The documentation set for this product strives to use bias-free language. For the purposes of this documentation set, bias-free is defined as language that does not imply discrimination based on age, disability, gender, racial identity, ethnic identity, sexual orientation, socioeconomic status, and intersectionality. Exceptions may be present in the documentation due to language that is hardcoded in the user interfaces of the product software, language used based on RFP documentation, or language that is used by a referenced third-party product. Learn more about how Cisco is using Inclusive Language.
This document describes the procedure to recover the password on XE-SDWAN.
There are no specific requirements for this document.
The information in this document was created from the devices in a specific lab environment. All of the devices used in this document started with a cleared (default) configuration. If your network is live, ensure that you understand the potential impact of any command.
In XE-SDWAN (version 16.10.3 onward), there is a default one-time admin password due to security reasons which can be easily ignored by the user and potentially can get into a user lock situation.
This is especially dangerous during initial router setup if control connection with vManage controller is not established; you cannot simply attach new template with username and password set.
This article gives a detailed procedure on how to recover.
Username: admin Password: Router#
Sep 23 20:36:03.133: SDWAN INFO: WARNING: Please configure a new username and password; one-time user admin is removed.
This is the new message on the console after login with default admin/admin credentials.
Note: This procedure wipes out the current configuration, so please take a backup of the configuration if possible before you proceed further.
This is an example of how a device gets locked as it ignores the onetime password message from console logs.
rommon 2 > boot bootflash:asr1000-ucmk9.16.10.3a.SPA.bin File size is 0x2f7f66c6 Located asr1000-ucmk9.16.10.3a.SPA.bin Image size 796878534 inode num 17, bks cnt 194551 blk size 8*512 ################################################################################################################################################################################################################################################################################################################################################################################################################################ Boot image size = 796878534 (0x2f7f66c6) bytes <<<<<<<< OUTPUT TRIMMED >>>>>>>>> Press RETURN to get started!
<<<<<<<< OUTPUT TRIMMED >>>>>>>>>
*Sep 23 20:35:33.558: %Cisco-SDWAN-Router-SYSMGR-6-INFO-200017: R0/0: SYSMGR: Started daemon vdaemon @ pid 2218 in vpn 0 *Sep 23 20:35:33.635: %Cisco-SDWAN-Router-TTMD-6-INFO-1200001: R0/0: TTMD: Starting *Sep 23 20:35:33.725: %Cisco-SDWAN-Router-CFGMGR-6-INFO-300001: R0/0: CFGMGR: Starting *Sep 23 20:35:33.823: %Cisco-SDWAN-Router-FPMD-6-INFO-1100001: R0/0: FPMD: Starting *Sep 23 20:35:33.953: %Cisco-SDWAN-Router-FTMD-6-INFO-1000020: R0/0: FTMD: SLA class '__all_tunnels__' added at index '0': loss = 128%, latency = 2147483647 ms *Sep 23 20:35:34.424: %Cisco-SDWAN-Router-FTMD-4-WARN-1000007: R0/0: FTMD: Connection to TTM came up. p_msgq 0x7fe1b3235500 p_ftm 0x9a3020 *Sep 23 20:35:41.475: %DMI-5-INITIALIZED: R0/0: syncfd: process has initialized. *Sep 23 20:35:44.975: %LINEPROTO-5-UPDOWN: Line protocol on Interface Loopback65528, changed state to up *Sep 23 20:35:44.991: %SYS-5-LOG_CONFIG_CHANGE: Buffer logging: level debugging, xml disabled, filtering disabled, size (262144) *Sep 23 20:35:45.025: SDWAN INFO: Received ENABLE_CONSOLE message from sysmgr *Sep 23 20:35:45.025: Console Enabled *Sep 23 20:35:45.025: SDWAN INFO: PNP start, status: success *Sep 23 20:35:45.023: %DMI-5-ACTIVE: R0/0: nesd: process is in steady state. *Sep 23 20:35:45.888: EXEC mode enabled on console User Access Verification Username: admin Password: Router# *Sep 23 20:36:03.133: SDWAN INFO: WARNING: Please configure a new username and password; one-time user admin is removed. *Sep 23 20:36:03.240: %DMI-5-CONFIG_I: R0/0: nesd: Configured from NETCONF/RESTCONF by system, transaction-id 14 Router#exit Press RETURN to get started. User Access Verification Username: admin Password: % Login invalid Press RETURN to get started. User Access Verification Username: Login incorrect Username:
