How to Factory Reset a Cisco Switch

Introduction

Every network administrator has faced that moment: a misconfigured switch causing network chaos, or inheriting a device with unknown credentials. Factory resetting a Cisco switch is your escape route from these situations, but it must be done correctly to avoid causing further issues.

This guide covers the three reset methods that actually apply to Catalyst switches - the Mode-button recovery, the modern factory-reset all command, and the classic write erase - with real output captured on a Catalyst 9000 (IOS XE 17.18) in our CML lab. It also clears up two myths that circulate in older guides: Catalyst switches do not use config-register 0x2142 for this (that is the router password-recovery procedure), and there are no default login credentials after a reset.

What you'll learn:

• The three reset methods and when each applies
• Best practices for pre-reset preparation
• Post-reset configuration steps
• Troubleshooting common issues

Understanding Factory Reset Basics

What is a Factory Reset?

A factory reset returns your Cisco switch to its original configuration, erasing all custom settings, including:

• VLANs
• IP addresses
• Security configurations
• User credentials
• Port configurations

🔍 Pro Tip: Always document your current configuration before performing a factory reset. You can use the show running-config command to save your settings.

When to Perform a Factory Reset

Common scenarios requiring a factory reset include:

• Lost admin passwords
• Severe misconfigurations
• Preparing devices for decommissioning
• Setting up new-to-you used equipment

Pre-Reset Preparation

Essential Steps Before Reset

1. Document current configuration
2. Back up important data
3. Verify console access
4. Prepare replacement configuration
5. Schedule maintenance window

⚠️ Warning: Performing a factory reset will disrupt network services. Ensure you have a maintenance window and have notified affected users.

Required Equipment

• Console cable
• Terminal emulator software
• Physical access to the switch
• Backup configuration files
• Network documentation

Step-by-Step Reset Methods

Method 1: write erase (you have CLI access)

If you can log in, this is the fastest path. Two files hold the configuration: startup-config in NVRAM, and the VLAN database in flash:vlan.dat. Erase both, then reload. Real output from our Catalyst 9000:

Switch# write erase
Erasing the nvram filesystem will remove all configuration files! Continue? [confirm]
[OK]
Erase of nvram: complete

Switch# delete flash:vlan.dat
Delete filename [vlan.dat]?
Delete bootflash:/vlan.dat? [confirm]

Switch# show startup-config
startup-config is not present

Switch# reload

Do not save the running configuration when the reload prompt offers it - saying yes would write the current config straight back to the startup-config you just erased. If you forget vlan.dat, the switch boots "clean" but the old VLANs come right back.

Method 2: factory-reset all (modern IOS XE)

Catalyst 9000-series switches (and other modern IOS XE platforms) have a dedicated command that goes further than write erase: it wipes all configuration, logs, and user files, and securely erases them, which is what you want before a device leaves your control:

Switch# factory-reset all

The switch lists what will be erased, asks for confirmation, then wipes and reloads - the process takes considerably longer than a plain write erase reload (expect 20+ minutes). Variants let you scope it: factory-reset config removes only the configuration, and factory-reset boot-vars resets boot variables. Use all for decommissioning, config for a quick clean slate.

Method 3: Mode-button recovery (locked out)

Lost the password? Classic Catalyst fixed switches (2960, 3560, 3750, and similar) use the physical Mode button to break into the boot loader, where you can delete the config files:

1. Power cycle the switch
2. Press and hold 'Mode' button during boot
3. Release when SYST LED turns amber
4. Switch enters boot loader (switch: prompt)
5. Type 'flash_init'
6. Type 'del flash:config.text'
7. Type 'del flash:vlan.dat'
8. Type 'boot'

One myth to retire: config-register 0x2142 is the router password-recovery procedure. Catalyst fixed switches do not use the configuration register for this - the Mode button and boot-loader route above is the switch procedure. (On Catalyst 9000, password recovery is also boot-loader based: break into ROMMON and set SWITCH_IGNORE_STARTUP_CFG=1.)

Expected Outcomes

After a successful reset:

• Switch boots with no startup configuration and offers the initial configuration dialog ("Would you like to enter the initial configuration dialog?")
• All ports in default VLAN 1
• Management interfaces unconfigured
• No login credentials at all - console access drops you at the Switch> prompt. Cisco switches have no default username/password; remote access stays impossible until you configure it

Post-Reset Configuration

Initial Setup Steps

1. Configure basic management access:

Switch> enable
Switch# configure terminal
Switch(config)# hostname [name]
Switch(config)# interface vlan 1
Switch(config-if)# ip address [ip] [mask]
Switch(config-if)# no shutdown

2. Set up secure access:

Switch(config)# username admin privilege 15 secret [password]
Switch(config)# line vty 0 15
Switch(config-line)# login local
Switch(config-line)# transport input ssh

Essential Security Configurations

3. Configure SSH and disable telnet:

Switch(config)# ip domain-name yourdomain.com
Switch(config)# crypto key generate rsa modulus 3072
Switch(config)# ip ssh version 2
Switch(config)# line vty 0 15
Switch(config-line)# transport input ssh
Switch(config-line)# exit

(Current IOS XE requires a 3072-bit RSA key minimum - the full walkthrough is in How to Enable SSH on Cisco Routers and Switches.)

Best Practices and Expert Tips

Security Considerations

• Set real credentials immediately (there are none after a reset)
• Enable SSH, disable telnet
• Configure VLAN segmentation
• Implement port security
• Set up access control lists (ACLs)
• Enable logging and monitoring

Common Mistakes to Avoid

1. Forgetting to document current configuration
2. Not having console access ready
3. Resetting during production hours
4. Neglecting to backup configurations
5. Forgetting to delete vlan.dat (the VLANs survive)
6. Not testing connectivity after reset

Troubleshooting Guide

Common Issues and Solutions

Verification Steps

After reset, verify:

1. Switch boots properly
2. Console access works
3. Basic connectivity is established
4. No error messages in logs
5. Port status is as expected

Quick Reference

Essential Commands

show running-config   ! View current configuration
write erase           ! Erase startup configuration
delete flash:vlan.dat ! Remove VLAN database
factory-reset all     ! Full secure wipe (modern IOS XE)
show version          ! Verify system status
show flash:           ! View flash contents
show boot             ! Check boot parameters

FAQ

Q: Will a factory reset erase the IOS image?
A: write erase and the Mode-button method only remove configuration files, not the operating system. factory-reset all keeps the booted image too, but wipes user-copied files from flash.

Q: Is there a default username and password after the reset?
A: No. Cisco switches ship with no login credentials - the console lands directly at the Switch> prompt, and remote access is impossible until you configure it. Any guide claiming default credentials after a reset is wrong (or talking about a different vendor).

Q: How long does the reset process take?
A: A write erase plus reload is typically 5-10 minutes. factory-reset all takes much longer (20+ minutes) because it securely erases storage.

Q: Can I recover deleted configurations?
A: Only if you backed them up before the reset.

Q: Do I need physical access to the switch?
A: For the Mode-button method, yes. write erase and factory-reset can be run over a console or remote session, but have console access ready - you will need it after the reload.

Conclusion

Factory resetting a Cisco switch comes down to picking the right method: write erase + delete flash:vlan.dat when you have access, factory-reset all when the device is leaving your hands, and the Mode-button boot-loader recovery when you are locked out. Skip the config-register folklore - that belongs to routers.

Next Steps

• Document your standard reset procedure
• Create a backup strategy for configurations
• Set up configuration templates for quick post-reset setup
• Implement monitoring to prevent future misconfigurations

More Cisco admin how-tos: Resetting Counters on Cisco Switches.