cisco ASA防火墙的密码恢复

CISCO ASA的密码恢复

 

普通的恢复类似IOS路由器： 进入CONSOLE的物理连接，重启设备 You can press the Esc (Escape) key after Use BREAK or ESC to interrupt boot is shown. This will take you into ROMMON mode, as follows: rommon #0 rommon #0 confreg Current Configurat

普通的恢复类似IOS路由器： 进入CONSOLE的物理连接，重启设备 You can press the Esc (Escape) key after "Use BREAK or ESC to interrupt boot" is shown. This will take you into ROMMON mode, as follows: rommon #0> rommon #0> confreg Current Configuration Register: 0x00000011 Configuration Summary: boot TFTP image, boot default image from Flash on netboot failure Do you wish to change this configuration? y/n [n]: y disable system configuration? y/n [n]: y 红色部分是需要键入的命令 设备接着执行，将提示： Current Configuration Register: 0x00000040 Configuration Summary: boot ROMMON ignore system configuration Update Config Register (0x40) in NVRAM... 这里将0X11启动模式转变到0X40模式——类似IOS的0X2102到0X2142 rommon #1> boot 重新启动，将进入以下模式： ciscoasa> ciscoasa> enable Password:<cr> ciscoasa# 现在 ciscoasa# copy startup-config running-config 完成密码重设 Chicago# config terminal Chicago(config)# passwd cisco123 Chicago(config)# enable password cisco123 改回启动方式 Chicago(config)# config-register 0x11 最后需要保存 Chicago(config)# copy running-config startup-config

以上方式并不是安全的方式，只需要物理连接即可完成重设密码。 下面是另外一种更安全的控制方式： Chicago(config)# no service password-recovery WARNING: Saving "no service password-recovery" in the startup-config will disable password recovery via the PIX Password Lockout Utility.  The only means of recovering from lost or forgotten passwords will be for the PIX Password Lockout Utility to erase all file systems including configuration files and images. You should make a backup of your configuration and have a mechanism to restore images from the Monitor Mode command line. 提示两点： 1、恢复的时候会清除所有配置 2、需要保存配置文件，并有一种方式从Monitor Mode command line得到恢复的IMAGES 密码恢复过程： 建立物理CONSOLE连接，RELOAD（命令）设备 press the Esc (Escape) key after "Use BREAK or ESC to interrupt boot" is shown 提示： a new image must be downloaded via ROMMON. Erase all file systems? y/n [n]: yes Disk1: is not present. Enabling password recovery... rommon #0> rommon #0> ADDRESS=192.168.10.1 rommon #1> SERVER=192.168.10.250 rommon #3> interface GigabitEthernet0/0 GigabitEthernet0/0 MAC Address: 000f.f775.4b54 rommon #4> file asa702.bin rommon #5> tftpdnld tftp asa702.bin@192.168.10.250 !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! Note The security appliance downloads the system image file in memory and boots up the device. However, the downloaded system image is not stored in flash. 这里提示只在MEMORY而不保存到FLASH中 此时可以进入： ciscoasa> enable ciscoasa# copy tftp: running-config Address or name of remote host []? 192.168.10.250 Source filename []? Chicago.conf 需要将以前保存的配置文件载入到设备中 然后重设密码，并保存即可 这里有两个安全提高： 1、IMEGE保存在TFTP、备份文件也保存在另外的位置 2、擦除了使用的配置文件 注意如果TFTP不在同一网段，则： rommon #2> GATEWAY 192.168.10.100 注意： TFTP的参数是需要预先配置好的，为密码恢复做准备，示例如下：是在rommon中完成的 Example 4-49. Setting Up TFTP Parameters rommon #0> ADDRESS 192.168.10.1 rommon #1> SERVER 192.168.10.250 rommon #2> interface GigabitEthernet0/0 GigabitEthernet0/0 MAC Address: 000f.f775.4b54 rommon #3> file ASA702.bin rommon #4> set 检查参数 rommon #5> tftpdnld    开始下载