When a Cisco router powers on, it doesn't merely load an operating system — it executes a precise, deterministic sequence of hardware checks, boot mode decisions, and image selection processes. For the CCNA 200-301 exam, understanding this boot sequence is essential because it appears in troubleshooting scenarios, password recovery procedures, and IOS upgrade planning. This chapter covers the router boot sequence, including POST, bootloader, configuration register, and IOS image selection, all of which are tested under the 'General CCNA knowledge' objective.
Jump to a section
Imagine your smartphone is a router. When you press the power button, the phone first runs a quick self-test: it checks the battery level, the screen, the touch sensor, and the internal memory. This is like the router's Power-On Self-Test (POST). If the battery is dead or the screen is broken, the phone either won't turn on or will display an error. Similarly, if POST fails on a router, it halts. Next, the phone's bootloader (the low-level software that initializes hardware) kicks in. On Android, this is often called the bootloader or fastboot mode. The bootloader checks for a recovery mode key combination or a normal boot. In a router, the bootloader (ROMMON) checks the configuration register to decide how to boot: from flash, from a TFTP server, or into ROM monitor mode for troubleshooting. The bootloader then locates the operating system (iOS or Android) usually stored in the phone's internal flash memory. If the OS is corrupted or missing, the bootloader may try to download a new OS from a connected PC (like TFTP) or enter recovery mode. Once the OS loads, it initializes drivers, mounts the filesystem, and then reads the user settings — your apps and preferences. In a router, the IOS initializes interfaces, loads the startup configuration from NVRAM, and applies it. If the startup config is missing, the router enters setup mode (like a factory reset phone asking for language and Wi-Fi). The entire process is deterministic: the bootloader reads a small set of variables (the configuration register) to decide which image to load and where to find the configuration. A wrong setting can cause the router to boot into ROMMON repeatedly, just as a wrong bootloader setting can brick a phone.
What is the Router Boot Sequence?
The router boot sequence is the series of steps a Cisco router performs from the moment power is applied until the router is fully operational with its configuration loaded. It is critical for network engineers to understand because it affects system availability, IOS upgrades, password recovery, and troubleshooting. The sequence is controlled by hardware, firmware (ROMMON), and software (IOS).
Step 1: Power-On Self-Test (POST)
When power is applied, the router's hardware performs POST. This is a series of diagnostic tests executed by microcode on the CPU and other hardware components. POST checks the CPU, memory (RAM and NVRAM), and interfaces. If POST fails, the router will not boot; it may output error messages to the console or blink LEDs in a pattern. For example, a failed RAM module can cause a POST failure, and the router will halt. POST is automatic and cannot be bypassed. During POST, the router has no OS loaded yet.
Step 2: Bootloader (ROMMON) Initialization
After POST, the CPU executes the bootstrap program located in ROM (Read-Only Memory). This bootstrap is often called ROMMON (ROM Monitor). ROMMON is a minimal operating system with a command-line interface used for low-level debugging and recovery. The primary job of ROMMON is to initialize the hardware enough to load the IOS image. ROMMON checks the configuration register (a 16-bit value stored in NVRAM) to determine the boot mode. The default configuration register value on most Cisco routers is 0x2102, which tells the router to boot from flash with console break disabled.
Step 3: Configuration Register and Boot Mode
The configuration register is a 16-bit software register that controls boot behavior. Its value is often expressed in hexadecimal (e.g., 0x2102). The low-order four bits (bits 0-3) form the boot field. The boot field determines the source of the IOS image:
0x0000: Boot into ROMMON (ROM monitor mode).
0x0001: Boot the first IOS image from flash.
0x0002-0x000F: Boot from flash with fallback to TFTP, or other options. The default 0x2102 has boot field = 0x2.
Other bits control break key behavior, console speed, and whether to ignore the startup configuration. For example, setting the configuration register to 0x2142 tells the router to ignore the startup configuration (useful for password recovery).
Step 4: Locating and Loading the IOS Image
Once the boot mode is determined, the router searches for a valid IOS image. The search order depends on the boot field:
If boot field = 0x2 (default): The router first checks the BOOT environment variable (set in the startup configuration). If the BOOT variable specifies a filename, the router tries to load that image from flash. If the file is not found or is corrupt, the router falls back to the first valid IOS image found in flash. If no valid image is found in flash, the router tries to boot from a TFTP server (using the network interface). If that fails, the router enters ROMMON.
