keep every original setting. The method relies entirely on physical access, so keep your switches locked up.

Related tutorials

• Configuring Static VLANs on a Cisco Switch (Packet Tracer Lab)
• Site-to-Site IPsec VPN on Cisco Routers: Packet Tracer Lab
• RIP vs EIGRP vs OSPF: Routing Protocols Compared

Sources

• Cisco, "Password Recovery Procedure for the Catalyst 2950 Series Switches"
• Cisco IOS Switching Command Reference (boot loader commands: flash_init, load_helper, rename)