Lab 2-11 - Recovering IOS on a 2600 Series

Real World Application

The Cisco 2600 Series Multi-Service router platform is a dying bread as the Cisco 2800 Series has taken its place however the 2600 series continues to be the router of choice when it comes to building your own Cisco Lab. The Cisco 2600 Series ROMMON is very similar to the latest generation routers so this lab will be a valuable lesson.

Lab Prerequisites

  • You’ll need a Cisco 2600 Series router or greater that has a corrupt Cisco IOS image or NO IOS image at all. If you wish to simulate this lab you can erase the flash on your device and reboot. Please note that you’ll need to backup the Cisco IOS image prior to erasing it unless you have another image on hand that you wish to load onto the device.
  • A console connection to the device is REQUIRED
  • You’ll need a TFTP server installed on your PC to restore the image.

Lab Objectives

  • Boot the Cisco router into ROM mode by breaking the boot sequence using the keystroke CTRL + Pause Break
  • Set the TFTPDNLD variables required to execute the procedure which include IP Address, Subnet Mask, Default Gateway, TFTP Server, TFTP Image name.
  • Execute the TFTPDNLD command and load the image into RAM using the -r switch.
  • Once booted into Cisco IOS, configure a router so that you may copy a Cisco IOS image from a TFTP server to Flash.
  • Once all necessary configuration is done copy the IOS image from the TFTP server to the flash.
  • After the copy has completed, reboot the router and verify that the image boots successfully.

Lab Instruction

Please note that in order to complete this lab you’ll need a REAL Cisco 2600 Series Router or greater as this lab cannot be emulated on the GNS3 application.

Step 1. Assuming that you already have an active console session to the router and the device is powered you should automatically be placed into ROMMON if you’re Cisco IOS image is corrupt or missing. However you have “Press Return to get started” Prompt then you’ve booted into an IOS image, you should power cycle the router and press CTRL+BREAK repeatedly to break the boot sequence and be placed into ROM Monitor mode as shown below;

System Bootstrap, Version 12.2(8r) [cmong 8r], RELEASE SOFTWARE (fc1)
Copyright (c) 2003 by cisco Systems, Inc.
C2600 platform with 262144 Kbytes of main memory

device does not contain a valid magic number
boot: cannot open "flash:"
boot: cannot determine first file name on device "flash:"

rommon 1 >

By executing the help command you can see all the available commands in ROMMON as shown below on the 2651XM;

rommon 1 > help    
alias               set and display aliases command
boot                boot up an external process
break               set/show/clear the breakpoint
confreg             configuration register utility
cont                continue executing a downloaded image
context             display the context of a loaded image
cookie              display contents of cookie PROM in hex
dev                 list the device table
dir                 list files in file system
dis                 display instruction stream
dnld                serial download a program module
frame               print out a selected stack frame
help                monitor builtin command help
history             monitor command history
meminfo             main memory information
repeat              repeat a monitor command
reset               system reset
set                 display the monitor variables
stack               produce a stack trace
sync                write monitor environment to NVRAM
sysret              print out info from last system return
tftpdnld            tftp image download
unalias             unset an alias
unset               unset a monitor variable
xmodem              x/ymodem image download
rommon 2 >

Step 2. In this lab we are most interested in the tftpdnld command.

This command will copy an IOS image from a TFTP Server into flash or load it directly into RAM. By executing the tftpdnld you can view all required variables for the command to operate properly;

rommon 2 > tftpdnld

Missing or illegal ip address for variable IP_ADDRESS
Illegal IP address.

usage: tftpdnld [-r]
  Use this command for disaster recovery only to recover an image via TFTP.
  Monitor variables are used to set up parameters for the transfer.
  (Syntax: "VARIABLE_NAME=value" and use "set" to show current variables.)
  "ctrl-c" or "break" stops the transfer before flash erase begins.

  The following variables are REQUIRED to be set for tftpdnld:
            IP_ADDRESS: The IP address for this unit
        IP_SUBNET_MASK: The subnet mask for this unit
       DEFAULT_GATEWAY: The default gateway for this unit
           TFTP_SERVER: The IP address of the server to fetch from
             TFTP_FILE: The filename to fetch

  The following variables are OPTIONAL:
          TFTP_VERBOSE: Print setting. 0=quiet, 1=progress(default), 2=verbose
      TFTP_RETRY_COUNT: Retry count for ARP and TFTP (default=12)
          TFTP_TIMEOUT: Overall timeout of operation in seconds (default=7200)
         TFTP_CHECKSUM: Perform checksum test on image, 0=no, 1=yes (default=1)
         FE_SPEED_MODE: 0=10/hdx, 1=10/fdx, 2=100/hdx, 3=100/fdx, 4=Auto(deflt)

  Command line options:
   -r: do not write flash, load to DRAM only and launch image
rommon 3 >

As per the objectives, we’re required to set the required variables to execute the tftpdnld command. You can issue the set command to view the current set variables.

rommon 3 > set
PS1=rommon ! > 
BOOT=
RET_2_RUTC=0
BSI=0
RANDOM_NUM=1492875412
ROM_PERSISTENT_UTC=1016225763
RET_2_RTS=
RET_2_RCALTS=
?=1
rommon 24 > set
PS1=rommon ! > 
BOOT=
RET_2_RUTC=0
BSI=0
RANDOM_NUM=1492875412
ROM_PERSISTENT_UTC=1016225763
RET_2_RTS=
RET_2_RCALTS=
?=0
rommon 4 >

Shown below is the required variables to execute tftpdnld successfully.

rommon 4 > IP_ADDRESS=10.1.1.10
rommon 5 > IP_SUBNET_MASK=255.255.255.0
rommon 6 > DEFAULT_GATEWAY=10.1.1.254
rommon 7 > TFTP_SERVER=172.16.20.17
rommon 8 > TFTP_FILE=c2600-i-mz.123-26.bin

You do not need a default gateway if your TFTP Server is on the same subnet as the Cisco router you’re recovering.

Once you have set the variables you can continue on to objective 3 by executing the tftpdnld command with the -r switch to copy the Cisco IOS image from a TFTP Server and load it into ram directly.

rommon 9 > tftpdnld -r

          IP_ADDRESS: 10.1.1.10
      IP_SUBNET_MASK: 255.255.255.0
     DEFAULT_GATEWAY: 10.1.1.254
         TFTP_SERVER: 172.16.20.17
           TFTP_FILE: c2600-i-mz.123-26.bin
.....
Receiving c2600-i-mz.123-26.bin from 172.16.20.17 !!!!!!!!!!!!!!!!!!!!!!!!!!!
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
File reception completed.
program load complete, entry point: 0x80008000, size: 0x765238
Self decompressing the image : ##############################################
####################################################################### [OK]

Smart Init is enabled
smart init is sizing iomem
  ID            MEMORY_REQ                 TYPE
00036F          0X00103980 C2651XM Dual Fast Ethernet
000065          0X00031500 Four port Voice PM
                0X00098670 public buffer pools
                0X00211000 public particle pools
TOTAL:          0X003DE4F0

If any of the above Memory Requirements are 
"UNKNOWN", you may be using an unsupported
configuration or there is a software problem and
system operation may be compromised.
Rounded IOMEM up to: 4Mb.
Using 3 percent iomem. [4Mb/128Mb]

              Restricted Rights Legend

Use, duplication, or disclosure by the Government is
subject to restrictions as set forth in subparagraph
(c) of the Commercial Computer Software - Restricted
Rights clause at FAR sec. 52.227-19 and subparagraph
(c) (1) (ii) of the Rights in Technical Data and Computer
Software clause at DFARS sec. 252.227-7013.

           cisco Systems, Inc.
           170 West Tasman Drive
           San Jose, California 95134-1706



Cisco Internetwork Operating System Software 
IOS (tm) C2600 Software (C2600-I-M), Version 12.3(26), RELEASE SOFTWARE (fc2)
Technical Support: http://www.cisco.com/techsupport
Copyright (c) 1986-2008 by cisco Systems, Inc.
Compiled Mon 17-Mar-08 15:23 by dchih

cisco 2651XM (MPC860P) processor (revision 0x200) with 126976K/4096K bytes of memory.
Processor board ID JAE08030QZL (457188033)
M860 processor: part number 5, mask 2
Bridging software.
X.25 software, Version 3.0.0.
2 FastEthernet/IEEE 802.3 interface(s)
2 Serial network interface(s)
32K bytes of non-volatile configuration memory.
49152K bytes of processor board System flash (Read/Write)


         --- System Configuration Dialog ---

Would you like to enter the initial configuration dialog? [yes/no]: 

After you’ve booted your Cisco Router into IOS you may be prompted by the Initial configuration Dialog, type no and press return.

Once you’re at the IOS command line you’ll then need to copy an actual image into flash. You’re probably thinking why did we not just copy it using TFTPDNLD and the answer is quite simple. Using TFTPDNLD will take significantly longer to copy an image via TFTP to flash verses booting into RAM and doing a quick IOS image recovery as you’ve done in a previous lab.

If you need reference the previous lab for copying the image back to flash you can click HERE

The next step is to copy the IOS image from the TFTP Server in Cisco IOS. As shown below the typical prerequisite configuration required to copy an IOS image from a tftp server to flash.

Router>enable
Router#configure terminal
Router(config)#interface fa0/0
Router(config-if)#ip add 10.1.1.10 255.255.255.0
Router(config-if)#no shut
Router(config-if)#exit
Router(config)#ip route 0.0.0.0 0.0.0.0 10.1.1.254
Router(config)#end
Router#

After you’ve configured the required configuration to copy an IOS image via TFTP to the Router’s flash you can execute the copy command as shown below;

Router#copy tftp flash
Address or name of remote host []? 172.16.20.17
Source filename []? c2600-adventerprisek9-mz.124-1.bin
Destination filename [c2600-adventerprisek9-mz.124-1.bin]? 
Accessing tftp://172.16.20.17/c2600-adventerprisek9-mz.124-1.bin...
Erase flash: before copying? [confirm]
Erasing the flash filesystem will remove all files! Continue? [confirm]
Erasing device... eeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeee
eeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeee
eeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeee ...erased
Erase of flash: complete
Loading c2600-adventerprisek9-mz.124-1.bin from 172.16.20.17 (via FastEthernet0/0):
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
[OK - 34634180 bytes]

Verifying checksum...  OK (0x8E89)
34634180 bytes copied in 279.014 secs (124131 bytes/sec)
Router#

Now that the new IOS image has copied to flash reload your router and verify that the router reboots.

Router#reload

System configuration has been modified. Save? [yes/no]: no
Proceed with reload? [confirm]

SYS-5-RELOAD: Reload requested by console. Reload Reason: Reload command.

System Bootstrap, Version 12.2(8r) [cmong 8r], RELEASE SOFTWARE (fc1)
Copyright (c) 2003 by cisco Systems, Inc.
C2600 platform with 262144 Kbytes of main memory

program load complete, entry point: 0x80008000, size: 0x2107824
Self decompressing the image : ######################################


Smart Init is enabled
smart init is sizing iomem
  ID            MEMORY_REQ                 TYPE
00036F          0X00103980 C2651XM Dual Fast Ethernet
000065          0X00031500 Four port Voice PM
                0X00098670 public buffer pools
                0X00211000 public particle pools
TOTAL:          0X003DE4F0

If any of the above Memory Requirements are 
"UNKNOWN", you may be using an unsupported
configuration or there is a software problem and
system operation may be compromised.
Rounded IOMEM up to: 3Mb.
Using 1 percent iomem. [3Mb/256Mb]

Increasing IOMEM up to: 8Mb
              Restricted Rights Legend

Use, duplication, or disclosure by the Government is
subject to restrictions as set forth in subparagraph
(c) of the Commercial Computer Software - Restricted
Rights clause at FAR sec. 52.227-19 and subparagraph
(c) (1) (ii) of the Rights in Technical Data and Computer
Software clause at DFARS sec. 252.227-7013.

           cisco Systems, Inc.
           170 West Tasman Drive
           San Jose, California 95134-1706



Cisco IOS Software, C2600 Software (C2600-ADVENTERPRISEK9-M), Version 12.4(1), RELEASE SOFTWARE (fc2)
Technical Support: http://www.cisco.com/techsupport
Copyright (c) 1986-2009 by Cisco Systems, Inc.
Compiled Wed 28-Oct-09 18:16 by prod_rel_team
Image text-base: 0x800080F8, data-base: 0x83594B3C


This product contains cryptographic features and is subject to United
States and local country laws governing import, export, transfer and
use. Delivery of Cisco cryptographic products does not imply
third-party authority to import, export, distribute or use encryption.
Importers, exporters, distributors and users are responsible for
compliance with U.S. and local country laws. By using this product you
agree to comply with applicable laws and regulations. If you are unable
to comply with U.S. and local laws, return this product immediately.

A summary of U.S. laws governing Cisco cryptographic products may be found at:

http://www.cisco.com/wwl/export/crypto/tool/stqrg.html

If you require further assistance please contact us by sending email to
export@cisco.com.

Cisco 2651XM (MPC860P) processor (revision 2.0) with 253952K/8192K bytes of memory.
Processor board ID JAE08030QZL
M860 processor: part number 5, mask 2
2 FastEthernet interfaces
2 Serial interfaces
32K bytes of NVRAM.
49152K bytes of processor board System flash (Read/Write)


         --- System Configuration Dialog ---

Would you like to enter the initial configuration dialog? [yes/no]:

After verifying that the new image has booted on your device than you’ve successfully recovered the IOS on your device and completed the objectives of this lab.