Recovering a Corrupt Cisco IOS Image on a 2600 Series Router

Lab Objectives

•   Boot the Cisco router into ROM mode by breaking the boot sequence using the keystroke CTRL + Pause Break
•   Set the TFTPDNLD variables required to execute the procedure which include IP Address, Subnet Mask, Default Gateway, TFTP Server, TFTP Image name.
•   Execute the TFTPDNLD command and load the image into RAM using the -r switch.
•   Once booted into Cisco IOS, configure a router so that you may copy a Cisco IOS image from a TFTP server to Flash.
•   Once all necessary configuration is done copy the IOS image from the TFTP server to the flash.
•   After the copy has completed, reboot the router and verify that the image boots successfully.

Lab Instruction

As per the prerequisites you’ll need a REAL Cisco 2600 series router or greater as this lab cannot be emulated on the GNS3 application.

Step 1. Assuming that you already have an active console session to the router and the device is powered you should automatically be placed into ROMMON if you’re Cisco IOS image is corrupt or missing. However you have “Press Return to get started” Prompt then you’ve booted into an IOS image, you should power cycle the router and press CTRL+BREAK repeatedly to break the boot sequence and be placed into ROM Monitor mode as shown below;

System Bootstrap, Version 12.2(8r) [cmong 8r], RELEASE SOFTWARE (fc1) Copyright (c) 2003 by cisco Systems, Inc. C2600 platform with 262144 Kbytes of main memory device does not contain a valid magic number boot: cannot open "flash:" boot: cannot determine first file name on device "flash:" rommon 1 >

By executing the help command you can see all the available commands in ROMMON as shown below on the 2651XM;

rommon 1 > help alias set and display aliases command boot boot up an external process break set/show/clear the breakpoint confreg configuration register utility cont continue executing a downloaded image context display the context of a loaded image cookie display contents of cookie PROM in hex dev list the device table dir list files in file system dis display instruction stream dnld serial download a program module frame print out a selected stack frame help monitor builtin command help history monitor command history meminfo main memory information repeat repeat a monitor command reset system reset set display the monitor variables stack produce a stack trace sync write monitor environment to NVRAM sysret print out info from last system return tftpdnld tftp image download unalias unset an alias unset unset a monitor variable xmodem x/ymodem image download rommon 2 >

Step 2. In this lab we are most interested in the tftpdnld command.

This command will copy an IOS image from a TFTP Server into flash or load it directly into RAM. By executing the tftpdnld you can view all required variables for the command to operate properly;

rommon 2 > tftpdnld Missing or illegal ip address for variable IP_ADDRESS Illegal IP address. usage: tftpdnld [-r] Use this command for disaster recovery only to recover an image via TFTP. Monitor variables are used to set up parameters for the transfer. (Syntax: "VARIABLE_NAME=value" and use "set" to show current variables.) "ctrl-c" or "break" stops the transfer before flash erase begins. The following variables are REQUIRED to be set for tftpdnld: IP_ADDRESS: The IP address for this unit IP_SUBNET_MASK: The subnet mask for this unit DEFAULT_GATEWAY: The default gateway for this unit TFTP_SERVER: The IP address of the server to fetch from TFTP_FILE: The filename to fetch The following variables are OPTIONAL: TFTP_VERBOSE: Print setting. 0=quiet, 1=progress(default), 2=verbose TFTP_RETRY_COUNT: Retry count for ARP and TFTP (default=12) TFTP_TIMEOUT: Overall timeout of operation in seconds (default=7200) TFTP_CHECKSUM: Perform checksum test on image, 0=no, 1=yes (default=1) FE_SPEED_MODE: 0=10/hdx, 1=10/fdx, 2=100/hdx, 3=100/fdx, 4=Auto(deflt) Command line options: -r: do not write flash, load to DRAM only and launch image rommon 3 >

As per the objectives, we’re required to set the required variables to execute the tftpdnld command. You can issue the set command to view the current set variables.

