How to configure level 9 enable secret on IOS-XE

[Ricky Sandhu]

Hi everyone, need some advice. Recently upgraded IOS-XE to version 16.12.x (Gibraltor) and it removed my enable secret which was using level 5 encryption. Looks like this version of IOS-XE doesn't support level 5 secrets and removes all credentials that use these.   How can I configure enable secret with level 9 encryption before I upgrade the IOS to the new version? When I type enable secret 9 ... it is asking to specify a SCRYPT HASHED secret. However if I type enable secret followed simply by the password, it again encrypts it with level 5 by default.

[M02@rt37]

Hello @Ricky Sandhu 

If a device is upgraded from Cisco IOS XE Fuji 16.9.x, Cisco IOS XE Gibraltar 16.10.x, or Cisco IOS XE Gibraltar 16.11.x to Cisco IOS XE Gibraltar 16.12.x, the type 5 secret is auto-converted to convoluted type 9 secret. After the device is upgraded, run the write memory command in privileged EXEC mode for the convoluted type 9 secret to be permanently written into the startup configuration.

=> Plain text passwords are converted to nonreversible encrypted password type 9.

[MHM Cisco World]

https://defaultgateway.org/2021/08/28/move-to-type-9-password/

check this link 

NOTE:- please dont WR config until you sure that the password is work and can access to config+t, in case the password is not work you can reload and return to point before config enable type 9 password 

thanks and be careful 
MHM

[liviu.gheorghe · Accepted solution]

Hello @Ricky Sandhu ,

to configure the enable password with level 9 encryption, use the following command:

enable algorithm-type scrypt secret 

[Ricky Sandhu]

THank you all for your valuable input.  @liviu.gheorghe this is exactly what I needed.  

Also thanks to M02@rt37 and @MHM Cisco World for your input.  

[MHM Cisco World]

You are so welcome friend 

MHM

[shekhawatakash20]

what is pre-requisites for enable secret 9?

can we configure on asr1001x? 

[Devaa]

I just validated in one of the ASR1000 models, the cmd is available. It should work as expected. 

enable algorithm-type scrypt secret <secret-password>