How to Erase a Cisco Switch

Whether you are preparing a Cisco Catalyst switch for redeployment in a new branch office, clearing a corrupted configuration in a lab environment, or wiping corporate hardware for secondary market resale, performing a thorough erase is a fundamental networking task. However, “erasing” a Cisco switch is not always as simple as entering a single reset command. Depending on the operating system version, the hardware generation, and your current access permissions, clearing configuration files requires specific command sequences across volatile and non-volatile storage.

This guide provides a comprehensive walkthrough for wiping Cisco switches across both classic Cisco IOS and modern Cisco IOS-XE platforms. It covers standard administrative CLI sequences, physical password recovery methods for locked hardware, modern zero-touch factory resets, and cryptographic sanitization protocols designed to meet rigorous enterprise compliance standards.

Understanding NVRAM vs. Flash: Why write erase Leaves VLANs Behind

A common stumbling block when resetting Cisco switches is running write erase, rebooting, and discovering that your custom VLANs, port assignments, and trunk configurations are still active. Understanding the division between Non-Volatile RAM (NVRAM) and Flash memory clarifies why this happens and how to prevent it.

What exactly does the write erase command remove?

The write erase command (an alias for erase startup-config or erase nvram:) instructs the switch to format its Non-Volatile RAM (NVRAM). This clears the stored startup-config file. It does not touch the operating system image, local licenses, boot variables, or file directories hosted in the switch’s local Flash memory (flash:).

Why do VLAN configurations persist after wiping NVRAM?

On Catalyst switches, VLAN definitions are not stored within the startup-config file if the switch runs in default VLAN Trunking Protocol (VTP) Client or Server mode. Instead, VTP maintains the VLAN database in a separate binary file called vlan.dat located directly in the root of the Flash filesystem (flash:vlan.dat). Because write erase targets exclusively NVRAM, vlan.dat remains untouched in Flash, and the switch re-reads all prior VLANs into the running configuration upon reboot.

What happens if you run delete vlan.dat without write erase?

Deleting only the VLAN database removes all custom VLAN numbers and names from the system. However, the interfaces still retain their configuration lines (such as switchport access vlan 20 or specific IP addresses assigned to Switch Virtual Interfaces) because those statements reside in NVRAM. To achieve a clean, factory-default state, you must clear both storage locations simultaneously.

Are boot parameters and license files stored in NVRAM?

Boot parameters, such as the BOOT environmental variable specifying which Cisco IOS binary to initialize, are managed as system environment variables written to internal ROM/NVRAM registers. Hardware and feature licenses are saved within dedicated Flash directories or protected non-volatile sectors. A standard configuration wipe will not unregister permanent licenses or break the boot path unless you format the underlying Flash storage.

Standard CLI Reset: Step-by-Step Guide for Classic Cisco IOS Switches

If you have administrative access (Privilege Level 15) via SSH, Telnet, or a direct serial console cable, use this sequence on classic Cisco Catalyst switches (such as the Catalyst 2960, 3560, and 3750 series) to restore factory defaults.

       Console / Terminal
               │
               ▼
      [ Enter Enable Mode ]
               │
               ▼
       [ `write erase` ]  ─────────► Clears NVRAM (startup-config)
               │
               ▼
   [ `delete flash:vlan.dat` ] ────► Clears VLAN Database
               │
               ▼
          [ `reload` ]
               │
               ▼
     Save config? -> "no" ─────────► Prevents re-writing memory
               │
               ▼
   [ Factory-Default Boot ]

Step 1: Elevate to Privileged EXEC Mode

Connect your terminal emulator to the switch (using standard serial settings: 9600 baud, 8 data bits, no parity, 1 stop bit, no flow control). Enter privileged mode using the enable command:

Switch> enable
Password: *********
Switch#

Step 2: Clear the Startup Configuration from NVRAM

Erase the non-volatile memory by issuing write erase or erase startup-config. Press Enter when prompted to confirm the operation:

Switch# write erase
Erasing the nvram filesystem will remove all configuration files! Continue? [confirm]
[OK]
Erase of nvram: complete

Step 3: Remove the VLAN Database from Flash Memory

Delete the vlan.dat file located in Flash. Press Enter through both verification prompts to confirm the file deletion:

Switch# delete flash:vlan.dat
Delete filename [vlan.dat]? 
Delete flash:/vlan.dat? [confirm]

Note: If the switch displays an error stating %Error deleting flash:vlan.dat (No such file or directory), the switch is operating in VTP Transparent mode or has not yet had custom VLANs created. You can safely proceed.

