# ROMMON

> Source: Courseiva IT Certification Glossary — https://courseiva.com//glossary/rommon

## Quick definition

ROMMON is like a basic startup program on Cisco routers and switches. It's stored in read-only memory and kicks in when the device first powers on or when the main operating system (IOS) can't load. You can use it to fix boot problems, recover lost passwords, or perform low-level diagnostics. It has a simple command-line interface that is different from the normal Cisco IOS commands.

## Simple meaning

Imagine your Cisco router is like a car with a sophisticated computer system that runs all the features like navigation, music, and performance control. That's the main IOS operating system. Now, what happens if that main computer system crashes or gets corrupted? You can't start the car properly, and the fancy dashboard doesn't work. ROMMON is like a tiny, simple computer built into the car's engine bay that only knows how to do a few basic things: check the fuel level, turn the starter motor, and maybe read a simple code from a diagnostic plug. It's not powerful enough to run the navigation or music, but it can get the engine running just enough to get the car to a mechanic.

For a Cisco router, ROMMON stands for Read-Only Memory Monitor. It's a very basic software program stored in a special chip (ROM) on the router's motherboard. When the router is powered on, it doesn't jump straight into the full IOS. First, it checks its hardware, then looks for ROMMON instructions. ROMMON's main job is to check if a valid IOS image exists on the flash memory or a TFTP server, and if so, load it into RAM and hand control over to it. If the IOS is missing or damaged, ROMMON stays in control, giving you a limited command prompt (usually 'rommon 1 >') from which you can issue commands to boot from a network server, format flash, or perform password recovery.

So, ROMMON is your router's emergency starter motor and diagnostic mode. It's not where you configure routing protocols or VLANs. It's where you go when something goes wrong with the main OS, or when you need to perform a low-level task like resetting the register value to bypass the startup configuration. Understanding ROMMON is crucial for network engineers because it's the last line of defense when a router becomes unbootable due to a corrupted IOS, a forgotten enable password, or a misconfigured boot system command.

## Technical definition

ROMMON, which stands for Read-Only Memory Monitor, is a low-level diagnostic and boot loader firmware program embedded in a non-volatile ROM (Read-Only Memory) chip on Cisco routers and some Catalyst switches. It is the first code executed by the CPU immediately after a hardware reset or power-on self-test (POST). The primary role of ROMMON is to provide a minimal set of instructions necessary to initialize the hardware, particularly the processor and memory subsystems, and to locate, load, and transfer execution control to a full Cisco IOS software image.

Technically, ROMMON is a stripped-down operating system that operates independently of the main IOS. It has its own command-line interface (CLI), which is distinctly different from the IOS CLI. The ROMMON CLI uses a 'rommon 1 >' prompt and offers a limited set of commands focused on boot management, memory inspection, and basic I/O operations. Common ROMMON commands include 'boot' to manually load a specified IOS image, 'set' to display or set environment variables like the boot device or TFTP server IP, 'confreg' to modify the configuration register value, and 'tftpdnld' to download an image via TFTP from a network server.

The boot process typically unfolds as follows: Upon power-up, the CPU fetches the first instruction from the ROM, which points to the ROMMON code. ROMMON performs POST, checking basic hardware components like RAM and the CPU. It then reads the configuration register value, usually set via the 'config-register' global configuration command in IOS or modified in ROMMON with 'confreg'. The configuration register is a 16-bit value stored in NVRAM. Its most significant nibble controls the boot behavior. For example, the default value is 0x2102, which tells ROMMON to look for a valid IOS in flash memory or by netboot. A value of 0x2142 tells ROMMON to ignore the startup configuration during boot, which is essential for password recovery. A value of 0x2100 forces ROMMON to stay at the ROMMON prompt without attempting to load IOS.