Step 1. Initiate the process with these steps
Note: We recommend 0xA102 because it is less prone to user errors. For example, if you set config register by mistake to 0x800 instead of 0x8000 (two zeros instead of three), the console baud rate is set to 4800 instead of configuration bypass. For more information about configuration registers, please see https://www.cisco.com/c/en/us/support/docs/routers/10000-series-routers/50421-config-register-use.html
Note: In Cisco IOS® XE software, the configuration bypass cannot be done with 0x2142 config register because Cisco IOS® XE SD-WAN software stores configuration in a different way in the Configuration Data Base (CDB) on the flash. From Cisco IOS® XE SD-WAN software 16.10.1, onward, bit 15 can be set to 1 to bypass configuration, hence configuration register is, for example, 0xA102. This is a result of bit 15 at (0x8000) in combination with hex value of default register 0x2102.
3. Reset the box (check the output for the command).
Initializing Hardware ... System integrity status: 90170400 12030117 U System Bootstrap, Version 16.3(2r), RELEASE SOFTWARE Copyright (c) 1994-2016 by cisco Systems, Inc. Current image running: Boot ROM1 Last reset cause: PowerOn Warning: Octeon PCIe lanes not x2 width: sts=0x5011 ASR1001-HX platform with 16777216 Kbytes of main memory rommon 1 > confreg 0x8000 You must reset or power cycle for new config to take effect rommon 2 > i Reset ....... Initializing Hardware ... System integrity status: 90170400 12030117 Trixie configured CaveCreek Link Status reg: Bus/Dev/Func: 0/28/1, offset 0x52, status = 00003011Times left ms:0000005C Initializing DS31408... Read MB FPGA Version: 0x16051716 DS31408 locked to local Oscillator Taking Yoda out of reset... Yoda VID enabled... Crypto enabled... Warning: Octeon PCIe link width not x2: sts=00001001 requesting link retrain Astro enabled... Astro PLL/bandgap init... NP5c out of reset... U System Bootstrap, Version 16.3(2r), RELEASE SOFTWARE Copyright (c) 1994-2016 by cisco Systems, Inc. CPLD Version: 16033009 ASR1001-HX Slot:0 Current image running: Boot ROM1 Last reset cause: LocalSoft Reading confreg 0x8000 Enabling interrupts Initializing SATA controller...done Checking for PCIe device presence... Warning: Octeon PCIe lanes not x2 width: sts=0x5011 done ASR1001-HX platform with 16777216 Kbytes of main memory autoboot entry: NVRAM VALUES: bootconf: 0x0, autobootstate: 0 autobootcount: 0, autobootsptr: 0x0
Step 2. Boot the XE-SDWAN .bin image from rommon.
rommon 3 > boot bootflash:asr1000-ucmk9.16.10.3a.SPA.bin Warning: filesystem is not clean File size is 0x2f7f66c6 Located asr1000-ucmk9.16.10.3a.SPA.bin Image size 796878534 inode num 17, bks cnt 194551 blk size 8*512 ####################################################################################################################################################################################################################################################################################################################################################################################################################################################################################################################### File is comprised of 200 fragments (0%) <<<<<< OUTPUT TRIMMED >>>>>>>> Press RETURN to get started!
