I need to do a password recovery on an ASA5525X. I only have a 30 minute window to get it done.

The ASA got locked out. No access to SSH or console access.

Console access got locked out because I accidentally did:

no aaa authentication serial console LOCAL 
no aaa authentication ssh console ACS LOCAL
no aaa authentication enable console ACS LOCAL
no aaa authentication http console LOCAL"

I need to revert these changes so I can have console access.

I have physical access to the device.

My questions are

  1. I don't have a back of the current running configuration. How do i do a password recovery with out loosing my current running configuration?
  2. Can I see what exactly is in the startup configuration before I reboot my ASA.
  • Did any answer help you? if so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you could provide and accept your own answer.
    – Ron Maupin
    Commented Aug 7, 2017 at 19:44

1 Answer 1


Since you didn't save the configuration, simply rebooting the unit will get you back to the previous configuration. I.E. the last one that was saved, and you will recover access.

If there's other configuration change that were not saved, they will be lost altogether.

It has already happened that a Cisco device worked for years with configuration update never saved, and then rebooted and.... troubles.

About seeing the configuration prior to reboot, there's no way I'm aware of.

Edit if the config was saved then

Performing Password Recovery for the ASA 5500 Series Adaptive Security Appliance

To recover passwords, perform the following steps:

Step 1 Connect to the security appliance console port according to the "Accessing the Command-Line Interface" section on page 2-4.

Step 2 Power off the security appliance, and then power it on.

Step 3 During the startup messages, press the Escape key when prompted to enter ROMMON.

Step 4 To set the security appliance to ignore the startup configuration at reload, enter the following command:

rommon #1> confreg

The security appliance displays the current configuration register value, and asks if you want to change the value:

Current Configuration Register: 0x00000011

Configuration Summary:

boot TFTP image, boot default image from Flash on netboot failure

Do you wish to change this configuration? y/n [n]:

Step 5 Record your current configuration register value (the number that is similar to 0x00000011 in the example above,) so you can restore it later.

Step 6 Enter Y to change the configuration and press Y.

The security appliance prompts you for new values.

Step 7 Accept the default values for all settings (which is N for all settings by the way,) except for the "disable system configuration?" value; at that prompt, enter Y.

Step 8 Reload the security appliance by entering the following command:

rommon #2> boot

The security appliance loads a default configuration instead of the startup configuration.

Step 9 Enter privileged EXEC mode by entering the following command:

hostname> enable

Step 10 When prompted for the password, press Return.

The password is blank.

Step 11 Load the startup configuration by entering the following command:

hostname# copy startup-config running-config

Step 12 Enter global configuration mode by entering the following command:

hostname# configure terminal

Step 13 Change the passwords in the configuration by entering the following commands, as necessary. Note: the second word "password" below is where you enter your actual password since the password "password" is not a password at all.

hostname(config)# password password

hostname(config)# enable password password

hostname(config)# username name password password

Step 14 Change the configuration register to load the startup configuration at the next reload by entering the following command:

hostname(config)# config-register value

Where value is the configuration register value you noted in Step 5 and 0x1 is the default configuration register. For more information about the configuration register, see the Cisco Security Appliance Command Reference.

Step 15 Save the new passwords to the startup configuration by entering the following command:

hostname(config)# copy running-config startup-config

Step 16 You will need to repeat steps 4 through 8, except this time at step seven press N for the "disable system configuration?"

Source : https://supportforums.cisco.com/document/79016/asa-password-recovery

  • what if i did save the configs after entering the no "aaa" commands ..
    – Indu Reddy
    Commented Feb 26, 2016 at 15:46
  • i think i did a write mem after doing the changes .. but i want to revert those commands during /after password recovery .. just wanted to make sure i wont get locked out again as soon as the password recovery is done and I do a copy run start .. .. since the configuration has no aaa commands for ssh, console ..
    – Indu Reddy
    Commented Feb 26, 2016 at 15:49
  • then see my edit.
    – JFL
    Commented Feb 26, 2016 at 15:56
  • Thnak you so much !!
    – Indu Reddy
    Commented Feb 26, 2016 at 22:34
  • quick question ..._ASA# sh run Fallback authorization. Username 'enable_15' not in LOCAL database Command authorization failed_.... Iam getting this error message on the ASA ..Will creating a new user named enable_15 on ACS would give me privileged access to ASA .. since that user is already in the ASA by default ...?? instead of doing a password recovery ..
    – Indu Reddy
    Commented Feb 26, 2016 at 22:34

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.