PIX 506 Password recovery

[zapanta.f]

All,

I just wanted to know if there is an effective way to recover a password on a pix 506e. The documentation on the this site does not work that way explained. Due to a recent ISP cut-over this morining at a client site they for got the password so I am unable to change the outside ip interface address to the new scheme. Please advise and thank you in advance.

-fz

[nefkensp]

For a password recovery on a pix, you need to

1) have physical access to the pix firewal console port

2) be able to reload the firewall in rommon mode

Check the following URL to see how the recovery of a pix password works:

http://www.cisco.com/en/US/products/hw/vpndevc/ps2030/products_password_recovery09186a008009478b.shtml

Hope this helps you a bit under way

[dougtempleton]

Sorry to butt into this thread unnanounced but I would also like to be able to factory reset a PIX506 that was donated to us by a neighbouring organisation that went into liquidation.

I have looked at the article on password recovery but I have two problems.

1. The PIX506 has no console cable. I have attempted to make one from a 9pin rs232 plug wired to an rj45 with a length of cat5 cable. I used the pinouts in the following doc (http://www.cisco.com/en/US/products/hw/vpndevc/ps2030/products_installation_guide_chapter09186a00800dff17_4container_ccmigration_09186a00801e8931.html)

I have connected this console cable and attepted a telnet to com1. I get nothing on screen though.

2. The article on password recovery mentions the 'password lockout utility' there are several releases of this and I'm unsure as to what version of the pix software this unit runs.

I don't duppose anyone has any further pointers, tips or advice for me do they?

Thanks if you do.

Doug.

[lavagecko]

I know this is over a year late, but I'm new to the forum. I had the same problem. The pinouts in the manual to build your own cable are not correct when trying to connect to a 'standard' PC COM (serial) port

The correct pinouts are as follows:

RJ45 1 -> 8 (not 7)

RJ45 2 -> 6 (not 4)

RJ45 3 -> 2 (not 3)

RJ45 4 -> 5 (as stated)

RJ45 5 -> 5 (as stated)

RJ45 6 -> 3 (not 2)

RJ45 7 -> 4 (not 6)

RJ45 8 -> 7 (not 8)

I constructed a working cable using the above. Hope this helps someone else, if not Doug.

[dougtempleton]

Thanks for sharing. :)

I'll give that a try this week if I get time. I had shelved this as a 'project for later'

So late or not, your post is very welcome.

Doug.

[lavagecko]

Don't forget that the RS232 'standard' was anything but. If my pinouts don't work for you, match the signal codes in the Cisco documentation with those for your serial port.

The other problem I ran into was finding the correct version of the unlock binary (nppix.bin, np50.bin, etc). Some even run and say the passwords have been reset, but don't actually do anything. So selecting the correct binary is essential.

Once you get serial communication established, let it boot up normally (without entering monitor mode). You'll see version information for the Embedded BIOS and 'Secure PIX Firewall BIOS'. These threw me off, and I tried to load the binary for these versions, without success.

Near the end of the initialization screens it will read Cisco PIX Firewall version X.X - that is the version you need to use when selecting the password recovery binary to upload to the PIX. You can set Hyperterminal to log the output to a text file, so you can examine the initialization info at your leisure.

Good luck!

[santukumar]

Plug ur console in the pix and reboot it.When it will boot then press ctrl+break key. After that u change the pix configuration register value to 0x41 and set the passwd and save & reboot.After that u again change the configuration register value to 0x01 and save the configuration.Finally u reboot it and work properly.