If boot field = 0x1: The router boots the first IOS image from flash (ignoring the BOOT variable).
If boot field = 0x0: The router boots into ROMMON.
When loading from flash, the router decompresses the IOS image (which is usually compressed) into RAM. The IOS image is typically a .bin file. The router verifies the image's integrity using a checksum.
Step 5: Loading and Initializing IOS
After the IOS image is loaded into RAM, the kernel initializes. The IOS then mounts the filesystem (flash, NVRAM, etc.) and initializes all the hardware interfaces. The router then looks for the startup configuration stored in NVRAM (if the configuration register allows). The startup configuration is a text file that contains all the user-configured commands. If the configuration register is set to ignore NVRAM (e.g., 0x2142), the router skips loading the startup configuration and enters the system configuration dialog (setup mode). If the startup configuration exists and is not ignored, the router loads it line by line, applying the configuration. If no startup configuration exists, the router enters setup mode.
Step 6: Running Configuration and Operational State
Once the startup configuration is loaded, the router is fully operational. The running configuration is now active in RAM. The router begins routing, and interfaces come up according to the configuration. The router may also perform other initialization tasks such as starting routing protocols, loading additional modules, and setting the system clock from NVRAM.
Key Commands for Verification
show version: Displays the IOS version, uptime, configuration register value, and the reason for last reload.
show flash: Lists files in flash memory, including IOS images.
show boot: Displays the BOOT variable and the current boot settings.
show running-config | include boot: Shows the BOOT variable in the running config.
show startup-config: Shows the configuration stored in NVRAM.
Example output of show version:
Router> show version
Cisco IOS Software, C1900 Software (C1900-UNIVERSALK9-M), Version 15.7(3)M3, RELEASE SOFTWARE (fc2)
ROM: System Bootstrap, Version 15.7(3)M3, RELEASE SOFTWARE (fc2)
Router uptime is 1 day, 3 hours, 45 minutes
System returned to ROM by power-on
System image file is "flash0:c1900-universalk9-mz.SPA.157-3.M3.bin"
Last reload type: Normal Reload
Last reload reason: power-on
Configuration register is 0x2102Interaction with Related Protocols
The boot sequence interacts with TFTP if the router fails to find a valid IOS image in flash. It sends a TFTP broadcast request for a file named by the BOOT variable or a default filename. This requires a TFTP server on the network and the router's interface to have an IP address (often configured via DHCP or statically in ROMMON). Additionally, the boot sequence can be affected by the boot system global configuration command, which sets the BOOT variable.
Power on and POST
When you power on the router, it immediately runs Power-On Self-Test (POST). POST is a hardware diagnostic that checks the CPU, memory (RAM, NVRAM), and interfaces. There is no user interaction during POST. If POST fails, the router will not boot; you will see error messages on the console or LEDs indicating the faulty component. For example, if RAM is faulty, the router may display "System Bootstrap, Version..." but then hang. POST is executed by microcode in the CPU and is not configurable.
ROMMON initializes
After POST succeeds, the CPU executes the bootstrap program stored in ROM. This is the ROM Monitor (ROMMON). ROMMON initializes the hardware enough to load the IOS image. It checks the configuration register (stored in NVRAM) to determine the boot mode. The default configuration register value is 0x2102. ROMMON provides a limited command-line interface (e.g., `rommon 1 >`) for debugging and recovery. If the configuration register boot field is 0x0, the router will stay in ROMMON.
Check configuration register
The configuration register is a 16-bit value that controls boot behavior. The low-order 4 bits (boot field) determine the boot source. Use `show version` to see the current value. To change the configuration register, use the global config command `config-register 0x2102`. For example, to bypass the startup configuration (password recovery), set it to 0x2142. The new value takes effect after the next reload. Common values: 0x2102 (normal boot from flash, break disabled), 0x2142 (ignore startup config), 0x2101 (boot first image in flash), 0x2120 (boot from ROM).