After reading the configuration register, ROMMON attempts to boot the IOS image based on the boot system commands stored in the startup configuration or the environment variables. It can boot from flash memory, a TFTP server (netboot), or even from a USB port on newer platforms. If a valid IOS image is found, ROMMON decompresses it into RAM and jumps to its entry point, handing control over to the IOS. If no valid IOS is found, or if the configuration register is set to boot into ROMMON, the device stays at the ROMMON prompt indefinitely, awaiting user intervention.

In real IT implementation, network engineers use ROMMON for several critical tasks: recovering from a corrupted or missing IOS image by downloading a new one via TFTP, performing password recovery on devices where the enable password is lost, changing the boot parameters to troubleshoot boot loops, and performing low-level file system operations like formatting flash memory. Different Cisco platforms have different ROMMON versions, and while the core concept is the same, specific commands can vary (e.g., the 'tftpdnld' command is common on older 2600/3600 series, while newer ISR routers use a menu-driven ROMMON interface with options like 'tftp' or 'flash').

From an exam perspective, especially for CCNA, understanding ROMMON is essential for the password recovery procedure and the boot sequence section. Students must memorize the default configuration register value (0x2102), the password recovery value (0x2142), and the step-by-step process of interrupting the boot process (often by pressing Ctrl+Break during power-on) to enter ROMMON mode. Additionally, knowing how to set the configuration register correctly and how to boot an IOS image manually are common exam objectives.

## Real-life example

Imagine you have a modern smart refrigerator. It has a big touchscreen on the door, connects to Wi-Fi, manages your grocery list, and even suggests recipes. That whole software ecosystem is like the Cisco IOS. One day, a power surge corrupts the software on the refrigerator’s main computer. The touchscreen goes black, the chiller stops working, and you can't even see the temperature. Your refrigerator is essentially 'bricked' for its normal functions.

Now, inside the refrigerator's motherboard, there is a tiny, unbreakable emergency chip – think of it as a secret diagnostic mode. You have a hidden service manual that tells you how to access it by holding down two specific buttons on the back of the unit while plugging it in. When you do that, a tiny, green text-only screen appears on a hidden LCD panel. This screen doesn't show the temperature or your grocery list. It just shows a basic cursor and a few commands: 'LOAD from USB', 'FORMAT memory', 'RUN basic motor test'. It asks you questions like 'What is the speed of the compressor fan?' or 'Enter the serial number of the new mainboard'. This is the ROMMON for your refrigerator.

This emergency mode is extremely simple. It can only perform a few actions. For example, if you insert a USB stick containing a new touchscreen software image, you can type the command to load it. Once the new software is loaded, the refrigerator restarts, the touchscreen lights up with the brand logo, and it goes back to managing your groceries. In this analogy, the USB stick is the TFTP server with the IOS image, and the hidden LCD menu is the ROMMON prompt. You only ever need to use this emergency mode when the main software is broken. Normal day-to-day operation never requires it. Just like a network engineer only enters ROMMON when a router's IOS is corrupted or when they need to reset a lost password, you only use the refrigerator's hidden menu in a crisis. It's the lowest-level way to interact with the device's hardware, bypassing all the fancy user-friendly features to perform a fundamental repair.

## Why it matters

For network professionals, ROMMON is a critical safety net. Routers and switches are the backbone of modern networks. When a core router loses its OS due to a flash corruption during a power failure or an interrupted upgrade, the entire network segment goes down, affecting hundreds or thousands of users. Without ROMMON, that device would be a brick, requiring a replacement and a long outage. ROMMON provides the ability to reload the IOS via a TFTP server, often restoring service within minutes instead of hours. This capability directly impacts network uptime and service level agreements (SLAs).

Second, ROMMON is indispensable for password recovery. Enable passwords and secret passwords protect the privileged EXEC mode on Cisco devices. When a network engineer leaves an organization without handing over the password, or when a password is mistakenly forgotten, the entire device configuration becomes inaccessible. ROMMON allows you to bypass the startup configuration (by changing the config register to 0x2142) and boot the IOS without loading the password. Then, you can reload the configuration and reset the password. This is a standard operational procedure that every network administrator must know, as it's a routine requirement in change management and asset recovery.

