enable password [password]
Sets a plaintext password for privileged EXEC access in global configuration mode, used when no enable secret is configured.
Definition: enable password [password] is a Cisco IOS global config command. Sets a plaintext password for privileged EXEC access in global configuration mode, used when no enable secret is configured.
Overview
The `enable password` command is used in global configuration mode to set a plaintext password that controls access to privileged EXEC mode (also known as enable mode). Privileged EXEC mode is the gateway to all configuration and troubleshooting commands on a Cisco IOS device. Without the correct password, a user remains in user EXEC mode, which offers only limited monitoring commands.
This command is one of the most fundamental security measures on a Cisco router or switch. It is important because it prevents unauthorized users from making configuration changes, viewing sensitive information, or disrupting network operations. The concept behind this command is simple: it stores the password in the running configuration as plaintext, which is a significant security risk.
For this reason, Cisco recommends using the `enable secret` command instead, which stores the password using a one-way hash (MD5 by default). The `enable password` command is still supported for backward compatibility, but it should only be used in environments where security is not a concern, such as lab setups or when the configuration is stored in a secure location. In a production network, you would almost always use `enable secret` because it provides better protection against password theft.
However, there are scenarios where `enable password` might be used: for example, when interoperating with older devices that do not support `enable secret`, or when you need to set a password that is readable by automated scripts (though this is not recommended). The command fits into the broader configuration workflow as one of the first steps in securing a device. After initial access to the device via console or SSH, you typically set the enable password (or secret) to protect privileged mode.
This is often followed by setting line passwords, SSH keys, and other security features. Important IOS behavior: when both `enable password` and `enable secret` are configured, the `enable secret` takes precedence. If only `enable password` is set, the device will prompt for that password.
The password is case-sensitive and can contain alphanumeric characters, but spaces are not allowed. The command immediately takes effect; there is no need to reload. The password appears in the running configuration as `enable password <password>` in plaintext, which is why it is a security risk.
To view the running configuration, you must already be in privileged EXEC mode, so the password is not exposed to unauthenticated users. However, if the configuration is backed up or displayed on a screen, the password is visible. The `service password-encryption` command can be used to encrypt the password in the configuration, but this uses a weak reversible encryption (type 7) and is not considered secure.
For better security, always use `enable secret` with a strong password. The command is available in all IOS versions and is a core part of the Cisco IOS security model.
enable password [password]When to Use This Command
- Configuring a simple password for lab or test environments where encryption is not required.
- Setting an initial enable password on a new router before upgrading to enable secret.
- Providing a fallback password for older IOS versions that do not support enable secret.
- Quickly securing privileged mode in a non-production network.
Parameters
| Parameter | Syntax | Description |
|---|---|---|
| password | password-string | The plaintext password that will be required to enter privileged EXEC mode. It can be any combination of alphanumeric characters, up to 25 characters in length. Spaces are not allowed. The password is case-sensitive. Common mistakes include using weak passwords (e.g., 'cisco' or 'password') or forgetting that the password is stored in plaintext, which can be a security risk if the configuration is viewed by unauthorized personnel. |
Command Examples
Setting a basic enable password
Router(config)# enable password cisco123Router(config)#
No output is displayed; the command is executed silently. The password 'cisco123' is now set for privileged EXEC access.
Verifying the enable password configuration
Router# show running-config | include enable passwordenable password cisco123
The running configuration shows the password in plaintext. This is a security risk; use 'enable secret' instead.
Understanding the Output
The 'enable password' command does not produce any output upon execution. To verify, use 'show running-config | include enable password' which displays the password in plaintext. In production, this is a security concern because anyone with access to the config can see the password.
Always prefer 'enable secret' which encrypts the password using MD5. The absence of 'enable secret' means the 'enable password' is used for authentication.
Configuration Scenarios
Setting a basic enable password on a new router
A network administrator needs to secure privileged EXEC access on a newly deployed Cisco router in a lab environment where security is not a primary concern. The goal is to set a simple password to prevent accidental changes by unauthorized users.
Topology
R1 (single router, no connections)Steps
- 1.Step 1: Enter privileged EXEC mode: Router> enable
- 2.Step 2: Enter global configuration mode: Router# configure terminal
- 3.Step 3: Set the enable password: Router(config)# enable password LabPass123
- 4.Step 4: Exit configuration mode: Router(config)# end
- 5.Step 5: Verify the configuration: Router# show running-config | include enable password
! Enter global configuration mode Router# configure terminal ! Set enable password Router(config)# enable password LabPass123 Router(config)# end
Verify: Use `show running-config | include enable password` to confirm the password is set. Expected output: `enable password LabPass123`. Alternatively, exit privileged mode and re-enter: `Router# disable`, then `Router> enable`, and you should be prompted for the password.
Watch out: The password is stored in plaintext. If you use `service password-encryption`, it will be encrypted with type 7, which is weak. For production, use `enable secret` instead.
Configuring enable password on a switch for lab use
A student is setting up a lab switch for CCNA practice. They want to set a simple enable password to simulate real-world security, but they are aware that the lab environment is isolated and security is not critical.
Topology
SW1 (single switch, no connections)Steps
- 1.Step 1: Access the switch via console and enter privileged EXEC mode: Switch> enable
- 2.Step 2: Enter global configuration mode: Switch# configure terminal
- 3.Step 3: Set the enable password: Switch(config)# enable password cisco123
- 4.Step 4: Optionally, enable password encryption: Switch(config)# service password-encryption
- 5.Step 5: Exit and verify: Switch(config)# end, then Switch# show running-config | include enable
Switch# configure terminal Switch(config)# enable password cisco123 Switch(config)# service password-encryption Switch(config)# end
Verify: After exiting, test by typing `disable` then `enable`. You should be prompted for the password. Use `show running-config | include enable` to see the encrypted or plaintext password.
Watch out: If you later configure `enable secret`, the `enable password` will be ignored. Also, if you forget the password, you may need to perform password recovery, which requires physical access and a reload.
Troubleshooting with This Command
When troubleshooting issues related to the `enable password` command, the primary concern is usually authentication failure. A healthy output when entering privileged EXEC mode is simply being granted access without any error messages. If the password is incorrect, the device will display `% Bad secrets` or `% Access denied` after three failed attempts (depending on the IOS version).
The key fields to focus on are the password itself and whether it matches what is configured. Common symptoms include users being unable to enter enable mode, which can be due to a forgotten password, a typo in the configuration, or the presence of an `enable secret` that overrides the `enable password`. To diagnose, first check the running configuration with `show running-config | include enable`.
If you see `enable secret 5 <hash>`, then the `enable secret` is in use and the `enable password` is ignored. If you see only `enable password <text>`, then that is the password in use. If you see both, the `enable secret` takes precedence.
Another common issue is that the password may be encrypted with type 7 if `service password-encryption` is enabled; in that case, the configuration shows `enable password 7 <encrypted-string>`. To recover a forgotten password, you must perform password recovery, which involves interrupting the boot process and entering ROMmon mode. On most Cisco routers and switches, you can do this by pressing the Break key during startup, then changing the configuration register to ignore the startup configuration, booting, and resetting the password.
This process is documented in Cisco's password recovery procedures. The `enable password` command itself does not generate logs, but failed authentication attempts may be logged if `login on-failure log` is configured. To correlate with other commands, use `show logging` to see authentication failures.
If you suspect the password is being overridden by an `enable secret`, use `show running-config | section enable` to see both. In summary, troubleshooting `enable password` issues involves verifying the configuration, understanding the precedence of `enable secret`, and performing password recovery if necessary. Always ensure that the password is correctly typed and that there are no hidden characters.
In a lab environment, it is common to set the password to something simple like 'cisco' or 'class', but in production, use strong passwords and prefer `enable secret`.
CCNA Exam Tips
CCNA exam tip: 'enable password' stores the password in plaintext; 'enable secret' uses MD5 hashing and takes precedence.
CCNA exam tip: If both 'enable password' and 'enable secret' are configured, only 'enable secret' is used for authentication.
CCNA exam tip: The 'service password-encryption' command encrypts 'enable password' in the config, but it's weak; 'enable secret' is still preferred.
CCNA exam tip: In the exam, you may be asked to identify the most secure method: always choose 'enable secret'.
Common Mistakes
Mistake 1: Using 'enable password' in production instead of 'enable secret' — exposes password in config.
Mistake 2: Forgetting that 'enable secret' overrides 'enable password' — if both are set, only secret works.
Mistake 3: Typing 'enable password' in user EXEC mode instead of global config mode — command is rejected.
enable password [password] vs enable secret [password]
Both commands set privileged EXEC access passwords, but they differ in security and precedence. They are often confused because both achieve the same functional goal, yet enable secret is strongly recommended over enable password due to its stronger encryption.
| Aspect | enable password [password] | enable secret [password] |
|---|---|---|
| Encryption | Plaintext (or type 7 with service password-encryption) | MD5 hash (type 5) |
| Precedence | Ignored if enable secret is configured | Takes precedence over enable password |
| Configuration | enable password [password] | enable secret [password] |
| Security | Weak (vulnerable to simple decryption) | Strong (one-way hash, resistant to brute force) |
| Typical Use | Legacy or low-security environments | Modern best practice for all deployments |
Use enable password [password] when interacting with legacy devices or scenarios where enable secret is not supported.
Use enable secret [password] for all new configurations to ensure secure privileged EXEC access.
Platform Notes
In Cisco IOS-XE, the `enable password` command behaves identically to classic IOS. The syntax and output are the same. However, IOS-XE devices often run in a more secure posture by default, and Cisco recommends using `enable secret` exclusively.
In NX-OS (used on Nexus switches), the equivalent command is `enable password [0 | 5 | 7] <password>`. The NX-OS syntax allows specifying the encryption type: 0 for plaintext, 5 for MD5 hash, and 7 for Cisco type 7 encryption. For example, `enable password 0 MyPassword` sets a plaintext password, while `enable password 5 <hash>` sets a hashed password.
NX-OS also supports `enable secret` but it is a separate command. On Cisco ASA firewalls, the equivalent command is `enable password <password> [level <level>]` in global configuration mode. The ASA also supports `enable secret` with MD5 hashing.
In IOS-XR, the command is `enable password [0 | 7] <password>` in global configuration mode, but IOS-XR typically uses a different authentication model based on task groups and user roles. The `enable password` command in IOS-XR is used for the root user or for fallback authentication. Between IOS versions, the behavior is consistent, but older versions (12.x) may have slightly different password length limits (up to 25 characters).
In 15.x and 16.x, the limit remains 25 characters. The `service password-encryption` command is available in all versions to encrypt the password in the configuration, but it is not recommended for security. Overall, while the command exists across platforms, the preferred method is always `enable secret` for stronger security.
Related Commands
enable secret [password]
Sets an encrypted password for privileged EXEC access, replacing the less secure 'enable password' command.
service password-encryption
Enables Cisco Type 7 (Vigenère cipher) encryption for all plaintext passwords stored in the running configuration, including line passwords, CHAP passwords, and username passwords not already using stronger hashing.
show running-config
Displays the current active configuration in DRAM, showing all non-default settings.
Practice for the CCNA 200-301
Test your knowledge with practice questions covering all CCNA 200-301 exam domains.
Practice CCNA 200-301 Questions