ROMMON Commands: Especially dnld

[cdAMLORcd]

Does anyone have anything more specifc than Cisco provided information on the ROMMON mode and commands? I have seen all of the easily accessible Cisco documents and they are not helpful. I do not know why they do not make the info more available?

I have also tried searching various unix sites with no luck (especially for results on the "dnld" command).

If anyone has successfully used the dnld command, please let me know the terminal emulator that you used; what protocol is used to transfer the binary file and what the largest size of the file can be (and any other useful info).

For those of you wondering why anyone cares about this, on many of the routers made in the 90s, cisco did not include an x/ymodem or tftpdnld unix module in the ROMMON mode. There is only a "dnld" module. However, cisco still allows people to use the erase / delete bootflash: command on these platforms which is pretty much a death blow according to the cisco documentation. I have a hard time believing that. Some of the platforms that I have seen this problem on include the ubr904 and the 4500M and 4700M. I'm sure there are other platforms. The 4500M and 4700M can be fixed by uptaining a working bootflash SIMM and replacing it. However, the ubr904 is toast since bootflash and flash are both on-board!

I'm hoping there are some hardware aces out there that can give some direction or links to specific websites. I couldn't find anything on the web!

One solution I think might work would be to use the dnld command to transfer an "xmodem" or "tftpdnld" unix module to ROMMON and then execute that program. Then you could use normal recovery procedures. However, I haven't been able to get this to work.

Thanks in advance,

[thisisshanky]

Chris what platform are u exactly talking about?

[cdAMLORcd]

The two models that have afflicted me are the 4500M+ and the uBR904. I know the 4500M+ can be fixed by using a working bootflash SIMM from a sister router. However, I would like to try with the "dnld" ROMMON module. The uBR904 has on-board flash and bootflash, so there is no hope of sharing a sister SIMM to fix it. "dnld" is its only hope I think ...

If you search cisco, they will state that these models need to be sent-in for service / replacement. There is no info on field-service but I believe that it is possible.

[thisisshanky]

Dont know if this helps!

there should be a command "boot

The IP address can be IP address of the TFTP server. Connect a cross cable to ethernet port connect it to the PC running TFTP software. Enter the above command and see if the router tries to load the image from TFTP server.

PS: This is just an idea! Not sure it works!

[thisisshanky]

Chris,

You might be lucky if you have the same situation. I spend some time today evening with my c4500 M that I have at home..I have a 12.0.running on the 4500. I reset the router, broke into rommon, tried the boot command, like I suggested in the previous post. It didnt seem to work for some reason..may be I was doing something wrong.

Then I typed "dev" and it listed devices and saw that there was a flash and bootflash along with nvram listed.

A "dir bootflash:" listed that the router had a boot image. This is otherwise known as Rxboot image. There are three images in most routers. A rommonitor program, a Rxboot program and the Cisco IOS which resides in flash.

Set the config register to 0x2101 which makes the router to boot into Rxboot mode using the rxboot image.

Here is a screen capture..

rommon 2 > dev

Devices in device table:

id name

flash: flash

bootflash: boot flash

eprom: eprom

rommon 3 > dir bootflash:

File size Checksum File name

3501020 bytes (0x356bdc) 0x4351 c4500-boot-m.111-7

rommon 4 > confreg 0x2101

rommon 5 > reset

System Bootstrap, Version 5.3(16) [richardd 16], RELEASE SOFTWARE (fc1)

Copyright (c) 1996 by cisco Systems, Inc.

C4500 processor with 32768 Kbytes of main memory

program load complete, entry point: 0x80008000, size: 0x34cec0

Restricted Rights Legend

Use, duplication, or disclosure by the Government is

subject to restrictions as set forth in subparagraph

(c) of the Commercial Computer Software - Restricted

Rights clause at FAR sec. 52.227-19 and subparagraph

(c) (1) (ii) of the Rights in Technical Data and Computer

Software clause at DFARS sec. 252.227-7013.

cisco Systems, Inc.