Step 4: Verify Flash Memory Contents

Run a directory check on the primary Flash partition to ensure the VLAN database is gone and that the valid .bin operating system image remains present:

Switch# dir flash:
Directory of flash:/

    2  -rwx     11732480   Mar 1 1993 00:02:18 +00:00  c2960-lanbasek9-mz.150-2.SE4.bin
    3  -rwx         2072   Mar 1 1993 00:02:45 +00:00  multiple-fs

57931776 bytes total (46197248 bytes free)

Step 5: Reload the Switch Without Saving

Initiate a reboot of the switch using the reload command. Pay close attention to the system prompts:

Switch# reload
System configuration has been modified. Save? [yes/no]: no
Proceed with reload? [confirm]

Critical Action: When the system prompts System configuration has been modified. Save? [yes/no]:, type no. Typing yes at this prompt will write the current running-config back into NVRAM, undoing the write erase command you just executed. Confirm the final prompt to begin the reboot cycle.

Password Recovery and Factory Wipe: Resetting via Mode Button and ROMMON

When locked out of a switch without administrative credentials, you cannot issue CLI reset commands. You must interact directly with the bootstrap firmware (ROMMON) using physical access to bypass the configuration register.

       [ Disconnect Power ]
                 │
                 ▼
 [ Hold Physical "Mode" Button ]
                 │
                 ▼
       [ Reconnect Power ]
                 │
                 ▼
  [ Release Button at Solid Green ]
                 │
                 ▼
       Terminal in ROMMON:
          `switch:`
                 │
                 ▼
       Execute `flash_init`
                 │
                 ▼
  Delete / Rename `config.text`
                 │
                 ▼
         Issue `boot`

Step 1: Set Up Console Access and Disconnect Power

Attach a rollover console cable from your computer to the switch’s RJ-45 or USB console port. Open your terminal emulator session. Disconnect the AC power cord from the rear of the switch chassis.

Step 2: Interrupt the Boot Loader Using the Mode Button

1. Press and hold down the physical Mode button located on the front panel of the switch.
2. While holding the button, reconnect the AC power cord.
3. Continue holding the Mode button until the SYST (System) LED flashes amber and then turns solid green (typically 10 to 15 seconds).
4. Release the Mode button. Your terminal screen will present the ROMMON prompt:

The system has been interrupted, or encountered an error 
during initialization. The following commands will finish 
loading the operating system software:

    flash_init
    boot

switch:

Step 3: Initialize the Flash File System

By default, ROMMON does not mount local storage. Run the flash_init command to initialize the internal Flash memory:

switch: flash_init
Initializing Flash...
...The flash is already initialized.

Step 4: Identify and Remove the Stored Configuration

List the contents of Flash to confirm the exact names of the configuration and VLAN files:

switch: dir flash:

Locate config.text (which contains the encrypted passwords and startup configuration) and vlan.dat. Delete them directly from the boot loader:

switch: delete flash:config.text
Are you sure you want to delete "flash:config.text" (y/n)? y

switch: delete flash:vlan.dat
Are you sure you want to delete "flash:vlan.dat" (y/n)? y

Alternative (Password Recovery without Configuration Loss): If you need to recover passwords rather than destroy the configuration, rename the file using rename flash:config.text flash:config.text.old. This allows you to boot the system cleanly, rename the file back in standard CLI, and modify only the enable secret line.

Step 5: Boot the Operating System

Start the standard Cisco IOS software by entering boot:

switch: boot

Because the switch cannot locate config.text or vlan.dat during boot, it loads with factory-default parameters and displays the initial setup dialog prompt: Would you like to enter the initial configuration dialog? [yes/no]:.

Modern Catalyst 9000 and 3850 Series: Executing factory-reset in Cisco IOS-XE

Enterprise switches built on Cisco IOS-XE (such as the Catalyst 3650, 3850, 9200, 9300, 9400, 9500, and 9600 series) feature an integrated factory reset engine. Rather than relying on multi-step deletions of individual files, Cisco IOS-XE includes the automated factory-reset privileged EXEC command.

+-----------------------------------------------------------------------------------+
|                        IOS-XE `factory-reset all` Workflow                         |
+-----------------------------------------------------------------------------------+
|                                                                                   |
|  1. Purges `startup-config` and `running-config` from NVRAM.                      |
|  2. Deletes all user files, crashinfo, tracelogs, and core dumps in `flash:`.     |
|  3. Removes all custom VLANs and Layer 2 databases.                               |
|  4. Deletes digital certificates, trustpoints, and generated crypto keys.         |
|  5. Preserves valid operating system packages / images (`packages.conf`).         |
|  6. Performs automated system restart into initial setup dialog.                  |
|                                                                                   |
+-----------------------------------------------------------------------------------+

Step 1: Verify Image Integrity and Boot Mode

Before triggering a comprehensive reset on Catalyst 9000 hardware, verify that your boot environment is stable and that you are operating in Install Mode:

Switch# show version | include Installation Mode
Installation Mode: INSTALL

Switch# dir flash:*.bin

Ensure that the operational system files (packages.conf and associated sub-packages) are present in root Flash so the switch can boot reliably after the wipe.

Step 2: Execute the Factory Reset Command

Run the factory-reset command with the all parameter:

Switch# factory-reset all

For modular or multi-member Cisco Catalyst Switch Stacks (StackWise-480/160), this command cascades across all stack members automatically.

