| 5.2 |  | Managing the Cisco File System |
| 5.2.6 |  | Managing IOS images using Xmodem |

| If the IOS image in flash has been erased or corrupted, the IOS may need to be restored from the ROM monitor mode (ROMmon). In many of the Cisco hardware architectures, the ROMmon mode is identified from the rommon 1 > prompt. This first step in this process is to identify why the IOS image did not load from flash. This could be due to a corrupt or missing image. The flash should be examined with the dir flash: command. If an image is located that appears to be valid, an attempt should be made to boot from that image. This is done using boot flash: command. For example if the image name was “c2600-is-mz.121-5”, the command would be: rommon 1>boot flash:c2600-is-mz.121-5 If the router properly boots, then there are a couple of items that need to be examined to determine why the router booted to the ROMmon instead of using IOS from flash. First, use the show version command to check the configuration register to ensure that it is configured for the default boot sequence. If the configuration register value is correct, use the show startup-config command to see if there is a boot system command instructing the router to use the IOS for ROM monitor. If the router will not properly boot from the image or there is no IOS image, a new IOS will need to be downloaded. The IOS file may be recovered using either Xmodem to restore the image through the console, or downloading the image using TFTP from the ROMmon mode. Download using Xmodem from ROMmon To restore the IOS through the console, the local PC needs to have a copy of the IOS file to restore and a terminal emulation program such as HyperTerminal. The IOS can be restored using the default console speed of 9600 bps. The baud rate can be changed to 115200 bps to speed up the download. The console speed can be changed from ROMmon mode using the confreg command. After entering the confreg command, the router will prompt for the various parameters that can be changed. When prompted “change console baud rate? y/n [n]:” selecting y will provide a prompt to select the new speed. After changing the console speed and restarting the router into the ROMmon mode, the terminal session (at 9600) should be terminated and a new session started at 115200 bps to match the console speed. The Xmodem command can be used from the ROMmon mode to restore the IOS software image from the PC. The format of the command is xmodem -c image_file_name. For example, to restore an IOS image file with the name “c2600-is-mz.122-10a.bin”, type the command: xmodem -c c2600-is-mz.122-10a.bin The -c instructs the Xmodem process to use Cyclic Redundancy Check (CRC) for error checking during the download. The router will prompt not to begin the transfer and present a warning message. The warning message informs that the bootflash will be erased and asks to confirm continuing. When the process is continued, the router will then prompt to start the transfer. Now the Xmodem transfer needs to be started from the terminal emulator. In HyperTerminal, select Transfer > Send File. Then in the Send File popup specify the image name/location, select Xmodem as the protocol, and start the transfer. During the transfer, the Sending File popup will display the status of the transfer. Once the transfer is complete a message appears indicating that flash is being erased. This is followed by the “Download Complete!” message. Before restarting the router, the console speed needs to be set back to 9600 and the config register back to 0x2102. Enter the command config-register 0x2102 at the privileged EXEC prompt. While the router is rebooting, the 115200 bps terminal session needs to be ended and a 9600 bps session begun.
| Lab Activity Lab Exercise: Password Recovery Procedures In this lab, the students will gain access to a router with an unknown privileged mode (enable) password.
| Lab Activity Lab Exercise: Managing IOS Images with ROMmon and Xmodem In this lab, the students will recover a Cisco 1700 series router using ROM monitor (ROMmon) (rommon >) due to a missing or corrupt IOS boot flash image.
| Web Links Loading and Maintaining System Images http://www.cisco.com/en/US/products/sw/ iosswrel/ps1835/products_configuration_guide_ chapter09186a00800c6c63.html#xtocid41