170 West Tasman Drive

San Jose, California 95134-1706

Cisco Internetwork Operating System Software

IOS (tm) 4500 Software (C4500-BOOT-M), Version 11.1(7), RELEASE SOFTWARE (fc2)

Copyright (c) 1986-1996 by cisco Systems, Inc.

Compiled Wed 23-Oct-96 22:37 by tej

Image text-base: 0x600088A0, data-base: 0x602A0000

cisco 4500 (R4K) processor (revision B) with 32768K/4096K bytes of memory.

Processor board ID 03359716

R4600 processor, Implementation 32, Revision 2.0

G.703/E1 software, Version 1.0.

X.25 software, Version 2.0, NET2, BFE and GOSIP compliant.

2 Ethernet/IEEE 802.3 interfaces.

4 Serial network interfaces.

128K bytes of non-volatile configuration memory.

8192K bytes of processor board System flash (Read/Write)

4096K bytes of processor board Boot flash (Read/Write)

Press RETURN to get started!

framesw(boot)>

framesw(boot)>

framesw(boot)>en

Password:

framesw(boot)#conf t

Enter configuration commands, one per line. End with CNTL/Z.

framesw(boot)(config)#int e0

framesw(boot)(config-if)#ip add 1.1.1.2 255.255.255.0

framesw(boot)#copy tftp flash

System flash directory:

File Length Name/status

1 4748836 c4500-is-mz.120-16.bin

[4748900 bytes used, 3639708 available, 8388608 total]

Address or name of remote host [255.255.255.255]?

====================================================

Now that you are in Rxboot mode, you can specify an IP to your ethernet interface and use "copy tftp flash" to copy a valid IOS for the 4500 via TFTP.

Hope this procedure works out in restoring your router...

Sankar.

[cdAMLORcd]

Sankar,

Sorry, I didn't see your last post. When I do the dir bootflash: and dir flash: command, I get the dreaded message "the device does not have a valid magic number". This is because someone erased both of them (not me). Why cisco let's people erase both blows my mind!

However, I have used the method above to recover an AS5200 successfully. What I wouldn't do for a working bootflash (RxBoot).

If you want to work in the same environment I'm in, then you can pull the 4MB or 8MB bootflash out of your 4500M (out of the 1st of 3 slots // the other two slots are for regular IOS flash). If you have an extra blank 4 or 8 MB SIMM, put it in. Make sure you label and protect the bootflash. Now you will be in the same (simulated) situation as me except that you sitll would have a valid flash / IOS. So you could cheat and type boot flash: I think...

If you pull all of your hair out, just swap the SIMMs back and confreg 0x2102. Everything should be fine.

Thanks,

Chris

[cdAMLORcd]

The "boot " will only work if you have a legitamite image in bootflash memory because it uses the tftp clinet/server module in the mini-IOS [router(boot)]. The command is typed in ROMMON but is passed (along with the other system values) to the mini-IOS once the system is reset and the POST is completed.

Unfortunately, my bootflash (and the stored mini-IOS) were erased. So when I try this, it shows the start of the boot command followed by the router trying to bring up the mini-ios and failing back to ROMMON.

This brings up some interesting points that I noticed while playing through this scenerio.

1) The router (and I think all other cisco would be the same) is not able to create an ethernet link (light a switch link light) until at least the mini-IOS (boot) is loaded.

2) The only exception to this is the "tftpdnld" ROMMON program module which will allow you to bring up an e0 port and link after setting several IP system values (IP_ADDRESS=, IP_SUBNET_MASK=, TFTF_SERVER=, etc.).

Unfortunetly, there is not a tftpdnld module on many cisco routers. Worse yet, there is not an xmodem module on many of these either!

This challenging problem will require some tricky hardware / firmware solution possible involivng the "dnld" command and more likely, in the end, involving a trash compactor!--well, I hope not :)

Thanks,

Chris