How to Factory Reset Cisco 3850 Switch

The Cisco Catalyst 3850 Series switch is an enterprise workhorse, operating on Cisco IOS XE and supporting advanced Layer 2 and Layer 3 capabilities, StackWise-480, and integrated wireless controller features. Whether you are decommissioning hardware, repurposing an appliance for a new campus network topology, preparing gear for lab environments, or troubleshooting an unexpected lockout, wiping the device back to its original out-of-the-box state is a fundamental administrative task.

A factory reset on an IOS XE device requires more than merely purging NVRAM. Because VLAN databases, stack configurations, boot variables, and cryptographic keys reside in separate memory registers, executing an incomplete reset often leaves residual configurations intact. This guide provides comprehensive, step-by-step instructions for performing a complete factory reset across all operational scenarios—from standard CLI commands and ROMMON password recovery to switch stack teardowns, data sanitization, and compliance-grade documentation.

Standard Factory Reset via the Cisco IOS XE CLI

When privileged EXEC access (Switch#) is available via console, Telnet, or SSH, resetting a standalone Cisco Catalyst 3850 switch requires purging the startup configuration from NVRAM, deleting the Layer 2 VLAN database from flash memory, and rebooting without writing the current active memory back to disk.

Step 1: Establish Privileged EXEC Mode

Access the switch console or terminal session and enter privileged EXEC mode by providing the administrative credentials:

Switch> enable
Password: *********
Switch#

Step 2: Erase the Startup Configuration

Clear the configuration stored in NVRAM using the write erase or erase startup-config command. When prompted for confirmation, press Enter:

Switch# write erase
Erasing the nvram filesystem will remove all configuration files! Continue? [confirm]
[OK]
Erase of nvram: complete

Step 3: Delete the VLAN Database

The Cisco Catalyst 3850 stores standard VLAN definitions (VLANs 1 to 1005) in a dedicated binary database named vlan.dat located in flash memory. This file is completely independent of the startup configuration and will survive a write erase unless manually purged:

Switch# delete flash:vlan.dat
Delete filename [vlan.dat]? 
Delete flash:/vlan.dat? [confirm]

Press Enter at each prompt to confirm the deletion. If the switch reports %Error deleting flash:vlan.dat (No such file or directory), the switch is operating in VTP Transparent mode without local VLAN databases, meaning no further action is required for this step.

Step 4: Zeroize Cryptographic Keys (Recommended)

If the switch is being reallocated or decommissioned, purge any stored RSA, DSA, or ECDSA keys used for SSH authentication to prevent cryptographic identity leakage:

Switch(config)# crypto key zeroize rsa
% All user keys will be removed.
% All router keys will be removed.
Do you really want to remove these keys? [yes/no]: yes

Step 5: Reload the Switch Without Saving

Reboot the switch using the reload command. Critical warning: When the switch prompts whether to save system configuration modifications, explicitly type no. Choosing yes immediately writes the current running configuration into NVRAM, completely undoing the reset.

Switch# reload
System configuration has been modified. Save? [yes/no]: no
Proceed with reload? [confirm]

Once the switch finishes its boot cycle, the prompt will display the initial System Configuration Dialog (Would you like to enter the initial configuration dialog? [yes/no]:), verifying that the switch has successfully loaded default factory parameters.

Password Recovery and Factory Reset via ROMMON Mode

If administrative credentials are unknown or the local access accounts are locked, you cannot enter privileged EXEC mode. In this scenario, you must interrupt the normal boot sequence via the physical Mode button on the switch faceplate to access the bootloader (switch:) prompt and bypass configuration loading.

+-----------------------------------------------------------------------+
|  [Mode] [STAT] [DUPLX] [SPEED] [STACK] [PoE]          CISCO CATALYST  |
|   (o)    ( )     ( )     ( )     ( )    ( )                3850       |
+-----------------------------------------------------------------------+

Step 1: Connect the Console Cable

Connect a PC to either the RJ-45 console port or the mini-USB Type-B console port on the switch. Open a terminal emulator configured to:
– Baud Rate: 9600
– Data Bits: 8
– Parity: None
– Stop Bits: 1
– Flow Control: None

Step 2: Interrupt the Bootloader

1. Disconnect the AC power cord(s) from the rear of the switch.
2. Press and hold the physical Mode button on the front left of the switch panel.
3. Reconnect the power cord while keeping the Mode button pressed.
4. Continue holding the Mode button for approximately 12 to 15 seconds until the SYST (System) LED turns solid amber, then release the button.

