How to Factory Reset Cisco 9300 Switch

Resetting a Cisco Catalyst 9300 Series enterprise switch to its original factory defaults is a routine yet critical task for network administrators. Whether preparing hardware for Return Material Authorization (RMA), repurposing switches across branch offices, breaking apart a StackWise cluster, or sanitizing storage media in compliance with corporate security standards, choosing the correct reset method determines whether existing operating system packages are preserved or completely scrubbed.

Because Catalyst 9300 switches operate on Cisco IOS-XE, the underlying architecture differs significantly from legacy Cisco Catalyst platforms. Administrators can execute traditional NVRAM wiping routines, utilize cryptographic data sanitization commands, or intervene at the hardware bootloader level using ROMMON mode when administrative access is locked. This comprehensive technical guide details every reset scenario, explores command syntax, outlines stack disassembly procedures, and provides actionable troubleshooting steps for boot recovery.

Cisco 9300 Reset Methods: factory-reset all vs. write erase

Before wiping any Catalyst 9300 switch, it is vital to distinguish between a logical configuration erase and a full cryptographic sanitization. Historically, administrators relied on write erase combined with deleting the VLAN database (vlan.dat). While this approach removes standard startup files, it leaves operating system images, crash logs, diagnostic information, and internal file system caches intact.

Modern IOS-XE releases introduce the factory-reset utility, which provides comprehensive data scrubbing aligned with NIST SP 800-88 media sanitization guidelines. The table below highlights the operational and architectural distinctions between these approaches.

Cisco IOS-XE factory-reset Command Syntax and Specifications

The factory-reset command subsystem operates under privileged EXEC mode within modern Cisco IOS-XE software trains (introduced systematically in Gibraltar 16.12.1r and standardized across Cupertino 17.9.x, Dublin 17.12.x, and later releases). It provides targeted arguments depending on whether your objective is resetting runtime parameters, scrubbing configuration files, or sanitizing entire flash storage partitions.

Validated Command Syntax

Device# factory-reset { all [ secure [ 3-pass ] ] | boot-vars | config }

For StackWise configurations where targeting a specific cluster node or every interconnected unit is necessary, use the stacking keyword extension:

Device# factory-reset switch { <switch-number> | all } { all [ secure 3-pass ] | boot-vars | config }

Parameter Definitions

• all: Erases all NVRAM content, all user and system data directories, core dumps, crash files, boot variables, and all installed Cisco IOS-XE software bundles (including the running image). The switch terminates in ROMMON mode.
• secure: Initiates cryptographic data sanitization across non-volatile solid-state drives and embedded multimedia cards (eMMC). It executes media purge sequences conforming to NIST SP 800-88 Rev. 1 guidelines. Note that the secure parameter is supported only on standalone switches and cannot be run across active stacking backplanes simultaneously.
• 3-pass: Augments the secure parameter by performing a three-pass pseudo-random character write cycle compliant with legacy DoD 5220.22-M storage sanitization specifications.
• config: Erases startup-config, running-config, interface configurations, and local credentials while deliberately keeping all IOS-XE software packages intact in flash memory. This keyword is not supported while the switch actively runs in multi-chassis StackWise or StackWise Virtual Link (SVL) operational mode.
• boot-vars: Resets all user-defined boot variables (BOOT, CONFIG_FILE, etc.) to default system bootstrap vectors without modifying files stored on local disks.

Preserved vs. Wiped Artifacts

Under an all or all secure directive, internal storage partitions are formatted. However, Cisco hardware roots of trust remain unaffected:

• Scrubbed Data: All system logs, Onboard Failure Logging (OBFL) user buffers, Cisco DNA / Catalyst Center staging credentials, local SSH/RSA key pairs, customer-installed certificates, temporary files, and downloaded IOS-XE .bin and .pkg files.
• Retained Data: Factory MAC addresses, serial numbers, hardware EEPROM settings, Secure Unique Device Identifier (SUDI) X.509 cryptographic certificates embedded during manufacturing, and Smart Licensing device registration reservations.

Step-by-Step CLI Factory Reset via Privileged EXEC Mode

When privileged EXEC access (Device#) is available via local console or out-of-band management, administrators can perform either a configuration wipe (retaining the OS) or an absolute system purge.

               +--------------------------------------+
               | Privileged EXEC Access Available?    |
               +--------------------------------------+
                                  |
                +-----------------+-----------------+
                |                                   |
                v                                   v
    [Routine Redeployment]                 [Asset Disposal / RMA]
                |                                   |
   1. write erase                         1. factory-reset all
   2. delete flash:vlan.dat               2. System reboots
   3. reload (Answer 'no' to save)        3. Reloads into ROMMON
                |                                   |
                v                                   v
     (Boots fresh into setup)              (Flash wiped; ready for
                                            clean OS re-installation)

Option 1: Standard Configuration Wipe (Keeps IOS-XE Intact)

Use this method when re-staging the switch within your organization. It ensures the switch can reboot directly into the operating system without requiring an external USB drive or TFTP server.