rommon 3 > set PS1=rommon ! > BOOT= RET_2_RUTC=0 BSI=0 RANDOM_NUM=1492875412 ROM_PERSISTENT_UTC=1016225763 RET_2_RTS= RET_2_RCALTS= ?=1 rommon 24 > set PS1=rommon ! > BOOT= RET_2_RUTC=0 BSI=0 RANDOM_NUM=1492875412 ROM_PERSISTENT_UTC=1016225763 RET_2_RTS= RET_2_RCALTS= ?=0 rommon 4 >

Shown below is the required variables to execute tftpdnld successfully.

rommon 4 > IP_ADDRESS=10.1.1.10 rommon 5 > IP_SUBNET_MASK=255.255.255.0 rommon 6 > DEFAULT_GATEWAY=10.1.1.254 rommon 7 > TFTP_SERVER=172.16.20.17 rommon 8 > TFTP_FILE=c2600-i-mz.123-26.bin

NOTE: You do not need a default gateway if your TFTP Server is on the same subnet as the Cisco router you’re recovering.

Once you have set the variables you can continue on to objective 3 by executing the tftpdnld command with the -r switch to copy the Cisco IOS image from a TFTP Server and load it into ram directly.

rommon 9 > tftpdnld -r IP_ADDRESS: 10.1.1.10 IP_SUBNET_MASK: 255.255.255.0 DEFAULT_GATEWAY: 10.1.1.254 TFTP_SERVER: 172.16.20.17 TFTP_FILE: c2600-i-mz.123-26.bin ..... Receiving c2600-i-mz.123-26.bin from 172.16.20.17 !!!!!!!!!!!!!!!!!!!!!!!!!!! !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! File reception completed. program load complete, entry point: 0x80008000, size: 0x765238 Self decompressing the image : ############################################## ####################################################################### [OK] Smart Init is enabled smart init is sizing iomem ID MEMORY_REQ TYPE 00036F 0X00103980 C2651XM Dual Fast Ethernet 000065 0X00031500 Four port Voice PM 0X00098670 public buffer pools 0X00211000 public particle pools TOTAL: 0X003DE4F0 If any of the above Memory Requirements are "UNKNOWN", you may be using an unsupported configuration or there is a software problem and system operation may be compromised. Rounded IOMEM up to: 4Mb. Using 3 percent iomem. [4Mb/128Mb] Restricted Rights Legend Use, duplication, or disclosure by the Government is subject to restrictions as set forth in subparagraph (c) of the Commercial Computer Software - Restricted Rights clause at FAR sec. 52.227-19 and subparagraph (c) (1) (ii) of the Rights in Technical Data and Computer Software clause at DFARS sec. 252.227-7013. cisco Systems, Inc. 170 West Tasman Drive San Jose, California 95134-1706 Cisco Internetwork Operating System Software IOS (tm) C2600 Software (C2600-I-M), Version 12.3(26), RELEASE SOFTWARE (fc2) Technical Support: http://www.cisco.com/techsupport Copyright (c) 1986-2008 by cisco Systems, Inc. Compiled Mon 17-Mar-08 15:23 by dchih cisco 2651XM (MPC860P) processor (revision 0x200) with 126976K/4096K bytes of memory. Processor board ID JAE08030QZL (457188033) M860 processor: part number 5, mask 2 Bridging software. X.25 software, Version 3.0.0. 2 FastEthernet/IEEE 802.3 interface(s) 2 Serial network interface(s) 32K bytes of non-volatile configuration memory. 49152K bytes of processor board System flash (Read/Write) --- System Configuration Dialog --- Would you like to enter the initial configuration dialog? [yes/no]:

Once you’ve booted your Cisco router into IOS you may be prompted by the Initial configuration Dialog, type no and press return.

Once you’ve booted the router into IOS you’ll then have to copy an actual image into flash. You’re probably thinking why did we not just copy it using TFTPDNLD and the answer is quite simple. Using TFTPDNLD will take significantly longer to copy an image via TFTP to flash verses booting into RAM and doing a quick ios image recovery as you’ve done in a previous lab.

The next step is to copy the IOS image from the TFTP Server in Cisco IOS. As shown below the typical prerequisite configuration required to copy an IOS image from a tftp server to flash.