Third, ROMMON plays a role in troubleshooting boot issues. A router that reboots repeatedly (boot loop) might have a corrupt configuration, a bad hardware module, or a misconfigured boot system command. By entering ROMMON, you can execute memory tests, examine the flash file system, and boot the IOS manually to isolate the problem. For example, you can boot the IOS and then not load the startup configuration to check if the config itself is causing the loop.

Finally, understanding ROMMON deepens your knowledge of the Cisco device boot process. This is not just a trivia point; it affects how you design backup and recovery procedures. For instance, knowing that the router can netboot from a TFTP server allows you to set up a network boot server as a fallback in case local flash fails. In large enterprise environments, this is a common practice for automatically recovering from failed software upgrades. ROMMON is, therefore, not just a feature for emergencies; it is a fundamental component of a resilient network infrastructure.

## Why it matters in exams

ROMMON is a staple topic in the CCNA (200-301) and CCNP ENCOR (350-401) exams, although it appears more frequently at the CCNA level. In the CCNA exam, it is directly tied to the 'Cisco Device Management' and 'Network Fundamentals' domains, specifically under 'Configure and verify Cisco device management' and 'Troubleshoot Cisco device boot failures'. The exam expects candidates to know the boot sequence steps, the role of ROMMON, and the configuration register's function.

Specifically, in CCNA, you will encounter questions related to password recovery procedures. The exam might present a scenario where a network administrator is locked out of a router, and you must select the correct sequence of steps to recover the password, which inevitably involves interrupting the boot process to enter ROMMON, changing the configuration register to 0x2142, booting the IOS, resetting the password, and reverting the register. Another common question type involves the boot process: 'A router does not load IOS after power-on. What is the most likely cause and how do you proceed?' The answer will involve ROMMON and checking for a valid IOS in flash.

You must be able to interpret the ROMMON prompt. The exam may not ask you to type 'rommon 1 >', but you might see a command-line scenario showing 'rommon 1 > boot tftp://10.1.1.10/c2600-advipservicesk9-mz.124-15.T14.bin' and ask what the device is currently running. The ability to recognize ROMMON commands like 'confreg', 'set', and 'boot' is also tested. For the CCNP ENCOR exam, the scope widens to include more advanced troubleshooting of boot failures using ROMMON, such as dealing with ROMMON variables for netboot or understanding how ROMMON interacts with the BOOT environment variable.

A crucial exam objective is the configuration register default and its bits. You must know that the default is 0x2102 (or 0x102 on older platforms), which boots from flash. You must know that 0x2142 ignores the startup-config during boot, and 0x2100 forces the router into ROMMON. Furthermore, you should understand that the configuration register can be set in IOS using the 'config-register' global command, or in ROMMON using the 'confreg' command, which presents a series of prompts to set the bits. The exam might ask a simulation or multiple-choice question like 'Which configuration register value causes the router to load IOS but not load the startup configuration file?' with the correct answer being 0x2142.

Finally, do not underestimate the importance of the key combination to enter ROMMON (Ctrl+Break during power-on). A common drag-and-drop or put-in-order question will require you to sequence the steps: power-cycle the router, send a break signal (Ctrl+Break) within 60 seconds, wait for the ROMMON prompt, change config register, and then reload. A surprise variation is that on some platforms (like when using a terminal server), the break signal might be different. Knowing that the ROMMON environment is unique and does not support IOS commands is also a common exam trap.

## How it appears in exam questions

Exam questions about ROMMON generally fall into three categories: conceptual understanding, step-by-step troubleshooting, and command recognition.

Scenario: 'A network administrator accidentally deleted the IOS image from flash on a Cisco 4321 router. Which mode should the administrator use to recover the IOS?' The answer is ROMMON. This tests your understanding that when no valid IOS is found, the device stays in ROMMON, and from there you can use the tftpdnld command (or menu options) to download a new image. A follow-up question might ask which protocol is used to transfer the image (TFTP).