Locate and load IOS image
Based on the boot field, the router searches for a valid IOS image. The default boot field (0x2) causes the router to read the BOOT environment variable from the startup configuration. If the BOOT variable is set (e.g., `boot system flash0:c1900-universalk9-mz.SPA.157-3.M3.bin`), the router tries that file. If not found or corrupt, it tries the first valid IOS image in flash. If no image is found in flash, it attempts TFTP boot. If TFTP fails, it enters ROMMON. Use `show boot` to see the BOOT variable. The image is decompressed into RAM.
Initialize IOS and load config
Once the IOS image is loaded into RAM, the kernel initializes hardware, mounts filesystems, and starts processes. The router then looks for the startup configuration in NVRAM. If the configuration register's bit 6 is set (e.g., 0x2142), the startup configuration is ignored. Otherwise, the router loads the startup config line by line. If no startup config exists, the router enters the system configuration dialog (setup mode). After configuration is applied, the router is fully operational.
Verify boot sequence
Use `show version` to verify the IOS image, uptime, and configuration register. Use `show flash` to see the files in flash. Use `show boot` to verify the BOOT variable. If the router is not booting correctly, check the console output during boot. Common issues: wrong configuration register (e.g., stuck in ROMMON), corrupt IOS image, or missing startup config. For example, if the router boots to ROMMON, check the configuration register (should not be 0x0) and try `boot flash:filename` manually.
In an enterprise network, understanding the router boot sequence is crucial for several scenarios. First, during an IOS upgrade, a network engineer must ensure the new image is valid and the boot variable points to it. For example, after copying a new IOS to flash, you set the BOOT variable with boot system flash0:new-image.bin and reload. If the new image is corrupt, the router will fall back to the first valid image in flash (if any) or enter ROMMON. In production, you always keep at least one known-good IOS image in flash to avoid a complete outage. Second, password recovery is a common task. When a router's enable password is lost, you can recover it by changing the configuration register to 0x2142, which tells the router to ignore the startup configuration. After reloading, the router boots with no configuration, allowing you to access privileged EXEC mode (no password required) and then reload with the original configuration register after resetting the password. Third, when deploying routers in remote sites, you might configure them to boot from a TFTP server. This is done by setting the BOOT variable to a TFTP path, but this requires network connectivity and a TFTP server. If the server is unreachable, the router may fail to boot. Therefore, a local fallback image in flash is always recommended. Misconfiguring the configuration register can lead to a router that boots into ROMMON every time (e.g., setting it to 0x0). This can happen accidentally during password recovery if you forget to change it back. In that case, you must manually boot from ROMMON using the boot command and then correct the configuration register. In large networks, the boot sequence also affects the time to bring a router online after a power outage. Routers with larger flash and slower CPUs take longer to decompress the IOS. Planning for this is important for service level agreements.
The CCNA 200-301 exam tests the router boot sequence under the 'General CCNA knowledge' objective. You must know the order of boot steps, the function of the configuration register, and how to interpret show version output. Specific exam topics include:
The boot sequence order: POST -> ROMMON -> locate IOS -> load IOS -> load startup config. You may be asked which step happens first or what happens if a step fails.
Configuration register values: Know that 0x2102 is default, 0x2142 ignores startup config, and 0x0 boots to ROMMON. The exam may give a scenario and ask which register value to use.
BOOT variable: Understand that the BOOT variable (set with boot system) overrides the default flash search order. The exam may ask what happens if the file in BOOT variable is missing.
TFTP boot: Know that if no valid image is in flash, the router tries a TFTP server. The default filename is the same as the BOOT variable or the router's model name.
Common wrong answers:
Candidates often confuse the configuration register with the BOOT variable. The register controls the boot mode; the BOOT variable specifies the image file.
Another trap: thinking that POST loads the IOS. POST is hardware test only; the bootloader (ROMMON) loads IOS.
Some think that the startup configuration is loaded before the IOS. It is loaded after IOS initializes.
Many forget that the configuration register is stored in NVRAM, not flash or RAM.
Calculation traps: None directly, but you may need to convert hexadecimal to binary to understand boot field bits. For example, 0x2102 in binary is 0010 0001 0000 0010, so boot field = 0010 = 2 (default).
Decision rule: For scenario questions about boot failure, always check the configuration register first. If the register is 0x0, the router will stay in ROMMON. If it is 0x2142, the config is ignored. Use show version to see the register and the reason for last reload.
The boot sequence order: POST, ROMMON, locate IOS, load IOS, load startup config.