<<<<<< OUTPUT TRIMMED >>>>>>>> *Sep 23 20:47:34.124: %Cisco-SDWAN-Router-SYSMGR-6-INFO-200017: R0/0: SYSMGR: Started daemon cfgmgr @ pid 5018 in vpn 0 *Sep 23 20:47:34.125: %Cisco-SDWAN-Router-SYSMGR-6-INFO-200017: R0/0: SYSMGR: Started daemon fpmd @ pid 5019 in vpn 0 *Sep 23 20:47:34.125: %Cisco-SDWAN-Router-SYSMGR-6-INFO-200017: R0/0: SYSMGR: Started daemon ftmd @ pid 5020 in vpn 0 *Sep 23 20:47:34.126: %Cisco-SDWAN-Router-SYSMGR-6-INFO-200017: R0/0: SYSMGR: Started daemon ompd @ pid 5021 in vpn 0 *Sep 23 20:47:34.127: %Cisco-SDWAN-Router-SYSMGR-6-INFO-200017: R0/0: SYSMGR: Started daemon ttmd @ pid 5022 in vpn 0 *Sep 23 20:47:34.127: %Cisco-SDWAN-Router-SYSMGR-6-INFO-200017: R0/0: SYSMGR: Started daemon vdaemon @ pid 5023 in vpn 0 *Sep 23 20:47:34.214: %Cisco-SDWAN-Router-TTMD-6-INFO-1200001: R0/0: TTMD: Starting *Sep 23 20:47:34.307: %Cisco-SDWAN-Router-CFGMGR-6-INFO-300001: R0/0: CFGMGR: Starting *Sep 23 20:47:34.382: %Cisco-SDWAN-Router-FPMD-6-INFO-1100001: R0/0: FPMD: Starting *Sep 23 20:47:34.525: %Cisco-SDWAN-Router-FTMD-6-INFO-1000020: R0/0: FTMD: SLA class '__all_tunnels__' added at index '0': loss = 128%, latency = 2147483647 ms *Sep 23 20:47:41.143: %ONEP_BASE-6-CONNECT: [Element]: ONEP session Application:com.cisco.syncfd Host:Router ID:726 User:a has connected. *Sep 23 20:47:41.997: %DMI-5-INITIALIZED: R0/0: syncfd: process has initialized. *Sep 23 20:47:45.480: %LINEPROTO-5-UPDOWN: Line protocol on Interface Loopback65528, changed state to up *Sep 23 20:47:45.495: %SYS-5-LOG_CONFIG_CHANGE: Buffer logging: level debugging, xml disabled, filtering disabled, size (262144) *Sep 23 20:47:45.534: SDWAN INFO: Received ENABLE_CONSOLE message from sysmgr *Sep 23 20:47:45.534: Console Enabled *Sep 23 20:47:45.534: SDWAN INFO: PNP start, status: success *Sep 23 20:47:45.531: %DMI-5-ACTIVE: R0/0: nesd: process is in steady state. *Sep 23 20:47:45.945: EXEC mode enabled on console
Step 3. Login with default admin credentials.
User Access Verification Username: admin Password: Router# *Sep 23 20:48:16.659: SDWAN INFO: WARNING: Please configure a new username and password; one-time user admin is removed. *Sep 23 20:48:16.767: %DMI-5-CONFIG_I: R0/0: nesd: Configured from NETCONF/RESTCONF by system, transaction-id 14 Router#
Router#sh ver | i Configuration register
Configuration register is 0x8000
Step 4. This is a mandatory step.
