Password-recovery mechanism

[chpmotry]

Hi guys .

The SOC administrator in my department told me that, for the purpose of securing the network, I should disable the password recovery service so that no one can access the switch configurations just by having a console cable. But I’m not sure whether disabling this feature might cause problems for me in the future if I ever need to access the ROMmon mode in switches model such as 2960s,2960x,2600,2960G models .please help me what are the problem occurred when i disabling this service"What problems might occur if I disable this feature?

[Leo Laohoo]

---

@chpmotry wrote:
for the purpose of securing the network, I should disable the password recovery service so that no one can access the switch configurations just by having a console cable

---

The most important part about "securing the network" is physical access.  We have several thousands of routers and switches locked behind a Class C cabinet.  If an unauthorized person have access, the configuration of the router or the switch is the least of my worries. 

And finally, disabling password recovery is a two-edged-sword.  Most of the time I've seen have been deployed maliciously.  

[chpmotry]

Thank you, dear colleague @Leo Laohoo .

I’ve been instructed to disable this feature, and I have no problem disabling the password recovery capability.

My main question is: could disabling this feature prevent me from accessing ROMmon mode in case the switch encounters a problem?

[Leo Laohoo]

---

@chpmotry wrote:
could disabling this feature prevent me from accessing ROMmon mode in case the switch encounters a problem?

---

Depends on the OS (IOS vs IOS-XE) and depends on the platform, but, yes.  In some platforms, particularly, classic IOS routers, disabling password-recovery means getting into ROMMON is made more difficult.  

In IOS-XE, disable password-recovery means any attempts to perform password will delete the config of the platform.  

[chpmotry]

Thanks for the clarification. For my use case, it's enough if I can at least access ROMmon in critical situations just to factory-reset the switch configuration. Are you sure that even this minimal level of access could be affected? I just want to make sure that disabling password recovery won’t prevent me from reaching ROMmon when I need to wipe the config.

[Leo Laohoo]

---

@chpmotry wrote:
Are you sure that even this minimal level of access could be affected?

---

I cannot answer this question because I do not know what platform this situation applies to. 

---

@chpmotry wrote:
I just want to make sure that disabling password recovery won’t prevent me from reaching ROMmon when I need to wipe the config.

---

Wut?

If I want to wipe the config of a router, switch, AP or WLC, I do not need to go into ROMMON to do that.  

[chpmotry]

Thank you so much @Leo Laohoo .Most of the switches under my management are model 2960X with IOS version 15.

When the switch encounters a problem loading the NVRAM, the only way to perform software-level troubleshooting is through ROMmon

[Leo Laohoo]

---

@chpmotry wrote:
When the switch encounters a problem loading the NVRAM, the only way to perform software-level troubleshooting is through ROMmon

---

RMA the switch.

[David Ruess]

Security feature functions are always an acceptable risk type of scenario. It all depends on what your organization is willing to accept as the risk. As with what @Leo Laohoo said if the switch is locked in a controlled room where only personnel who are allowed to access the switch has access then it would be fine. However, if it's in a common area or an area where multiple entities have access there may be a security concern. You as a network professional present the facts and scenarios where its needed or not needed. At the end of the day whichever decision is made will be organization policy. If there are any downfalls it will need to be brought up again. For example, if the switch goes down and you couldn't do a password recovery (because you disabled the option) you would have to include that in your report of why it took so long to restore. Again, if the organization is ok with that metric, then that's what you will implement into your procedures.

-David

[chpmotry]

Thank you, dear colleague @David Ruess 
I’ve been instructed to disable this feature, and I have no problem disabling the password recovery capability.
My main question is: could disabling this feature prevent me from accessing ROMmon mode in case the switch encounters a problem?

[David Ruess]

You should still be able to access ROMMON mode for other functions, but the Password recovery in there will likely be inaccessible.