Cisco IOS Maintenance and Recovery: TFTP, Images, ROMMON, and Lab Tools

Overview

This guide provides a CCNA-level introduction to backing up, restoring, upgrading, and recovering Cisco IOS devices. It also covers Packet Tracer, GNS3, Cisco Modeling Labs (CML), Wireshark, Windows OpenSSH, PuTTY, PuTTYgen, and Pageant.

1. Cisco Device Storage

RAM holds the running-config and operational state. NVRAM commonly stores startup-config. Flash or bootflash stores IOS images and related files. ROM loads the bootstrap; ROMMON is the recovery shell when normal boot fails.

show version
show boot
show file systems
dir
dir flash:
dir bootflash:
show running-config
show startup-config

2. TFTP Fundamentals

Trivial File Transfer Protocol (TFTP) uses UDP port 69. It is simple but has no built-in encryption or authentication — use it only on trusted or isolated networks.

Requirements:

• The TFTP server must allow the device to read or write files.
• Firewalls and Windows network profiles can block transfers.
• The Cisco device needs IP connectivity to the server.

ping <TFTP-SERVER-IP>
show ip interface brief
show file systems
dir flash:

3. Backing Up Configurations

copy running-config tftp:
copy startup-config tftp:

Typical interactive prompts:

Address or name of remote host []?
Destination filename [R1-confg]?

Use clear filenames such as:

• R1-running-2026-07-10.cfg
• R1-startup-known-good.cfg

4. Restoring a Known-Good Configuration

copy tftp: startup-config
reload

copy tftp: running-config

Where supported (platform- and IOS-dependent):

configure replace tftp://192.0.2.10/R1-known-good.cfg force

Check support with configure replace ? on your device.

5. Backing Up and Copying IOS Images

copy flash:<IMAGE-NAME.bin> tftp:
copy tftp: flash:

On many newer platforms, use bootflash: instead of or in addition to flash:.

6. Pre-Upgrade Checklist

1. Confirm the exact device model.
2. Check current IOS or IOS XE version.
3. Read the release notes.
4. Check memory and flash requirements.
5. Confirm licensing and entitlement.
6. Back up running-config.
7. Back up startup-config.
8. Record existing boot variables.
9. Keep the current working image.
10. Verify the new image hash.
11. Ensure console or out-of-band access.
12. Schedule an appropriate maintenance window.
13. Have a rollback plan.

show version
show inventory
show boot
show license summary
show file systems
dir flash:
dir bootflash:

7. Image Integrity Verification

verify /md5 flash:<IMAGE-NAME.bin>

Supported hash options vary by platform and release. Compare the calculated hash with the value published by the authorized software source.

8. Classic IOS Boot Variables

configure terminal
no boot system
boot system flash:<IMAGE-NAME.bin>
end
copy running-config startup-config
show boot

Some devices use bootflash. Some IOS XE systems boot from packages.conf. Always check the platform-specific upgrade procedure.

9. Cisco Software Image Types

At CCNA scope, recognize these naming patterns:

Feature availability depends on hardware, IOS release, license, Smart Licensing status, and image family. Not every k9 image supports every SSH or cryptographic feature.

10. Legal Sources for IOS Images

• Physical-device software should come from Cisco's official software download service or another authorized source.
• Downloads may require a Cisco account and valid entitlement.
• Do not use torrents, random archive sites, file-sharing forums, or unverified images.
• Cisco Modeling Labs includes licensed virtual reference platforms — licensing terms control usage.
• Packet Tracer includes simulated devices — students do not need to locate IOS images.
• GNS3 does not legally provide proprietary Cisco IOS images for download.

11. ROMMON and the Configuration Register

ROMMON (ROM monitor) is the low-level recovery environment when normal IOS boot fails.

Classic configuration-register values on many traditional routers:

rommon 1 > confreg 0x2142
rommon 2 > reset

After boot:

enable
copy startup-config running-config
configure terminal
enable secret <NEW-SECRET>
config-register 0x2102
end
copy running-config startup-config
reload

Why copy startup-config to running-config first? The running configuration is minimal after 0x2142 boot — you must load the saved config before changing credentials.

Failing to restore config-register 0x2102 may cause the router to continue ignoring startup-config on every reload.

12. Older Catalyst Switch Password Recovery

switch: flash_init
switch: dir flash:
switch: rename flash:config.text flash:config.old
switch: boot

After boot, restore and merge:

rename flash:config.old flash:config.text
copy flash:config.text running-config

Then change credentials and save. Some switches use the Mode button during recovery. VLAN data may be stored separately from config.text.

13. Missing or Damaged IOS Image

High-level recovery options (platform-dependent):

• Boot another valid image already in flash
• Boot from USB when supported
• ROMMON network recovery when supported
• TFTP recovery when supported
• XMODEM on some older devices (slow last resort)
• IOS XE install or recovery procedures on newer platforms
• Restore boot variables after recovery

14. Packet Tracer, GNS3, CML, and Physical Hardware

15. Capturing Traffic With Wireshark

GNS3 link capture

1. Start both virtual devices.
2. Right-click the link.
3. Select Start Capture.
4. Open the capture in Wireshark.
5. Generate test traffic.
6. Apply a display filter.
7. Stop and save the capture if needed.

Useful display filters:

Telnet vs SSH exercise

1. Start a Telnet session and inspect packets — contents are readable in cleartext.
2. Start an SSH session — payload is encrypted.
3. Do not use real credentials in the Telnet demonstration.

Physical-network capture may require a network TAP, hub, switch port mirroring (SPAN), or capturing directly from the endpoint.

16. DNS Testing With nslookup

nslookup example.com
nslookup example.com 192.0.2.53
nslookup
set type=mx
example.com
exit

Concepts:

• Forward lookup — name to IP
• Querying a specific DNS server — second form above
• Record types — A, MX, etc.
• NXDOMAIN — name does not exist
• DNS failure vs IP connectivity failure — ping the server IP if DNS fails

PowerShell (when available):

Resolve-DnsName example.com

17. Windows OpenSSH

ssh [email protected]
ssh -v [email protected]
ssh-keygen
ssh-add
ssh-add -l

• Modern Windows includes a built-in OpenSSH client.
• -v provides troubleshooting output.
• Host-key warnings should not be ignored without verifying why the key changed.
• Older Cisco hardware may support limited SSH algorithms that modern clients disable by default.

18. PuTTY, PuTTYgen, and Pageant

Cisco public-key authentication on IOS varies significantly by version — treat as an advanced topic beyond CCNA core configuration.

19. Recovery and Upgrade Verification

Post-change checklist:

show version
show boot
show logging
show ip interface brief
show interfaces status
show ip route
show cdp neighbors
show license summary
show running-config
ping <NEXT-HOP>
copy running-config startup-config

A device reaching the CLI does not by itself prove recovery or upgrade is complete. Also verify:

• Interfaces and VLANs
• Routing and neighbor relationships
• Management access
• Licensing
• Logs
• Boot variables
• Saved configuration

20. Final Lab Exercises

Exercise 1: Back up a router's running and startup configurations to TFTP.

Exercise 2: Change the hostname, restore the startup configuration from TFTP, and reload.

Exercise 3: Capture a Telnet session and an SSH session in GNS3 and compare cleartext vs encrypted payloads.

Exercise 4: Use nslookup against the default DNS server, then against a specific DNS server.

Exercise 5: Inspect flash, boot variables, IOS version, and file systems without making changes.

Exercise 6: Write a recovery plan for a router whose primary IOS image is missing — include alternate boot sources, TFTP/ROMMON options for your platform, and rollback steps. Do not intentionally erase flash or brick a device for this exercise.