Router#request platform software sdwan software reset *Sep 23 20:52:17.400: %INSTALL-5-INSTALL_START_INFO: R0/0: install_engine: Started install activate bootflash:asr1000-ucmk9.16.10.3a.SPA.bin *Sep 23 20:52:23.919: %SYS-7-NV_BLOCK_INIT: Initialized the geometry of nvram Router# *Sep 23 20:52:47.943: %INSTALL-5-INSTALL_COMPLETED_INFO: R0/0: install_engine: Completed install activate PACKAGESep 23 20:53:04.302: Initializing Hardware ... System integrity status: 90170400 12030117 U System Bootstrap, Version 16.3(2r), RELEASE SOFTWARE Copyright (c) 1994-2016 by cisco Systems, Inc. Current image running: Boot ROM1 Last reset cause: LocalSoft Warning: Octeon PCIe lanes not x2 width: sts=0x5011 ASR1001-HX platform with 16777216 Kbytes of main memory File size is 0x00001a47 Located packages.conf Image size 6727 inode num 1120114, bks cnt 2 blk size 8*512 # File size is 0x01e7df8e Located asr1000-rpboot.16.10.3a.SPA.pkg Image size 31973262 inode num 1120126, bks cnt 7806 blk size 8*512 ######################################################################################################################################################################################################################################################################################################################## Boot image size = 31973262 (0x1e7df8e) bytes ROM:RSA Self Test Passed ROM:Sha512 Self Test Passed
<<<<<< OUTPUT TRIMMED >>>>>>>>
*Sep 23 20:57:13.347: %ONEP_BASE-6-CONNECT: [Element]: ONEP session Application:com.cisco.syncfd Host:Router ID:8029 User:a has connected. *Sep 23 20:57:15.226: %Cisco-SDWAN-Router-SYSMGR-6-INFO-200017: R0/0: SYSMGR: Started daemon cfgmgr @ pid 4435 in vpn 0 *Sep 23 20:57:15.227: %Cisco-SDWAN-Router-SYSMGR-6-INFO-200017: R0/0: SYSMGR: Started daemon fpmd @ pid 4436 in vpn 0 *Sep 23 20:57:15.228: %Cisco-SDWAN-Router-SYSMGR-6-INFO-200017: R0/0: SYSMGR: Started daemon ftmd @ pid 4437 in vpn 0 *Sep 23 20:57:15.229: %Cisco-SDWAN-Router-SYSMGR-6-INFO-200017: R0/0: SYSMGR: Started daemon ompd @ pid 4438 in vpn 0 *Sep 23 20:57:15.229: %Cisco-SDWAN-Router-SYSMGR-6-INFO-200017: R0/0: SYSMGR: Started daemon ttmd @ pid 4439 in vpn 0 *Sep 23 20:57:15.230: %Cisco-SDWAN-Router-SYSMGR-6-INFO-200017: R0/0: SYSMGR: Started daemon vdaemon @ pid 4440 in vpn 0 *Sep 23 20:57:15.308: %Cisco-SDWAN-Router-TTMD-6-INFO-1200001: R0/0: TTMD: Starting *Sep 23 20:57:15.391: %Cisco-SDWAN-Router-CFGMGR-6-INFO-300001: R0/0: CFGMGR: Starting *Sep 23 20:57:15.484: %Cisco-SDWAN-Router-FPMD-6-INFO-1100001: R0/0: FPMD: Starting *Sep 23 20:57:15.620: %Cisco-SDWAN-Router-FTMD-6-INFO-1000020: R0/0: FTMD: SLA class '__all_tunnels__' added at index '0': loss = 128%, latency = 2147483647 ms *Sep 23 20:57:16.092: %Cisco-SDWAN-Router-FTMD-4-WARN-1000007: R0/0: FTMD: Connection to TTM came up. p_msgq 0x7f5815c35500 p_ftm 0x9a3020 *Sep 23 20:57:27.380: %DMI-5-INITIALIZED: R0/0: syncfd: process has initialized. *Sep 23 20:57:35.032: %LINEPROTO-5-UPDOWN: Line protocol on Interface Loopback65528, changed state to up *Sep 23 20:57:35.048: %SYS-5-LOG_CONFIG_CHANGE: Buffer logging: level debugging, xml disabled, filtering disabled, size (262144) *Sep 23 20:57:35.081: SDWAN INFO: Received ENABLE_CONSOLE message from sysmgr *Sep 23 20:57:35.081: Console Enabled *Sep 23 20:57:35.081: SDWAN INFO: PNP start, status: success *Sep 23 20:57:35.079: %DMI-5-ACTIVE: R0/0: nesd: process is in steady state. *Sep 23 20:57:35.682: EXEC mode enabled on console
Step 5. Now, once again you are prompted with one-time admin credentials. After this step, do not forget to change the default password. It is recommended to add an additional user also. If you miss this step and get locked out, then you need to repeat all the steps again.
