I got my hands on (or rather, it was handed to me) a Cisco PIX 501. I decided to set it up as a backup router in case I urgently needed to swap out some piece of hardware somewhere or temporarily replace one - the PIX 501 is fairly small in size (about like an 8-port switch) and convenient for grabbing and running to the site.
The model is incredibly old and doesn't shine in terms of speed, but purely as a spare unit (not for permanent use, but as a temporary replacement so people can at least work somehow) it'll do.
But, first of all, I needed to reset the password on this Cisco. This is what I'll be talking about here - how I reset every possible and impossible password on it.
What we'll need:
a) A console cable - a COM port on one end, and Rj45 on the other, which will plug into the Cisco.
b) A computer with a COM port. As a last resort - with a PCI-2-COM card.
c) A TFTP server, installed on a computer accessible from the Cisco. I used this one: http://tftpd32.jounin.net/tftpd32_download.html.
d) A serial client, for example, PuTTY.
So,
1) We connect the console cable with one end to the Cisco (into the Console port), and the other end - to the computer's COM port.
2) We connect an ethernet cable from the Cisco's LAN port (any non-WAN one) into the switch that is on your network and through which the computer with the TFTP server can be reached.
3) We install and start the TFTP server (if you used the one from the link above - it's very simple and easy there).
4) We start PuTTY on the computer with the COM port, choose Serial mode and establish a connection. It's not a problem that the Cisco isn't turned on yet - that's exactly how it should be.
5) We power on the Cisco and watch the PuTTY console. We're interested in waiting for the device to fully boot in order to see the IOS OS version.
-----------------------------------------------------------------------
|| ||
|| ||
|||| ||||
..:||||||:..:||||||:..
c i s c o S y s t e m s
Private Internet eXchange
-----------------------------------------------------------------------
Cisco PIX Firewall
Cisco PIX Firewall Version 6.3(1)
Licensed Features:
Failover: Disabled
VPN-DES: Enabled
VPN-3DES-AES: Enabled
Maximum Interfaces: 2
Cut-through Proxy: Enabled
Guards: Enabled
URL-filtering: Enabled
Inside Hosts: 50
Throughput: Unlimited
IKE peers: 10
Here in the line "Cisco PIX Firewall Version 6.3" you can see the OS version (not the BIOS!).
6) Now we head over to this site: http://www.cisco.com/c/en/us/products/security/firewalls/index.html, and download the bin file with the required OS version. For example, in our case that will be np63.bin.
7) We place this file in the root of the TFTP server's directory.
8) Now we power-cycle the Cisco again, and as soon as it displays:
Use BREAK or ESC to interrupt flash boot.
Use SPACE to begin flash boot immediately.
and starts counting down seconds - press ESC to enter monitor mode.
9) Now we enter the commands to establish a connection with the TFTP server and download the required file:
monitor> address 192.168.0.100
monitor> ping 192.168.0.15
!!!!!
monitor> server 192.168.0.15
monitor> file np63.bin
monitor> tftp
Here:
- address: sets the IP address of the Cisco itself (in our example 192.168.0.100),
- ping: in this example the TFTP server is at IP 192.168.0.15 and with the ping command we check its availability,
- server: we specify that the TFTP server has address 192.168.0.15,
- file: we specify the name of the downloaded file (in our case np63.bin),
- tftp: with this line we ask the Cisco to load the specified file and erase the passwords.
After issuing the last command, the Cisco will request confirmation for the password reset and will delete them. Moreover, on the next startup it will say "enter password", but the password itself will be blank.
PS. Keep in mind that only the password is reset. IP addresses and other settings are not touched, so if, as in my case, you got a Cisco with an unknown configuration - it's advisable to perform a full reset. To do this:
$ enable
# write erase
Comments