Cisco Catalyst 9300 Password Recovery: A Step-by-Step Guide

Forgetting a password can be a major setback in network management, especially when it concerns critical infrastructure like the Cisco Catalyst 9300 switch. Whether you're a network administrator, system integrator, or a distributor supporting end-users, knowing how to reset the Cisco 9300 switch password is essential for maintaining network access and performance.

Why Cisco 9300 Password Recovery Matters

The Cisco Catalyst 9300 Series, a cornerstone of modern enterprise networks, delivers advanced speed, security, and programmability. However, a forgotten password can lock you out of the CLI, preventing critical configuration or troubleshooting tasks.

To regain access, you’ll use a method that bypasses the startup configuration—allowing you to set a new password without losing existing configurations.

Prerequisites

Before starting the password recovery process, ensure you have:

• Physical access to the switch
• Console cable (RJ-45 to DB9, USB-C, or USB-mini, depending on your model)
• A PC with a terminal emulator (e.g., PuTTY, Tera Term, SecureCRT)
• An approved maintenance window, as this procedure requires a reboot

Cisco 9300 Password Recovery Procedure (Step-by-Step)

1. Connect and Reboot the Switch

a. Connect the console cable to the switch. Use these terminal settings:

• Baud rate: 9600
• Data bits: 8
• Parity: None
• Stop bits: 1
• Flow control: None

b. Power cycle the switch (turn it off and back on).

2. Enter ROMMON (Bootloader) Mode

1. While the switch is booting, press and hold the MODE button.
2. Release the button when the SYST LED turns solid amber, then blinks amber.
3. You should see the switch: prompt on your terminal — this confirms you're in ROMMON mode.

3. Instruct the Switch to Ignore the Startup Configuration

At the switch: prompt, type:

switch: SWITCH_IGNORE_STARTUP_CFG=1

Then boot the switch with:

switch: boot

The switch will now boot with the default factory configuration, ignoring the saved credentials.

4. Restore Configuration and Set a New Password

a. Enter privileged EXEC mode:

Switch> enable

b. Load the previous configuration:

Switch# copy startup-config running-config

Confirm when prompted — the switch's hostname should now reflect your saved config.

c. Set a new password:

Option 1: Set enable secret

Switch# configure terminal
Switch(config)# enable secret YourNewStrongPassword123

Option 2: Create a new local admin user

Switch(config)# username admin privilege 15 secret YourNewStrongPassword123

d. Disable config-ignore to ensure normal boot behavior next time:

Switch(config)# no system ignore startupconfig switch all

e. Exit configuration mode:

Switch(config)# exit

5. Save the Configuration

To ensure your changes persist:

Switch# copy running-config startup-config

or simply:

Switch# write memory

(Optional) Reload the switch to verify everything:

Switch# reload

What to Do If Cisco 9300 Password Recovery Is Not Working

If you've followed the steps but are still locked out, you might have run into one of these common issues. Here are the fixes:

▪ Cannot Enter ROMMON Mode

The most common failure point is timing. Ensure you press and hold the MODE button immediately as the switch powers on. If the switch: prompt doesn't appear, don't hesitate to power cycle and try again. It can sometimes take a couple of attempts to get the timing just right.

▪ Password Recovery Disabled

If the message “Password recovery is disabled” appears, configuration recovery isn't possible. You'll need to erase the config completely and reconfigure the switch.

▪ In Stack Mode

If the 9300 is part of a switch stack, this process must be done from the master switch. Connect to the master, reboot the whole stack, and hold the Mode button on the master unit.

▪ SSH Not Working After Recovery

SSH may fail after recovery due to missing crypto keys. Regenerate them with:

Switch(config)# crypto key generate rsa modulus 2048

Best Practices to Avoid Password Recovery Scenarios

• Regular Backups: Always store up-to-date configs on TFTP/SFTP servers or USB drives.
• Use Centralized AAA: Implement TACACS+ or RADIUS to reduce reliance on local passwords.
• Secure Credential Storage: Maintain a secure, encrypted record of all device credentials.

Need Help or Looking to Upgrade?

If you're planning to expand or secure your network, check out our latest deals on the Cisco Catalyst 9300 Series Switches, or contact us for personalized assistance.