Scenario: 'An administrator has forgotten the enable password on a Cisco 2960 switch. The administrator power-cycles the switch and holds down the Mode button. What is the next step?' This is a password recovery scenario. The mode button on a Catalyst switch is the equivalent of sending a break signal. The switch boots into a limited ROMMON-like environment (often called switch: prompt). Then the administrator must initialize the flash, rename the config file, and boot. Cisco routers typically use Ctrl+Break rather than a button.

Config Register: 'What does changing the configuration register to 0x2142 accomplish during password recovery?' Answer: It causes the router to boot IOS but skip loading the startup configuration file, allowing the administrator to access the router with no password. A more specific variant might ask: 'After password recovery, why must the administrator change the configuration register back to 0x2102?' Answer: To ensure the router boots normally from flash on subsequent reboots.

Boot Sequence: 'Place the following boot stages in the correct order: 1. Load IOS from flash, 2. Power-on self-test, 3. Execute ROMMON, 4. Load startup configuration.' The correct order is 2 (POST), 3 (ROMMON), 1 (Load IOS), 4 (Load startup-config). This shows you understand where ROMMON fits in the boot process.

Command Recognition: 'An engineer is at the 'rommon 1 >' prompt. Which command allows the engineer to view the current environment variables?' The answer is 'set'. A variation might ask about 'confreg' which allows modification of the configuration register. Another: 'Which ROMMON command is used to start the TFTP download process?' The answer is 'tftpdnld' on older platforms, but on newer ISR routers, it's a menu option like 'tftp' after typing 'boot'.

Troubleshooting: 'A router continuously reboots. The administrator is unable to see the IOS initialization messages. What could be the cause and what mode should be used to investigate?' This suggests a possible boot loop caused by a corrupt IOS. The answer involves entering ROMMON (by sending a break signal) to examine the flash file system and attempt a manual boot.

Simulation: In a lab simulation, you might be given a scenario where a router boots to the 'rommon 1 >' prompt. The question might be: 'Use the appropriate ROMMON command to boot the IOS image file named 'c1100-universalk9-mz.SPA.159-3.M' located in flash. Then view the running configuration and set the hostname to 'RecoveredRouter'. Steps: First, you would type 'boot flash:c1100-universalk9-mz.SPA.159-3.M' or 'boot' with the correct filename. Then, after IOS loads, you would enter enable mode and configure the hostname.

## Example scenario

A CCNA candidate is practicing on a real Cisco 2811 router in their home lab. They accidentally delete the startup configuration file using the 'erase startup-config' command and then reload the router. After the reload, the router boots normally (because the IOS is fine) and presents the 'would you like to enter the initial configuration dialog?' prompt. They answer 'no', get a basic prompt, and decide to set a new enable password. They type 'enable secret cisco123' and then try to save it with 'copy running-config startup-config'. However, they make a typo and accidentally issue 'copy running-config flash' which succeeds but also corrupts the flash memory index, causing the IOS image to be partially overwritten. They don't notice this.

The next day, they come back to the lab, power on the router, and the router does not boot normally. Instead, after the POST LED test, the console shows a message like 'System Bootstrap, Version 12.4(11r) ...' followed by 'attempting to boot from flash ...'. After a few seconds, the screen goes blank and then displays 'rommon 1 >' prompt. The student has a problem: the IOS is missing or corrupt. This is a classic ROMMON scenario.

Now, the student must use ROMMON to recover the IOS. They have a TFTP server running on their laptop with a copy of the same IOS image. They connect the router's FastEthernet0/0 port to their laptop with an Ethernet cable and configure a static IP address on their laptop (e.g., 192.168.1.2). At the 'rommon 1 >' prompt, they need to set environment variables: IP address of the router interface (e.g., 'ROMMON> IP_ADDRESS=192.168.1.1'), subnet mask ('ROMMON> IP_SUBNET_MASK=255.255.255.0'), default gateway ('ROMMON> DEFAULT_GATEWAY=192.168.1.2'), and the TFTP server address ('ROMMON> TFTP_SERVER=192.168.1.2'). Finally, they set the IOS filename ('ROMMON> TFTP_FILE=c2800nm-advipservicesk9-mz.124-15.T14.bin'). Then they type the command 'tftpdnld' to start the download. The router downloads the IOS image and stores it in flash. Finally, they type 'boot' to load the new IOS, and the router boots up normally.

This scenario is directly from real-world lab experiences. The student learns that ROMMON is not just a theoretical concept but a practical emergency tool. It also highlights the importance of having a TFTP server and a backup IOS image available in the same network segment as the router.

## Common mistakes

- **Mistake:** Thinking ROMMON is an IOS mode you can access from the enable prompt, like global configuration mode.
  - Why it is wrong: ROMMON is a separate, low-level firmware environment that runs before IOS is loaded. You cannot type 'rommon' at the enable prompt to enter it. You must interrupt the boot process or power-cycle the device and send a break signal.
  - Fix: Remember that ROMMON is a completely separate operating system that exists in ROM. Access it by sending a break signal (Ctrl+Break) during the first 60 seconds of booting, not by typing a command in IOS.
- **Mistake:** Believing that copying an IOS image while the device is in ROMMON can be done using 'copy tftp flash' like in IOS.
  - Why it is wrong: ROMMON does not support IOS commands like 'copy'. It has its own limited command set, such as 'tftpdnld' or a boot menu with 'tftp' option. You must use the specific ROMMON commands or menu options to transfer files.
  - Fix: Learn the ROMMON-specific commands for file transfer. On older platforms, use the 'tftpdnld' command. On newer ISR routers, typically you enter the 'boot' command and then select the 'tftp' option from the menu. Never use 'copy' in ROMMON.
- **Mistake:** Assuming that changing the configuration register in ROMMON (with 'confreg') automatically saves the change permanently.
  - Why it is wrong: The 'confreg' command in ROMMON prompts you to answer questions about boot behavior and then informs you that you must reset or power-cycle the router for the changes to take effect. The new value is written to NVRAM by the ROM monitor, but it is not immediately active.
  - Fix: After using 'confreg' in ROMMON, you must type 'reset' or 'i' to reload the router. The configuration register change only becomes active after a reboot. Similarly, after password recovery, you need to set the register back to 0x2102 in IOS using 'config-register' and then save and reload.
- **Mistake:** Confusing ROMMON with ROMmonitor mode for switches (switch: prompt).
  - Why it is wrong: While both are low-level recovery environments, ROMMON is used on routers and some high-end switches, and uses a 'rommon 1 >' prompt. Catalyst switches (like 2960, 3650) use a different environment called 'switch:' prompt with different commands (like 'flash_init', 'rename', 'set'). They have similar purposes but are not identical.
  - Fix: Know the platform difference. For Cisco routers, look for the 'rommon' prompt. For Catalyst switches, look for 'switch:' or 'bootloader>' prompt. The commands are different. For switches, you typically need to load an IOS from the switch: prompt using commands like 'boot flash:/c2960-lanbasek9-mz.150-2.SE.bin'.
- **Mistake:** Thinking that ROMMON only exists on older routers and is not present on modern hardware.
  - Why it is wrong: All Cisco routers and many switches have a ROM monitor. Its interface may differ (some use a more sophisticated menu-based ROM Monitor on ISR 4K routers), but the fundamental concept remains. Even the latest ISR 1100 and 4300 series have ROMMON, accessible via a similar break signal.
  - Fix: Understand that ROMMON is a constant across Cisco platforms, but its user interface can vary. Always check the platform documentation for the exact ROMMON commands. The underlying purpose—low-level recovery—is universal.

## Exam trap

{"trap":"When performing password recovery on a router, the candidate changes the configuration register to 0x2142, reloads the router, and then immediately configures a new enable secret and reloads again, without first copying the running configuration to startup configuration or resetting the config register back to 0x2102.","why_learners_choose_it":"Learners see that after booting with 0x2142, they are able to access the router and set a new password. They think the job is done and wrongly believe the configuration register will revert automatically or that it's safe to leave it at 0x2142. They may also forget to reload the startup configuration from the backup (which was ignored).","how_to_avoid_it":"Follow the correct password recovery procedure: After booting with 0x2142, copy the startup configuration to running configuration (copy startup-config running-config), or manually view and re-apply it. Then change the config register to the default 0x2102 (using 'config-register 0x2102' in global config). Save the configuration to startup (write memory). Only then reload. This ensures the router boots normally with the original configuration (minus the old password) and a proper config register."}

## Commonly confused with

- **ROMMON vs Bootloader (switch: prompt):** ROMMON is the firmware environment on routers. The bootloader (switch: prompt) is the equivalent on Catalyst switches. While both serve the same purpose—low-level recovery and boot—their command sets differ. ROMMON uses 'confreg', 'tftpdnld', 'boot'. The switch bootloader uses 'flash_init', 'rename', 'set', and 'boot flash:filename'. (Example: On a router, you enter ROMMON by Ctrl+Break. On a Catalyst 2960, you enter switch bootloader by holding the Mode button while powering on.)
- **ROMMON vs IOS image (flash):** The IOS image is the full operating system stored in flash memory. ROMMON is a tiny, pre-installed firmware in ROM. ROMMON loads the IOS. They are not the same; ROMMON exists even if the IOS is deleted. The IOS provides full network configuration capabilities; ROMMON provides only basic boot and recovery commands. (Example: If you delete the IOS file from flash, ROMMON is still there. The router will boot to a 'rommon 1 >' prompt. You cannot configure VLANs or routing from ROMMON; you must first load the IOS image.)
- **ROMMON vs Configuration Register:** The configuration register is a 16-bit value in NVRAM that tells ROMMON how to boot. It is not an environment. ROMMON reads the configuration register. Changing the register (e.g., to 0x2142) is a task performed in ROMMON. The register is a setting; ROMMON is the program that interprets that setting. (Example: Setting the config register to 0x2100 tells ROMMON to stay in ROMMON. ROMMON is the program that obeys that instruction, not the register itself.)
- **ROMMON vs POST (Power-On Self-Test):** POST is a hardware diagnostic routine that runs immediately after power-on, before ROMMON even starts. POST checks the CPU, memory, and essential hardware. ROMMON begins after POST completes. If POST fails, the device will not proceed to ROMMON. They are sequential processes. (Example: If a RAM stick is bad, POST will fail, and you will never see a ROMMON prompt. The device might just power on with no console output.)

## Step-by-step breakdown

1. **Power-On and POST (Power-On Self-Test)** — When the router is powered on, the CPU starts executing its microcode. A built-in diagnostic routine called POST checks the basic hardware integrity: CPU, RAM, and motherboard components. If POST fails (e.g., bad RAM), the router halts and usually blinks the system LED in a pattern. If POST passes, control is passed to the program stored in the ROM chip, which is ROMMON.
2. **ROMMON Initialization** — ROMMON takes control of the system. It initializes the console interface, allowing you to see output on the terminal. It also sets up a minimal memory map and starts its own command-line interface. At this point, no network interfaces are fully operational for routing, but ROMMON can often use a single interface for TFTP if needed.
3. **Read Configuration Register** — ROMMON reads the 16-bit configuration register stored in NVRAM. The default value is 0x2102, which means ROMMON should look for a bootable IOS image in flash memory or from a network server. If the value is 0x2100, ROMMON stops and waits for user commands at the rommon prompt. If it is 0x2142, ROMMON will boot the IOS but instruct the IOS to ignore the startup configuration file.
4. **Locate and Load the IOS Image** — Based on the configuration register and the 'boot system' commands from the startup configuration (if accessible), ROMMON attempts to find a valid Cisco IOS image. It typically checks the first file in flash memory. If it finds one, it decompresses the image into RAM. If not found locally, it may attempt to netboot from a TFTP server, using the boot environment variables set by the user (e.g., IP address, TFTP server).
5. **Transfer Control to IOS** — Once the IOS image is fully loaded into RAM and decompressed, ROMMON performs a final integrity check (checksum) of the image. If valid, ROMMON jumps to the entry point of the IOS kernel. The IOS then takes over, initializes all interfaces, loads any modules, and reads the startup configuration file (unless prevented by an altered configuration register). The ROMMON prompt disappears, and the familiar IOS console prompt appears.

