Rommon Security

CAUTION

Disclaimer: The author and Cisco Press are not liable for any damage to routers when using this feature. Please use this feature with extreme caution, and read all related materials and the following recovery procedure.

The 2600/3600 series (and newer versions of ROMMON for the 1700 series) all have what is known as a "ROMMON security" feature.

ROMMON security is designed to prevent a person with physical access to the router (2600 or 3600) from viewing the configuration file.

ROMMON security disables access to the ROMMON so that a person cannot set the configuration register to ignore the startup configuration. See the example that follows:

Router(config)#no service password-recovery WARNING:

Executing this command will disable password recovery mechanism. Do not execute this command without another plan for password recovery.

Are you sure you want to continue? [yes/no]: yes Router(config)#

! Upon system boot, the 3600 will display a message warning the user ! that password recovery is disabled:

System Bootstrap, Version 11.1(4675) [kluk 143], INTERIM SOFTWARE

Copyright (c) 1994-1996 by cisco Systems, Inc.

C3600 processor with 32768 Kbytes of main memory

Main memory is configured to 64 bit mode with parity disabled

PASSWORD RECOVERY FUNCTIONALITY IS DISABLED

program load complete, entry point: 0x80008000, size: 0x2733f4

NOTE

The ROMMON Security feature is not enabled via the config register, but rather with a global configuration command: no service password-recovery. This will turn on ROMMON security and prevent the router from responding to a break sequence on boot-up.

Risks: If a router is configured with no service password-recovery, this disables all access to the ROMMON. If there is not a valid IOS image in Flash in the router, the user will not be able to use the ROMMON XMODEM command to load a new Flash image. To fix the router, you must get a new IOS image on a Flash SIMM or on a PCMCIA card (3600 only).

To minimize this risk, a customer who uses ROMMON security should also use dual Flash bank memory and put a backup IOS image in a separate partition.

On the 3640 and 3660, in an emergency you can remove the NVRAM and reseat it. The NVRAM is implemented using battery backed-up SRAM. Removing the SRAM will erase the contents of NVRAM, which contains the no service password-recovery configuration. The NVRAM chip is located on the motherboard of the 3640 next to the PCMCIA connector. The silkscreen on the motherboard will identify it as "NVRAM." Please be sure to use proper anti-static procedures when handling the NVRAM.

The 1700, 2600, and 3620 use an EEPROM to hold the configuration. The EEPROM does not erase when you remove it.

Dependencies: The boot bits in the configuration register must not be set to 0x0 (boot to ROMMON) or 0x1. The "ignore" config bit must not be set. If the configuration register settings aren't correct, the router will print this error message:

Router(config)#config-register 0x3920 Router(config)#no service password-recovery Please setup auto boot using config-register first.

Recovery procedure: If a user uses this feature and loses the enable password, use following method to erase the entire contents of NVRAM:

Step 1. Boot the system and wait until after the system decompresses the IOS image:

Self decompressing the image : ############################### #################]

Step 2. Press Break within 5 seconds.

The 3600 will ask if you want to reset the router to the factory default configuration:

PASSWORD RECOVERY IS DISABLED.

Do you want to reset the router to factory default configuration and proceed [y/n] ? y

Step 3. Reset the router configuration to factory default. NOTE

Consult the following URLs for more information:

www.cisco.com/warp/customer/701/59.html

www.cisco.com/warp/customer/130/recovery_c2600.html

www.cisco.com/warp/customer/130/recovery_c3600.html

www.cisco.com/warp/customer/130/xmodem_generic.html

www.cisco.com/warp/customer/130/sw_upgrade_proc_ram.shtml

Continue reading here: Configure NAT on PIX for VLAN2 to 16415420 as demonstrated in the following example

Was this article helpful?

0 0