The terminal window will display bootloader diagnostics and halt at the switch: prompt:

The system has been interrupted prior to initializing some filesystems.
switch: 

Step 3: Initialize Flash and Set the Ignore Flag

Initialize the internal flash file system so bootloader utilities can read local partitions:

switch: flash_init

Set the bootloader environmental variable that instructs Cisco IOS XE to ignore startup-config during system initialization:

switch: SWITCH_IGNORE_STARTUP_CFG=1

(Note: If password recovery was explicitly disabled via configuration prior to lockout, the bootloader will present a warning: Would you like to reset the system back to the default configuration (y/n)?. Entering y wipes the configuration automatically.)

Step 4: Boot the Operating System

Boot the switch into Cisco IOS XE:

switch: boot

(Alternatively, if an automatic boot path is not configured: boot flash:packages.conf).

Step 5: Wipe the System and Clear the Boot Variable

The switch will bypass authentication and load an empty configuration. Press Enter to bypass the initial configuration dialog.

Enter privileged EXEC mode (no password will be requested), wipe the existing startup configuration and VLAN database, and reset the bootloader ignore variable so subsequent boots behave normally:

Switch> enable
Switch# write erase
Switch# delete flash:vlan.dat
Switch# configure terminal
Switch(config)# no system ignore startupconfig switch all
Switch(config)# end
Switch# reload

When prompted to save configuration changes before reloading, type no and confirm.

Resetting Cisco Catalyst 3850 Stacks and Member Switches

Cisco Catalyst 3850 switches utilize StackWise-480 architecture to combine up to nine physical switches into a single logical management entity. Resetting stacked hardware requires distinguishing between resetting the entire logical stack versus detaching an individual member to return it to standalone operation.

Scenario A: Resetting an Entire StackWise-480 Stack

When you issue reset commands on the active switch (stack master), the configuration changes apply across all connected members:

1. Connect to the active switch console.
2. Clear the synchronized startup configuration:
   text
Stack-Master# write erase
3. Remove the stack VLAN database:
   text
Stack-Master# delete flash:vlan.dat
4. Reset individual stack member hardware priorities back to default (1) to prevent legacy role elections in future topologies:
   text
Stack-Master(config)# switch 1 priority 1
Stack-Master(config)# switch 2 priority 1
Stack-Master(config)# switch 3 priority 1
5. Reload the stack without saving:
   text
Stack-Master# reload

Scenario B: Unpairing a Stack Member for Standalone Use

When a single switch is physically unplugged from an existing stack, it often retains its stack member identification (e.g., Switch 3) and port numbering format (GigabitEthernet3/0/x). To restore an unpaired unit to an independent, factory-default “Switch 1”:

[Stack Ring] ---> [Power Down Member] ---> [Disconnect Stack Cables] ---> [Boot Standalone]

1. Power down the target switch and disconnect both StackWise-480 data cables and StackPower cables.
2. Power on the standalone switch and connect via console.
3. Verify the current member identity using show switch:
   “`text
   Switch# show switch
   Switch/Stack Mac Address : 00a3.d14c.2200
   H/W Current
   Switch# Role Mac Address Priority Version State

*3 Active 00a3.d14c.2200 1 V01 Ready
4. Renumber the switch back to `1`:text
Switch# switch 3 renumber 1
5. Reset the hardware priority to `1`:text
Switch(config)# switch 1 priority 1
6. Clear any remaining offline provisioned module profiles left over from the original stack:text
Switch(config)# no switch 2 provision
Switch(config)# no switch 3 provision
7. Perform standard file sanitization, erase NVRAM, and reload:text
Switch# write erase
Switch# delete flash:vlan.dat
Switch# reload
``
Upon reboot, the switch will identify as standalone Switch 1 with default port allocations (GigabitEthernet1/0/x`).

Data Persistence FAQ: What write erase Removes vs. Retains

Performing a routine configuration wipe does not erase every data structure residing within flash memory. Understanding file persistence is crucial for enterprise security and data privacy.

Does write erase delete vlan.dat?

No. The write erase command formats the nvram: filesystem where startup-config is saved. The Layer 2 VLAN database (vlan.dat) is stored on the local flash: file system. Because flash storage is separate from NVRAM, VLAN IDs and VTP domain data persist across reboots unless explicitly removed using delete flash:vlan.dat.

