Cisco Cisco IPS 4255 Sensor

To recover the password using the ROMMON CLI, follow these steps:

Reboot the appliance.

To interrupt the boot process, press ESC or Control-R (terminal server) or send a BREAK command 
(direct connection).

The boot code either pauses for 10 seconds or displays something similar to one of the following:

Evaluating boot options

Use BREAK or ESC to interrupt boot

Enter the following commands to reset the password:

Sample ROMMON session:

Booting system, please wait...

CISCO SYSTEMS

Embedded BIOS Version 1.0(11)2 01/25/06 13:21:26.17

...

Evaluating BIOS Options...

Launch BIOS Extension to setup ROMMON

Cisco Systems ROMMON Version (1.0(11)2) #0: Thu Jan 26 10:43:08 PST 2006

Platform IPS-4240-K9

Use BREAK or ESC to interrupt boot.

Use SPACE to begin boot immediately.

Boot interrupted. 

Management0/0

Link is UP

MAC Address:000b.fcfa.d155

Use ? for help.

rommon #0> confreg 0x7

Update Config Register (0x7) in NVRAM...

rommon #1> boot

To recover the password for the IDSM2, you must install a special password recovery image file. This 
installation only resets the password, all other configuration remains intact. The password recovery 
image is version-dependent and can be found on the Cisco Download Software site. For IPS 6.x, 
download WS-SVC-IDSM2-K9-a-6.0-password-recovery.bin.gz. For IPS 7.x, download 
WS-SVC-IDSM2-K9-a-7.0-password-recovery.bin.gz. 

FTP is the only supported protocol for image installations, so make sure you put the password recovery 
image file on an FTP server that is accessible to the switch. You must have administrative access to the 
Cisco 6500 series switch to recover the password on the IDSM2.

During the password recovery image installation, the following message appears:

Upgrading will wipe out the contents on the hard disk.

Do you want to proceed installing it [y|n]:

This message is in error. Installing the password recovery image does not remove any configuration, it 
only resets the login account.