Router>enable Router#configure terminal Router(config)#interface fa0/0 Router(config-if)#ip add 10.1.1.10 255.255.255.0 Router(config-if)#no shut Router(config-if)#exit Router(config)#ip route 0.0.0.0 0.0.0.0 10.1.1.254 Router(config)#end Router#

Once you’ve configured the required configuration to copy an ios image via tftp to the router you can execute the copy command as shown below;

Router#copy tftp flash Address or name of remote host []? 172.16.20.17 Source filename []? c2600-adventerprisek9-mz.124-1.bin Destination filename [c2600-adventerprisek9-mz.124-1.bin]? Accessing tftp://172.16.20.17/c2600-adventerprisek9-mz.124-1.bin... Erase flash: before copying? [confirm] Erasing the flash filesystem will remove all files! Continue? [confirm] Erasing device... eeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeee eeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeee eeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeee ...erased Erase of flash: complete Loading c2600-adventerprisek9-mz.124-1.bin from 172.16.20.17 (via FastEthernet0/0): !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! [OK - 34634180 bytes] Verifying checksum... OK (0x8E89) 34634180 bytes copied in 279.014 secs (124131 bytes/sec) Router#

Once the new IOS image has copied to flash reload your router and verify that the router reboots.

Router#reload System configuration has been modified. Save? [yes/no]: no Proceed with reload? [confirm] SYS-5-RELOAD: Reload requested by console. Reload Reason: Reload command. System Bootstrap, Version 12.2(8r) [cmong 8r], RELEASE SOFTWARE (fc1) Copyright (c) 2003 by cisco Systems, Inc. C2600 platform with 262144 Kbytes of main memory program load complete, entry point: 0x80008000, size: 0x2107824 Self decompressing the image : ###################################### Smart Init is enabled smart init is sizing iomem ID MEMORY_REQ TYPE 00036F 0X00103980 C2651XM Dual Fast Ethernet 000065 0X00031500 Four port Voice PM 0X00098670 public buffer pools 0X00211000 public particle pools TOTAL: 0X003DE4F0 If any of the above Memory Requirements are "UNKNOWN", you may be using an unsupported configuration or there is a software problem and system operation may be compromised. Rounded IOMEM up to: 3Mb. Using 1 percent iomem. [3Mb/256Mb] Increasing IOMEM up to: 8Mb Restricted Rights Legend Use, duplication, or disclosure by the Government is subject to restrictions as set forth in subparagraph (c) of the Commercial Computer Software - Restricted Rights clause at FAR sec. 52.227-19 and subparagraph (c) (1) (ii) of the Rights in Technical Data and Computer Software clause at DFARS sec. 252.227-7013. cisco Systems, Inc. 170 West Tasman Drive San Jose, California 95134-1706 Cisco IOS Software, C2600 Software (C2600-ADVENTERPRISEK9-M), Version 12.4(1), RELEASE SOFTWARE (fc2) Technical Support: http://www.cisco.com/techsupport Copyright (c) 1986-2009 by Cisco Systems, Inc. Compiled Wed 28-Oct-09 18:16 by prod_rel_team Image text-base: 0x800080F8, data-base: 0x83594B3C This product contains cryptographic features and is subject to United States and local country laws governing import, export, transfer and use. Delivery of Cisco cryptographic products does not imply third-party authority to import, export, distribute or use encryption. Importers, exporters, distributors and users are responsible for compliance with U.S. and local country laws. By using this product you agree to comply with applicable laws and regulations. If you are unable to comply with U.S. and local laws, return this product immediately. A summary of U.S. laws governing Cisco cryptographic products may be found at: http://www.cisco.com/wwl/export/crypto/tool/stqrg.html If you require further assistance please contact us by sending email to export@cisco.com. Cisco 2651XM (MPC860P) processor (revision 2.0) with 253952K/8192K bytes of memory. Processor board ID JAE08030QZL M860 processor: part number 5, mask 2 2 FastEthernet interfaces 2 Serial interfaces 32K bytes of NVRAM. 49152K bytes of processor board System flash (Read/Write) --- System Configuration Dialog --- Would you like to enter the initial configuration dialog? [yes/no]:

Once you’ve verified that the new image will boot successfully on your recovered device you’ve completed the objectives of this lab.