User Access Verification Username: admin Password: Router# *Sep 23 20:58:18.048: SDWAN INFO: WARNING: Please configure a new username and password; one-time user admin is removed. *Sep 23 20:58:18.155: %DMI-5-CONFIG_I: R0/0: nesd: Configured from NETCONF/RESTCONF by system, transaction-id 18 Router#confi Router#config-tr System is still initializing. Wait for PnP to be completed or terminate PnP with the command: pnpa service discovery stop Router#pnpa service discovery stop PNP-EXEC-DISCOVERY (1): Stopping PnP Discovery... Waiting for PnP discovery cleanup .. Router# *Sep 23 20:58:48.997: %PNP-6-PNP_DISCOVERY_ABORT_ON_CLI: PnP Discovery abort on CLI input *Sep 23 20:58:48.999: %DMI-5-SYNC_START: R0/0: syncfd: External change to running configuration detected. The running configuration will be synchronized to the NETCONF running data store. *Sep 23 20:58:54.955: %DMI-5-SYNC_COMPLETE: R0/0: syncfd: The running configuration has been synchronized to the NETCONF running data store. *Sep 23 20:58:54.955: %DMI-5-ACTIVE: R0/0: syncfd: process is in steady state. *Sep 23 20:58:55.150: %DMI-5-CONFIG_I: R0/0: nesd: Configured from NETCONF/RESTCONF by system, transaction-id 181 *Sep 23 20:58:55.676: %Cisco-SDWAN-Router-SYSMGR-5-NTCE-200050: R0/0: SYSMGR: System status solid green (reason: All daemons up) Router# *Sep 23 20:59:00.083: %INSTALL-5-INSTALL_START_INFO: R0/0: install_engine: Started install commit PACKAGE *Sep 23 20:59:00.327: %INSTALL-5-INSTALL_COMPLETED_INFO: R0/0: install_engine: Completed install commit PACKAGE Router#sh ver | i register Configuration register is 0x2102 Router#sh sdwan ver *Sep 23 20:59:12.640: %PNP-6-PNP_DISCOVERY_ABORT_ON_CLI: PnP Discovery abort on CLI input *Sep 23 20:59:12.640: %PNP-6-PNP_DISCOVERY_STOPPED: PnP Discovery stopped (Discovery Aborted)16.10.3a Router# Router#sh sdwan ver 16.10.3a Router# Router#conf Router#config-tr admin connected from 127.0.0.1 with console on Router Router(config)# username admin privilege 15 secret <your password> Router(config)# username sdwan privilege 15 secret <your password> Router(config)# comm Commit complete. Router(config)# *Sep 23 21:00:59.270: %DMI-5-CONFIG_I: R0/0: nesd: Configured from NETCONF/RESTCONF by admin, transaction-id 204 Router(config)# end
Step 6. Verify that you still have access to the device with newly created username and password.
Router#exit Router con0 is now available Press RETURN to get started. User Access Verification Username: admin Password: Router>en Router# Router#exit Router con0 is now available Press RETURN to get started. User Access Verification Username: sdwan Password: Router>en Router#
Revision | Publish Date | Comments |
---|---|---|
3.0 |
08-May-2023 |
Recertification |
1.0 |
21-Oct-2019 |
Initial Release |