Default configuration register is 0x2102 (boot from flash, break disabled).
Configuration register 0x2142 ignores startup configuration (used for password recovery).
Configuration register 0x0000 boots into ROMMON.
The BOOT environment variable (set with 'boot system' command) specifies which IOS image to load.
If no valid IOS image is found in flash, the router attempts TFTP boot.
Use 'show version' to view the configuration register and IOS image filename.
These come up on the exam all the time. Here's how to tell them apart.
Configuration Register (0x2102)
Default value on most routers.
Boots from flash normally.
Loads startup configuration from NVRAM.
Break key disabled during boot.
Used in normal operation.
Configuration Register (0x2142)
Used for password recovery.
Boots from flash normally.
Ignores startup configuration (NVRAM).
Break key disabled during boot.
Router boots with no configuration; must be changed back.
Mistake
POST loads the IOS image.
Correct
POST is a hardware diagnostic only; the bootloader (ROMMON) is responsible for loading the IOS image after POST succeeds.
Candidates often assume POST includes loading the OS because that's how a PC works, but in Cisco routers, POST is separate.
Mistake
The configuration register is stored in the running configuration.
Correct
The configuration register is stored in NVRAM and is not part of the running or startup configuration. It is set using the 'config-register' command in global config mode.
Because the register affects boot behavior before the configuration is loaded, it must be stored separately.
Mistake
The BOOT variable is the same as the configuration register.
Correct
The BOOT variable is an environment variable that specifies the IOS image filename; the configuration register controls the boot mode (e.g., from flash, from ROM, ignore config).
Both affect booting, but they are different mechanisms; the register is a hardware-level setting, while the BOOT variable is software-level.
Mistake
If the startup configuration is missing, the router will not boot.
Correct
If the startup configuration is missing, the router will boot normally with a default configuration and then enter the system configuration dialog (setup mode). The router is still operational.
Candidates think the configuration is mandatory, but the router can run without a saved config.
Reveal each answer, then mark whether you got it right. Score 60%+ to unlock the next chapter.
The default configuration register on most Cisco routers is 0x2102. This value tells the router to boot from flash with the break key disabled. It also sets the console speed to 9600 baud. The boot field is 0x2, meaning the router will use the BOOT variable or the first valid image in flash. You can verify this with `show version`.
To change the configuration register, enter global configuration mode and use the command `config-register 0xVALUE`, where VALUE is a 4-digit hexadecimal number. For example, `config-register 0x2142` to ignore startup config. The change takes effect after the next reload. To make it permanent, save the configuration with `write memory`.
If the IOS image is corrupt, the router will fail to decompress or verify it. The router then tries the next valid image in flash (if any). If no valid image exists, it attempts a TFTP boot. If TFTP fails, the router enters ROMMON. To recover, you can manually boot from ROMMON using `boot flash:filename` or copy a new image via XMODEM or TFTP.
The BOOT variable is an environment variable that specifies the exact IOS image file to load from flash or a TFTP server. It is set using the `boot system` global configuration command. For example, `boot system flash0:c1900-universalk9-mz.SPA.157-3.M3.bin`. If the BOOT variable is set, the router will attempt to load that file first. If it fails, it falls back to the default search order.
First, check the configuration register using `show version` from ROMMON (if available) or by inspecting the register value. If it is 0x0, you need to boot manually: type `boot flash:filename` where filename is a valid IOS image. Once booted, change the config register to 0x2102 and save. If no valid image is in flash, you must load one via XMODEM or TFTP from ROMMON.
ROMMON (ROM Monitor) is a minimal firmware that runs from ROM. It provides a command-line interface for low-level debugging and recovery. IOS is the full operating system that provides routing, switching, and management features. ROMMON is used when IOS is not loaded or cannot be loaded. You can identify ROMMON by the prompt `rommon 1 >`.
After. The IOS is loaded into RAM and initializes first. Then, the IOS reads the startup configuration from NVRAM and applies it. If the configuration register is set to ignore NVRAM (e.g., 0x2142), the startup configuration is skipped. This order is important because the IOS must be running to interpret configuration commands.
You've just covered Router Boot Sequence — now see how well it sticks with free CCNA 200-301 practice questions. Full explanations included, no account needed.
Done with this chapter?