Step 3: Confirm System Prompts

The switch will outline what data will be destroyed and request explicit confirmation:

The factory-reset all command will reset the system to factory default 
and remove all configurations, data files, trace logs, crash dumps, and 
keys. The system will be reloaded.

Do you want to continue? [confirm] y

Step 4: Allow Automated Sanitization and Reload

Once confirmed, the switch initiates an internal script that formats the NVRAM, clears user directories across Flash storage, scrubs active certificates and private keys, and triggers a controlled hardware reboot. The entire process takes between 5 and 15 minutes depending on chassis size and flash density.

Secure Sanitization for Disposal or Resale: Meeting NIST 800-88 Standards

When taking network infrastructure out of service, returning leased equipment, or shipping hardware for third-party recycling, standard reset commands leave residual digital artifacts behind. System logs, core dumps, and local cryptographic material can sometimes be recovered using low-level flash inspection tools. To comply with guidelines such as NIST SP 800-88 Rev. 1 (Guidelines for Media Sanitization), follow this secure purge sequence.

Step 1: Destroy Cryptographic Key Pairs and Certificates

Zeroize all asymmetric RSA, DSA, and ECDSA key pairs generated for SSH, SSL, and IPsec sessions. This invalidates any public/private key pairs stored in internal secure system memory:

Switch# configure terminal
Switch(config)# crypto key zeroize rsa
% All of your RSA keys will be removed.
% Reset all active SSH sessions? [confirm]: y
Switch(config)# crypto key zeroize ecdsa
Switch(config)# exit

Next, remove all installed public key infrastructure (PKI) certificates and CA trustpoints:

Switch# no crypto pki certificate pool
Switch# no crypto pki trustpoint <trustpoint_name>

Step 2: Scrub Diagnostic Artifacts, Crash Logs, and Hidden Directories

Inspect the Flash partition and any secondary storage (such as crashinfo: or USB ports) for residual diagnostic files:

Switch# dir flash:
Switch# dir crashinfo:

Recursively delete system trace logs, crash reports, and hidden directories:

Switch# delete /recursive /force flash:crashinfo*
Switch# delete /recursive /force flash:tracelogs*
Switch# delete /recursive /force flash:core*

Step 3: Run Secure Multi-Pass Overwrites (Platform Dependent)

On Cisco IOS-XE (Catalyst 9000):

Use the cryptographic secure wipe feature to overwrite storage blocks using DoD- and NIST-compliant multi-pass random data patterns:

Switch# factory-reset all secure 3-pass

This command performs three successive overwrite passes across the underlying flash blocks before unlinking tables, rendering previous file layers unrecoverable.

On Classic Cisco IOS (Catalyst 2960/3560/3750):

When running hardware that does not support the modern factory-reset utility, format the user data partitions directly, preserving only your gold-standard operating system image:

Switch# format flash:

(Ensure you maintain an active TFTP or console xmodem path if formatting unpartitioned legacy flash memory where the operational image resides).

Step 4: Purge NVRAM and Unset ROMMON Environment Variables

Force-erase NVRAM and scrub any persistent boot flags, IP settings, or console speed overrides:

Switch# erase /all /force nvram:

Enter configuration mode to ensure manual boot flags and password-recovery bypass bits are restored to production defaults:

Switch(config)# config-register 0x2102
Switch(config)# no system ignore startupconfig
Switch(config)# exit

Official Cisco Documentation and Platform Command Matrix

The following reference specifications reflect Cisco Technical Assistance Center (TAC) documentation standards for configuration sanitization across hardware architectures.

System Storage Architecture Definitions

• NVRAM: Non-volatile system memory accessed at nvram:. Houses startup-config and persistent environment registers.
• Flash: Primary solid-state embedded storage accessed as flash: (or bootflash: on select platforms). Stores binary images, package configurations, crash logs, and the vlan.dat database.
• ROMMON: Read-Only Memory Monitor bootstrap firmware layer. Runs diagnostic routines and boots operating system software independently of flash-resident operating configurations.

Platform-Specific Command Matrix

Pre-Reload Verification Checklist

Before issuing the final reload command, verify your switch meets these conditions:
1. dir nvram: shows zero bytes used or indicates startup-config is missing.
2. dir flash:vlan.dat returns %Error: No such file or directory.
3. show running-config has not been saved using write memory or copy running-config startup-config.
4. The system boot path variable matches a valid operating system file (show boot or show bootvar).

Conclusion

Erasing a Cisco switch requires choosing the right tool for your situation. For standard lab redeployments, clearing NVRAM with write erase and deleting flash:vlan.dat remains the standard CLI sequence. When you are locked out of a device, the front-panel Mode button provides direct access to ROMMON to bypass local credentials. For modern Catalyst 9000 installations running Cisco IOS-XE, the native factory-reset all command simplifies this workflow into a single operation. Finally, if you are decommissioning hardware or preparing devices for external resale, running cryptographic key zeroization alongside multi-pass storage scrubs ensures complete compliance with enterprise data-sanitization standards.

Please follow and like us: