Courseiva
SecurityGlobal Config

enable secret [password]

Sets an encrypted password for privileged EXEC access, replacing the less secure 'enable password' command.

Definition: enable secret [password] is a Cisco IOS global config command. Sets an encrypted password for privileged EXEC access, replacing the less secure 'enable password' command.

Overview

The 'enable secret' command is a fundamental security command in Cisco IOS that sets an encrypted password for privileged EXEC access (enable mode). Unlike the older 'enable password' command, which stores the password in plaintext or weakly encrypted (type 7), 'enable secret' uses a strong MD5-based hash (type 5) by default, making it resistant to dictionary attacks. This command is critical for securing network devices because privileged EXEC mode grants access to all configuration commands, including those that can disrupt or compromise the entire network.

The concept behind it is simple: after a user enters user EXEC mode (often with a login password), they must provide the enable secret password to reach global configuration mode or execute privileged commands like 'show running-config' or 'reload'. Without this password, an attacker gaining user-level access cannot escalate privileges. Network engineers reach for 'enable secret' during initial device setup, security hardening, or when migrating from legacy 'enable password' to meet compliance standards (e.g., PCI DSS, HIPAA).

It is part of a broader security workflow that includes setting console/VTY passwords, SSH, and AAA. Important IOS behavior: the 'enable secret' password is stored in the running configuration as a hashed value (type 5), and it overrides any 'enable password' if both are configured. The command requires privilege level 15 (enable mode) to set.

If you forget the password, you must perform password recovery via the ROMmon boot process. The command does not affect other privilege levels; for granular control, use 'privilege' command or AAA. The password is case-sensitive and can be up to 25 characters.

When you issue 'show running-config', the hash appears as 'enable secret 5 $1$...'.

Syntax·Global Config
enable secret [password]

When to Use This Command

  • Securing remote management access to a router or switch by setting a strong, encrypted enable secret.
  • Complying with security policies that require encrypted storage of privileged mode passwords.
  • Configuring a backup enable password using 'enable password' while 'enable secret' takes precedence.
  • Migrating from plaintext 'enable password' to encrypted 'enable secret' for enhanced security.

Parameters

ParameterSyntaxDescription
passwordWORD (1-25 characters)The plaintext password that will be hashed and stored. It can contain letters, numbers, and special characters. Common mistake: using a weak password or one that matches the 'enable password' (which is less secure). Avoid using dictionary words or common patterns.

Command Examples

Setting a basic enable secret

enable secret MySecret123
Router(config)# enable secret MySecret123
Router(config)#

The command sets the enable secret to 'MySecret123'. No output is shown; the password is stored encrypted in the running configuration.

Verifying enable secret in running config

do show running-config | include enable secret
enable secret 5 $1$v0lY$Zx9cQpV6sG2kLmN8rT4bH.

The output shows the encrypted enable secret (type 5 hash). The '5' indicates MD5 encryption. The hash is the encrypted form of the password.

Understanding the Output

The 'enable secret' command itself produces no output upon successful configuration. To verify, use 'show running-config | include enable secret'. The output shows 'enable secret 5 <hash>', where '5' denotes MD5 encryption (Cisco type 5).

The hash is a one-way encrypted string. If you see 'enable password' without encryption, that indicates a less secure configuration. Always ensure 'enable secret' is set and 'enable password' is not used alone.

In production, the hash should be long and complex; a short hash may indicate a weak password.

Configuration Scenarios

Basic enable secret configuration on a new router

A network administrator is deploying a new Cisco router and needs to set a strong enable secret password to protect privileged EXEC access.

Topology

R1 (standalone)

Steps

  1. 1.Step 1: Enter privileged EXEC mode: Router> enable
  2. 2.Step 2: Enter global configuration mode: Router# configure terminal
  3. 3.Step 3: Set the enable secret password: Router(config)# enable secret Cisco123!
  4. 4.Step 4: Exit and verify: Router(config)# end
  5. 5.Step 5: Test the password: Router# disable, then Router> enable, enter password
Configuration
! Full IOS config block
Router> enable
Router# configure terminal
Router(config)# enable secret Cisco123!
Router(config)# end

Verify: Use 'show running-config | include enable secret' to see the hashed password. Expected output: 'enable secret 5 $1$...'

Watch out: If you also configure 'enable password Cisco123!' (type 7), the 'enable secret' takes precedence. A common mistake is forgetting the password; always store it securely.

Migrating from enable password to enable secret

An existing router uses the older 'enable password' command. The administrator wants to upgrade security by replacing it with 'enable secret'.

Topology

R1 (standalone)

Steps

  1. 1.Step 1: Enter global config mode: R1# configure terminal
  2. 2.Step 2: Remove the old enable password: R1(config)# no enable password
  3. 3.Step 3: Set the new enable secret: R1(config)# enable secret Str0ng!Pass
  4. 4.Step 4: Verify: R1(config)# do show running-config | include enable
Configuration
! Full IOS config block
R1# configure terminal
R1(config)# no enable password
R1(config)# enable secret Str0ng!Pass
R1(config)# end

Verify: Use 'show running-config | include enable'. Expected output: 'enable secret 5 $1$...' and no 'enable password' line.