Are Cisco IOS XE software images or boot packages deleted?

No. The underlying operating system binaries (such as .bin installation files or extracted packages.conf subroutines) reside on flash: and remain untouched. Erasing startup configurations will not leave your switch without a bootable operating system.

Do permanent licenses and Smart Licensing registrations survive a reset?

Yes. Right-To-Use (RTU) permanent licenses, evaluation entitlements, and hardware-bound Universal Unique Device Identifier (UDI) certificates persist across standard resets. However, Cisco Smart Licensing tokens and local cloud registration states are cleared when the startup configuration is removed, requiring re-registration with Cisco Smart Software Manager (SSM) upon deployment.

Do SSH private keys and SSL certificates persist?

Partially. While the startup configuration referencing SSH/SSL certificates is removed, generated private keys stored within the non-volatile private-config partition can remain readable. Running crypto key zeroize rsa prior to reloading is required to purge these keys permanently.

What is the difference between write erase and the factory-reset command?

In later Cisco IOS XE releases (16.12.x and later), Cisco introduced the high-level factory-reset execution command. The table below contrasts the impact of each method:

If you are returning hardware for RMA or complete asset liquidation, using factory-reset all secure ensures absolute sanitization.

Automated CLI Command Template and Cheat Sheet

For network engineers wiping multiple Cisco Catalyst 3850 units in succession, the following script template executes a full configuration reset without hanging on interactive confirm prompts:

! =====================================================================
! CISCO CATALYST 3850 RAPID FACTORY RESET TEMPLATE
! =====================================================================
enable

! Step 1: Wipe startup configuration from NVRAM
write erase

! Step 2: Delete VLAN database without confirmation prompts
delete /force flash:vlan.dat

! Step 3: Zeroize cryptographic identities
configure terminal
 crypto key zeroize rsa
 exit

! Step 4: Ensure bootloader ignore variables are cleared
configure terminal
 no system ignore startupconfig switch all
 exit

! Step 5: Reload hardware immediately without saving running config
reload
no

Note: The /force switch flag bypasses file-deletion verification queries on compatible Cisco IOS XE versions.

Official Cisco Documentation and Compliance Standards

When maintaining infrastructure under regulated IT frameworks (such as ISO/IEC 27001, PCI-DSS, or DoD directives), administrators should align device sanitization processes with vendor-verified Cisco technical documentation.

Authoritative Cisco Documentation References

The procedures detailed in this guide comply with official Cisco publications:
– Password Recovery Procedures: Password Recovery Procedure for the Cisco Catalyst 3850 Series Switch (Document ID: EDCS-1153523), hosted on Cisco Support & Documentation.
– System Configuration Management: System Management Configuration Guide, Cisco IOS XE Release 3SE / 16.x (Catalyst 3850 Switches), chapters “Troubleshooting the Software Configuration” and “Managing Configuration Files.”
– Hardware Clearing and Sanitization: Factory Reset Guide for Cisco Catalyst 3850 and Catalyst 9000 Series Switches, outlining media sanitization implementations governed by NIST Special Publication 800-88 Revision 1 (Guidelines for Media Sanitization).

Compliance and RMA Guidelines

For hardware designated for Return Material Authorization (RMA) or transition across classification boundaries:
1. Ensure the platform is detached from active stacking rings.
2. For high-assurance environments, issue factory-reset all secure. This executes a cryptographic pattern overwrite across flash storage, effectively eliminating forensic recoverability while returning the processor to baseline ROMMON.
3. Maintain console logging outputs of the sanitization sequence as audit-ready evidence for system compliance records.

All authoritative software bundles, MD5/SHA-512 hashes, and release advisories should be accessed directly via Cisco Software Central (software.cisco.com) under the Catalyst 3850 product tree.

Executing a complete factory reset on a Cisco Catalyst 3850 switch involves addressing both NVRAM and the flash filesystem. By methodically wiping the startup configuration, removing vlan.dat, restoring stack member parameters to default, and clearing bootloader flags, you ensure the device cleanly reinitializes without orphaned configs or residual security vulnerabilities. Whether completed in minutes through privileged EXEC mode or recovered via physical ROMMON button access, following these validated procedures ensures your hardware is fully prepared for its next operational deployment.

Please follow and like us: