Recovering IOS on a 2600 Series
Recovering a corrupt Cisco IOS Image on a modern Cisco Router which includes the 2600 Series or later is significantly easier than the 2500 Series. This lab will discuss and demonstrate the IOS recovery procedure for modern Cisco Routers.
Real World Application
The Cisco 2600 Series Multi-Service router platform is a dying bread as the Cisco 2800 Series has taken its place however the 2600 series continues to be the router of choice when it comes to building your own Cisco Lab. The Cisco 2600 Series ROMMON is very similar to the latest generation routers so this lab will be a valuable lesson.
Lab Prerequisites
- You’ll need a Cisco 2600 Series router or greater that has a corrupt Cisco IOS image or NO IOS image at all. If you wish to simulate this lab you can erase the flash on your device and reboot. Please note that you’ll need to backup the Cisco IOS image prior to erasing it unless you have another image on hand that you wish to load onto the device.
- A console connection to the device is REQUIRED
- You’ll need a TFTP server installed on your PC to restore the image.
Lab Objectives
- Boot the Cisco router into ROM mode by breaking the boot sequence using the keystroke CTRL + Pause Break
- Set the TFTPDNLD variables required to execute the procedure which include IP Address, Subnet Mask, Default Gateway, TFTP Server, TFTP Image name.
- Execute the TFTPDNLD command and load the image into RAM using the -r switch.
- Once booted into Cisco IOS, configure a router so that you may copy a Cisco IOS image from a TFTP server to Flash.
- Once all necessary configuration is done copy the IOS image from the TFTP server to the flash.
- After the copy has completed, reboot the router and verify that the image boots successfully.
Lab Instruction
Please note that in order to complete this lab you’ll need a REAL Cisco 2600 Series Router or greater as this lab cannot be emulated on the GNS3 application.
Step 1. Assuming that you already have an active console session to the router and the device is powered you should automatically be placed into ROMMON if you’re Cisco IOS image is corrupt or missing. However you have “Press Return to get started” Prompt then you’ve booted into an IOS image, you should power cycle the router and press CTRL+BREAK repeatedly to break the boot sequence and be placed into ROM Monitor mode as shown below;
System Bootstrap, Version 12.2(8r) [cmong 8r], RELEASE SOFTWARE (fc1) Copyright (c) 2003 by cisco Systems, Inc. C2600 platform with 262144 Kbytes of main memory device does not contain a valid magic number boot: cannot open "flash:" boot: cannot determine first file name on device "flash:" rommon 1 >
By executing the help command you can see all the available commands in ROMMON as shown below on the 2651XM;
rommon 1 > help
alias set and display aliases command
boot boot up an external process
break set/show/clear the breakpoint
confreg configuration register utility
cont continue executing a downloaded image
context display the context of a loaded image
cookie display contents of cookie PROM in hex
dev list the device table
dir list files in file system
dis display instruction stream
dnld serial download a program module
frame print out a selected stack frame
help monitor builtin command help
history monitor command history
meminfo main memory information
repeat repeat a monitor command
reset system reset
set display the monitor variables
stack produce a stack trace
sync write monitor environment to NVRAM
sysret print out info from last system return
tftpdnld tftp image download
unalias unset an alias
unset unset a monitor variable
xmodem x/ymodem image download
rommon 2 >
Step 2. In this lab we are most interested in the tftpdnld command.
This command will copy an IOS image from a TFTP Server into flash or load it directly into RAM. By executing the tftpdnld you can view all required variables for the command to operate properly;
rommon 2 > tftpdnld
Missing or illegal ip address for variable IP_ADDRESS
Illegal IP address.
usage: tftpdnld [-r]
Use this command for disaster recovery only to recover an image via TFTP.
Monitor variables are used to set up parameters for the transfer.
(Syntax: "VARIABLE_NAME=value" and use "set" to show current variables.)
"ctrl-c" or "break" stops the transfer before flash erase begins.
The following variables are REQUIRED to be set for tftpdnld:
IP_ADDRESS: The IP address for this unit
IP_SUBNET_MASK: The subnet mask for this unit
DEFAULT_GATEWAY: The default gateway for this unit
TFTP_SERVER: The IP address of the server to fetch from
TFTP_FILE: The filename to fetch
The following variables are OPTIONAL:
TFTP_VERBOSE: Print setting. 0=quiet, 1=progress(default), 2=verbose
TFTP_RETRY_COUNT: Retry count for ARP and TFTP (default=12)
TFTP_TIMEOUT: Overall timeout of operation in seconds (default=7200)
TFTP_CHECKSUM: Perform checksum test on image, 0=no, 1=yes (default=1)
FE_SPEED_MODE: 0=10/hdx, 1=10/fdx, 2=100/hdx, 3=100/fdx, 4=Auto(deflt)
Command line options:
-r: do not write flash, load to DRAM only and launch image
rommon 3 >
As per the objectives, we’re required to set the required variables to execute the tftpdnld command. You can issue the set command to view the current set variables.
rommon 3 > set
PS1=rommon ! >
BOOT=
RET_2_RUTC=0
BSI=0
RANDOM_NUM=1492875412
ROM_PERSISTENT_UTC=1016225763
RET_2_RTS=
RET_2_RCALTS=
?=1
rommon 24 > set
PS1=rommon ! >
BOOT=
RET_2_RUTC=0
BSI=0
RANDOM_NUM=1492875412
ROM_PERSISTENT_UTC=1016225763
RET_2_RTS=
RET_2_RCALTS=
?=0
rommon 4 >
Shown below is the required variables to execute tftpdnld successfully.
rommon 4 > IP_ADDRESS=10.1.1.10 rommon 5 > IP_SUBNET_MASK=255.255.255.0 rommon 6 > DEFAULT_GATEWAY=10.1.1.254 rommon 7 > TFTP_SERVER=172.16.20.17 rommon 8 > TFTP_FILE=c2600-i-mz.123-26.bin
You do not need a default gateway if your TFTP Server is on the same subnet as the Cisco router you’re recovering.
Once you have set the variables you can continue on to objective 3 by executing the tftpdnld command with the -r switch to copy the Cisco IOS image from a TFTP Server and load it into ram directly.
rommon 9 > tftpdnld -r
IP_ADDRESS: 10.1.1.10
IP_SUBNET_MASK: 255.255.255.0
DEFAULT_GATEWAY: 10.1.1.254
TFTP_SERVER: 172.16.20.17
TFTP_FILE: c2600-i-mz.123-26.bin
.....
Receiving c2600-i-mz.123-26.bin from 172.16.20.17 !!!!!!!!!!!!!!!!!!!!!!!!!!!
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
File reception completed.
program load complete, entry point: 0x80008000, size: 0x765238
Self decompressing the image : ##############################################
####################################################################### [OK]
Smart Init is enabled
smart init is sizing iomem
ID MEMORY_REQ TYPE
00036F 0X00103980 C2651XM Dual Fast Ethernet
000065 0X00031500 Four port Voice PM
0X00098670 public buffer pools
0X00211000 public particle pools
TOTAL: 0X003DE4F0
If any of the above Memory Requirements are
"UNKNOWN", you may be using an unsupported
configuration or there is a software problem and
system operation may be compromised.
Rounded IOMEM up to: 4Mb.
Using 3 percent iomem. [4Mb/128Mb]
Restricted Rights Legend
Use, duplication, or disclosure by the Government is
subject to restrictions as set forth in subparagraph
(c) of the Commercial Computer Software - Restricted
Rights clause at FAR sec. 52.227-19 and subparagraph
(c) (1) (ii) of the Rights in Technical Data and Computer
Software clause at DFARS sec. 252.227-7013.
cisco Systems, Inc.
170 West Tasman Drive
San Jose, California 95134-1706
Cisco Internetwork Operating System Software
IOS (tm) C2600 Software (C2600-I-M), Version 12.3(26), RELEASE SOFTWARE (fc2)
Technical Support: http://www.cisco.com/techsupport
Copyright (c) 1986-2008 by cisco Systems, Inc.
Compiled Mon 17-Mar-08 15:23 by dchih
cisco 2651XM (MPC860P) processor (revision 0x200) with 126976K/4096K bytes of memory.
Processor board ID JAE08030QZL (457188033)
M860 processor: part number 5, mask 2
Bridging software.
X.25 software, Version 3.0.0.
2 FastEthernet/IEEE 802.3 interface(s)
2 Serial network interface(s)
32K bytes of non-volatile configuration memory.
49152K bytes of processor board System flash (Read/Write)
--- System Configuration Dialog ---
Would you like to enter the initial configuration dialog? [yes/no]:
After you’ve booted your Cisco Router into IOS you may be prompted by the Initial configuration Dialog, type no and press return.
Once you’re at the IOS command line you’ll then need to copy an actual image into flash. You’re probably thinking why did we not just copy it using TFTPDNLD and the answer is quite simple. Using TFTPDNLD will take significantly longer to copy an image via TFTP to flash verses booting into RAM and doing a quick IOS image recovery as you’ve done in a previous lab.
If you need reference the previous lab for copying the image back to flash you can click HERE
The next step is to copy the IOS image from the TFTP Server in Cisco IOS. As shown below the typical prerequisite configuration required to copy an IOS image from a tftp server to flash.
Router>enable Router#configure terminal Router(config)#interface fa0/0 Router(config-if)#ip add 10.1.1.10 255.255.255.0 Router(config-if)#no shut Router(config-if)#exit Router(config)#ip route 0.0.0.0 0.0.0.0 10.1.1.254 Router(config)#end Router#
After you’ve configured the required configuration to copy an IOS image via TFTP to the Router’s flash you can execute the copy command as shown below;
Router#copy tftp flash Address or name of remote host []? 172.16.20.17 Source filename []? c2600-adventerprisek9-mz.124-1.bin Destination filename [c2600-adventerprisek9-mz.124-1.bin]? Accessing tftp://172.16.20.17/c2600-adventerprisek9-mz.124-1.bin... Erase flash: before copying? [confirm] Erasing the flash filesystem will remove all files! Continue? [confirm] Erasing device... eeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeee eeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeee eeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeee ...erased Erase of flash: complete Loading c2600-adventerprisek9-mz.124-1.bin from 172.16.20.17 (via FastEthernet0/0): !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! [OK - 34634180 bytes] Verifying checksum... OK (0x8E89) 34634180 bytes copied in 279.014 secs (124131 bytes/sec) Router#
Now that the new IOS image has copied to flash reload your router and verify that the router reboots.
Router#reload System configuration has been modified. Save? [yes/no]: no Proceed with reload? [confirm] SYS-5-RELOAD: Reload requested by console. Reload Reason: Reload command. System Bootstrap, Version 12.2(8r) [cmong 8r], RELEASE SOFTWARE (fc1) Copyright (c) 2003 by cisco Systems, Inc. C2600 platform with 262144 Kbytes of main memory program load complete, entry point: 0x80008000, size: 0x2107824 Self decompressing the image : ###################################### Smart Init is enabled smart init is sizing iomem ID MEMORY_REQ TYPE 00036F 0X00103980 C2651XM Dual Fast Ethernet 000065 0X00031500 Four port Voice PM 0X00098670 public buffer pools 0X00211000 public particle pools TOTAL: 0X003DE4F0 If any of the above Memory Requirements are "UNKNOWN", you may be using an unsupported configuration or there is a software problem and system operation may be compromised. Rounded IOMEM up to: 3Mb. Using 1 percent iomem. [3Mb/256Mb] Increasing IOMEM up to: 8Mb Restricted Rights Legend Use, duplication, or disclosure by the Government is subject to restrictions as set forth in subparagraph (c) of the Commercial Computer Software - Restricted Rights clause at FAR sec. 52.227-19 and subparagraph (c) (1) (ii) of the Rights in Technical Data and Computer Software clause at DFARS sec. 252.227-7013. cisco Systems, Inc. 170 West Tasman Drive San Jose, California 95134-1706 Cisco IOS Software, C2600 Software (C2600-ADVENTERPRISEK9-M), Version 12.4(1), RELEASE SOFTWARE (fc2) Technical Support: http://www.cisco.com/techsupport Copyright (c) 1986-2009 by Cisco Systems, Inc. Compiled Wed 28-Oct-09 18:16 by prod_rel_team Image text-base: 0x800080F8, data-base: 0x83594B3C This product contains cryptographic features and is subject to United States and local country laws governing import, export, transfer and use. Delivery of Cisco cryptographic products does not imply third-party authority to import, export, distribute or use encryption. Importers, exporters, distributors and users are responsible for compliance with U.S. and local country laws. By using this product you agree to comply with applicable laws and regulations. If you are unable to comply with U.S. and local laws, return this product immediately. A summary of U.S. laws governing Cisco cryptographic products may be found at: http://www.cisco.com/wwl/export/crypto/tool/stqrg.html If you require further assistance please contact us by sending email to export@cisco.com. Cisco 2651XM (MPC860P) processor (revision 2.0) with 253952K/8192K bytes of memory. Processor board ID JAE08030QZL M860 processor: part number 5, mask 2 2 FastEthernet interfaces 2 Serial interfaces 32K bytes of NVRAM. 49152K bytes of processor board System flash (Read/Write) --- System Configuration Dialog --- Would you like to enter the initial configuration dialog? [yes/no]:
After verifying that the new image has booted on your device than you’ve successfully recovered the IOS on your device and completed the objectives of this lab.
