Performing Password Recovery for the ASA 5500 Series Adaptive Security Appliance and the ASA Security Services Modules AIP-SSM and CSC-SSM

Performing Password Recovery for the ASA 5500 Series Adaptive Security Appliance 

To recover passwords, perform the following steps: 

Step 1 Connect a PC to the console port using the provided console cable, and connect to the console using a terminal emulator set for 9600 baud, 8 data bits, no parity, 1 stop bit, no flow control.

Step 2  Press the Enter key to see the following prompt:

hostname> 

This prompt indicates that you are in user EXEC mode.

Step 3 To access privileged EXEC mode, enter the following command:

hostname> enable

The following prompt appears:

Password:

Step 4  Enter the enable password at the prompt.

By default, the password is blank, and you can press the Enter key to continue.

The prompt changes to:

hostname#

To exit privileged mode, enter the disable, exit, or quit command.

Step 5  To access global configuration mode, enter the following command:

hostname# configure terminal

The prompt changes to the following:

hostname(config)#

Step 6 Power off the security appliance, and then power it on.

Step 7 During the startup messages, press the Escape key when prompted to enter ROMMON.

Step 8  To set the security appliance to ignore the startup configuration at reload, enter the following command:

rommon #1> confreg

The security appliance displays the current configuration register value, and asks if you want to change the value:

Current Configuration Register: 0x00000011

Configuration Summary:

  boot TFTP image, boot default image from Flash on netboot failure

Do you wish to change this configuration? y/n [n]:

Step 9  Record your current configuration register value, so you can restore it later.

Step 10  At the prompt, enter Y to change the value.

The security appliance prompts you for new values.

Step 11  Accept the default values for all settings, except for the “disable system configuration?” value; at that prompt, enter Y.

Step 12  Reload the security appliance by entering the following command:

rommon #2> boot

The security appliance loads a default configuration instead of the startup configuration.

Step 13  Enter privileged EXEC mode by entering the following command:

hostname> enable

Step 14 When prompted for the password, press Return.

The password is blank. 

Step 15  Load the startup configuration by entering the following command:

hostname# copy startup-config running-config

Step 16  Enter global configuration mode by entering the following command:

hostname# configure terminal

Step 17  Change the passwords in the configuration by entering the following commands, as necessary:

hostname(config)# password password

hostname(config)# enable password password

hostname(config)# username name password password

Step 18  Change the configuration register to load the startup configuration at the next reload by entering the following command:

hostname(config)# config-register value

Where value is the configuration register value you noted in Step 8 and 0x1 is the default configuration register. For more information about the configuration register, see the Cisco Security Appliance Command Reference.

Step 19  Save the new passwords to the startup configuration by entering the following command:

hostname(config)# copy running-config startup-config

 Step-by-Step Procedure 

Issue the hw-module module <module_num> password-resetcommand from the Cisco ASA CLI. For the AIP module, this command sets the configuration register in ROMMON to cause a boot of the password reset image and then power cycles the module. For the CSC module, this command sends the session 1 do reset-password command to the module.

ciscoasa(config)#hw-module module 1 password-reset
Reset the password on module in slot 1? [confirm]

Sample Procedure 

This procedure shows how to recover the password with the Cisco Adaptive Security Device Manager (ASDM).

1. For the AIP-SSM, click Tools on the main menu, and select IPS Password Reset.

2. For the CSC-SSM, click Tools on the main menu, and select CSC Password Reset.