Watch out: If you forget to remove the old 'enable password', it remains but is overridden. However, it's best practice to remove it to avoid confusion. Also, ensure the new password is not the same as the old one.

Troubleshooting with This Command

When troubleshooting enable secret issues, the primary symptom is being unable to access privileged EXEC mode. Healthy output: after entering 'enable' and the correct password, the prompt changes from 'Router>' to 'Router#'. Problem indicators: 'Password: % Bad secrets' or 'Access denied'.

The command itself does not produce output; instead, you verify its configuration with 'show running-config | include enable secret'. If the hash appears, the password is set. Common symptoms: (1) Forgot password – you cannot enter enable mode; solution is password recovery via ROMmon. (2) Password mismatch – if you recently changed the password but are still using the old one, you get 'Access denied'. (3) Configuration replaced – if someone issues 'no enable secret', the password is removed, and you may fall back to 'enable password' if configured, or no password at all (allowing access).

Diagnostic flow: 1) Attempt to enter enable mode; if denied, check if you have the correct password. 2) If you have physical access, perform password recovery. 3) If you suspect the config was altered, check the running config via console (if possible) or via remote management if you have another admin account. Correlate with other commands: 'show users' shows who is logged in; 'debug aaa authentication' can help if AAA is used. For AAA, the enable secret may be overridden by a AAA server; check 'show aaa servers' and 'show running-config | section aaa'.

In some IOS versions, the hash algorithm can be changed to SHA-256 (type 8) or scrypt (type 9) using 'enable algorithm-type' command; verify with 'show running-config | include enable algorithm'. If you see 'enable secret 0' (type 0), that means the password is stored in plaintext – a serious security issue. Always ensure the hash type is 5, 8, or 9.

CCNA Exam Tips

1.

CCNA exam tip: 'enable secret' overrides 'enable password' if both are configured.

2.

CCNA exam tip: The 'enable secret' uses MD5 hashing (type 5); newer IOS supports type 8/9 (SHA-256).

3.

CCNA exam tip: If you forget the enable secret, you must perform password recovery via ROMmon mode.

4.

CCNA exam tip: The 'service password-encryption' command does NOT affect 'enable secret' (it's already encrypted).

Common Mistakes

Mistake 1: Using 'enable password' instead of 'enable secret', leaving the password in plaintext in the config.

Mistake 2: Setting a weak or easily guessable password for the enable secret.

Mistake 3: Forgetting to save the configuration after setting the enable secret, losing it on reload.

enable secret [password] vs enable password [password]

Both 'enable secret' and 'enable password' configure privileged EXEC access passwords, but they differ in encryption and precedence. They are often confused because both achieve the same functional goal—authentication for enable mode—yet 'enable secret' uses stronger MD5-based hashing and takes priority over 'enable password' when both are configured.

Aspectenable secret [password]enable password [password]
EncryptionMD5 hash (strong encryption)Plaintext (unless service password-encryption is used, which uses weak reversible encryption)
PrecedenceTakes precedence if both are configuredIgnored if enable secret is set
Security LevelHighly secureLow security (vulnerable to sniffing)
Configuration ModeGlobal configurationGlobal configuration
Storage in Running ConfigStored as hashed value (type 5)Stored as plaintext or weak encryption (type 7 if encrypted)

Use enable secret [password] when security is a priority and you need strong, non-reversible password protection for privileged EXEC access.

Use enable password [password] when you must maintain backward compatibility with older devices or scripts that do not support enable secret, but be aware of the security risks.

Platform Notes

In IOS-XE (e.g., Catalyst 9000 switches), the 'enable secret' command works identically to classic IOS. However, IOS-XE also supports 'enable algorithm-type' to choose stronger hashes (sha256 or scrypt). For example: 'enable algorithm-type sha256 secret MyPassword' stores a type 8 hash.

The output in 'show running-config' shows 'enable secret 8' or 'enable secret 9'. In NX-OS (e.g., Nexus switches), the equivalent command is 'enable secret [0|5] [password]' where 0 is plaintext and 5 is MD5. NX-OS also supports 'enable password' but 'enable secret' is recommended.

The syntax is: 'configure terminal ; enable secret 5 <password>'. In ASA (Adaptive Security Appliance), the command is 'enable password <password> [encrypted]' but it uses a different hash (type 4 or type 6). ASA does not have 'enable secret'; instead, use 'enable password' with the 'encrypted' keyword if you want to paste a pre-hashed value.

In IOS-XR, the command is 'admin secret [password]' or 'secret [password]' under the admin plane. IOS-XR uses a different privilege model; the 'enable' command is not used in the same way. For classic IOS versions: 12.x and 15.x support type 5 hashes; 16.x (IOS-XE) adds type 8 and 9.

Always check the specific platform documentation for hash algorithm support.

Related Commands

enable password [password]

Sets a plaintext password for privileged EXEC access in global configuration mode, used when no enable secret is configured.

service password-encryption

Enables Cisco Type 7 (Vigenère cipher) encryption for all plaintext passwords stored in the running configuration, including line passwords, CHAP passwords, and username passwords not already using stronger hashing.

show running-config

Displays the current active configuration in DRAM, showing all non-default settings.

Practice for the CCNA 200-301

Test your knowledge with practice questions covering all CCNA 200-301 exam domains.

Practice CCNA 200-301 Questions