## Practical mini-lesson

Understanding ROMMON is not just about memorizing exam facts; it is about having the practical skills to recover a network device that is down. In a professional environment, a router might lose its IOS due to a failed upgrade, a power cut during a write operation to flash, or accidental deletion. Your ability to get that router back online without having to ship it back to Cisco is a measure of your skill.

First, you must know how to initiate a ROMMON session. The classic method is to power-cycle the router and watch the console output. Immediately after the power-on message and before the IOS starts loading, you send a Break signal. On Windows HyperTerminal or Putty, this is typically mapped to 'Ctrl+Break' or a special serial break sequence. If you miss the window, you must power-cycle again. Some newer platforms (like the ISR 4000 series) have a ROMMON menu that appears if you press the Ctrl+Break key at the right moment, or if you set the configuration register to 0x2100 in advance.

Once in ROMMON, the first thing to do is diagnose the problem. If you see the message 'unable to locate valid IOS image', you know the issue is missing or corrupt IOS. Use the 'set' command to view current environment variables. On older platforms like the 2600 series, you need to set variables manually: IP_ADDRESS, IP_SUBNET_MASK, DEFAULT_GATEWAY, TFTP_SERVER, and TFTP_FILE. Then run 'tftpdnld'. On newer ISR routers (e.g., 4331), you can type 'boot' and then 'tftp' from the menu, and it will prompt you for the same parameters in a more guided way.

Another common ROMMON task is password recovery. The procedure: Connect to the console, power-cycle the router, and send a break signal to enter ROMMON. At the rommon prompt, type 'confreg 0x2142' (or use 'confreg' and answer the prompts to set bit 6). Then type 'reset' to reboot. The router will boot IOS but ignore the startup configuration, so you will land at the initial setup prompt with no password. From there, enter privileged EXEC mode (which will be empty), then copy the startup-config into running-config using 'copy startup-config running-config'. This loads the configuration back without the old enable password. Then set a new enable secret, change the config register back to 0x2102 using 'config-register 0x2102' in global configuration, and save with 'write memory'. Finally, reload.

Things that can go wrong during ROMMON operations: Incorrect subnet mask or IP address can cause the TFTP download to fail. Not having the TFTP server running on the same VLAN or segment is another issue. On some platforms, the Ethernet interface might be administratively down in ROMMON, requiring an extra command like 'unlock' or 'enable' specific to that platform. Also, note that modern ROMMON menus often require you to select an interface (like GigabitEthernet0/0/0) and assign an IP address to it as part of the boot menu. Always verify the connection and the TFTP server's reachability.

Finally, for professionals, it's wise to keep a ROMMON cheat sheet for the specific router models in your network. Different models have slightly different commands. For example, on the Cisco 7200 series, the TFTP command is 'tftpdnld' but on the ISR G2 (2900/3900 series), you might use the 'boot' command followed by the 'tftp' option. The key takeaway is that ROMMON is a powerful tool that every network engineer should practice in a lab environment before needing it in production.

## Memory tip

Remember the default config register: 0x2102 (2 1 02) – 2 for 'boot normal', 1 for 'break disabled', 02 for 'console speed 9600'. Change it to 0x2142 (2 1 42) to '4' (ignore NVRAM config) during password recovery.

---

Practice questions and the full interactive page: https://courseiva.com//glossary/rommon