1. Enter Privileged EXEC Mode
   text
Device> enable
Device#
2. Erase the NVRAM File System
   Execute the write erase (or erase startup-config) command to delete the startup configuration file.
   text
Device# write erase
Erasing the nvram filesystem will remove all configuration files! Continue? [confirm] <Press Enter>
[OK]
Erase of nvram: complete
3. Delete the VLAN Database
   VLAN definitions in Cisco Catalyst switches are stored independently from the startup configuration in a separate file named vlan.dat located in flash memory.
   text
Device# delete flash:vlan.dat
Delete filename [vlan.dat]? <Press Enter>
Delete flash:/vlan.dat? [confirm] <Press Enter>
   Note: If vlan.dat is not present, the switch is operating in VTP transparent mode or storing VLANs in the configuration file; disregard any “file not found” message.
4. Verify Boot Path Integrity
   Confirm that the boot environment variable is pointing to the active packages.conf file to avoid an inadvertent drop to ROMMON:
   text
Device# show boot
   If the boot variable is unassigned, point it to the local package file:
   text
Device(config)# boot system flash:packages.conf
Device(config)# exit
5. Reload the Switch Without Saving
   Issue the reload command. When IOS-XE prompts to save the modified system configuration, you must respond no. Answering yes will copy the active running configuration into the startup configuration, undoing the erase operation.
   text
Device# reload
System configuration has been modified. Save? [yes/no]: no
Proceed with reload? [confirm] <Press Enter>

Upon rebooting, the switch will display the system setup dialog:

         --- System Configuration Dialog ---
Would you like to enter the initial configuration dialog? [yes/no]:

Option 2: Full System Sanitization (factory-reset all)

Use this procedure to decommission hardware or sanitize storage for compliance. Ensure you have a console connection established, as all network management sessions will drop.

1. Execute the Factory Reset Routine
   text
Device# factory-reset all
   (Optional for cryptographic sanitization: Device# factory-reset all secure 3-pass)
2. Acknowledge Confirmation Warnings
   The CLI will emit an explicit security warning that all customer data, licenses, and operating system packages will be permanently removed. Confirm the execution prompt.
3. Allow Zeroization to Finish
   The switch will dismantle storage partitions, zeroize flash sectors, and execute a hardware reboot. Do not disconnect physical power during this phase. Once completed, the switch will stop at the switch: bootloader prompt.

Password Recovery and Factory Reset via ROMMON Mode

If administrative passwords have been lost or the switch is locked due to an AAA misconfiguration, privileged EXEC access is unavailable. You can bypass authentication and wipe the system by physically interrupting the bootloader sequence via the front-panel Mode button.

Power On / Cycle Switch
         |
         v
Hold front-panel MODE button (10-15s) until SYST LED blinks amber
         |
         v
Drops into ROMMON bootloader:  switch:
         |
         v
switch: SWITCH_IGNORE_STARTUP_CFG=1
         |
         v
switch: boot flash:packages.conf
         |
         v
Boots IOS-XE bypassing startup configuration
         |
         v
Device> enable  (No password required)
         |
         v
Device# write erase
Device# delete flash:vlan.dat
Device(config)# no system ignore startupconfig switch all
         |
         v
Device# reload  (Answer 'no' to configuration save prompt)

Step 1: Establish Physical and Console Connectivity

1. Attach an RJ-45 roll-over or USB Type-C console cable to the switch’s console port.
2. Open a terminal emulator with standard serial parameters:
3. Baud Rate: 9600
4. Data Bits: 8
5. Parity: None
6. Stop Bits: 1
7. Flow Control: None

Step 2: Interrupt the Boot Sequence

1. Disconnect the power cord from the power supply unit(s) to turn off the switch.
2. Reconnect the power cord.
3. Immediately press and hold the physical Mode button on the front left of the switch chassis.
4. Continue holding the button for approximately 10 to 15 seconds until the SYST (System) LED transitions to solid amber and then begins blinking amber. Release the button.
5. The terminal console will cease autobooting and present the ROMMON prompt:
   text
switch:

Step 3: Set the Startup Bypass Environment Variable

Instruct the ROMMON environment to ignore the NVRAM startup configuration during boot. Note that ROMMON environment variables are case-sensitive.

switch: SWITCH_IGNORE_STARTUP_CFG=1

Step 4: Boot into Cisco IOS-XE

Initiate the boot routine using the local system package file:

switch: boot flash:packages.conf

(If the switch is running in bundle mode rather than install mode, list the storage directory with dir flash: and boot the primary binary image, for example: switch: boot flash:cat9k_iosxe.17.09.04a.SPA.bin)

Step 5: Execute the Factory Reset from Privileged EXEC

Once the operating system initializes, it will bypass stored passwords:

1. Decline the initial configuration wizard:
   text
Would you like to enter the initial configuration dialog? [yes/no]: no
2. Enter privileged EXEC mode (no credentials will be requested):
   text
Switch> enable
Switch#
3. Erase the configuration and VLAN database:
   text
Switch# write erase
Erasing the nvram filesystem will remove all configuration files! Continue? [confirm]
Switch# delete flash:vlan.dat
Delete filename [vlan.dat]?
Delete flash:/vlan.dat? [confirm]
4. Reset the bootloader ignore variable so future boots process fresh configuration files normally:
   text
Switch# configure terminal
Switch(config)# no system ignore startupconfig switch all
Switch(config)# exit
5. Reload the unit:
   text
Switch# reload
System configuration has been modified. Save? [yes/no]: no
Proceed with reload? [confirm]

The Catalyst 9300 will reboot as an unconfigured, factory-default standalone switch.

How to Factory Reset and Unstack a Catalyst 9300 Switch Stack

When Cisco Catalyst 9300 switches are grouped using StackWise-480 or StackWise-320 cables, they share an active management plane. Simply running write erase on the active stack master clears the running configuration but preserves stack member assignments (e.g., Switch 2, Switch 3) and hardware provisioning.

To return each member switch to an independent, out-of-the-box standalone state with interfaces numbered GigabitEthernet1/0/x, follow this sequence.

Step 1: Renumber Stack Members to Switch 1

Log in to the active switch console. Inspect your current stack topology:

Device# show switch
Switch/Stack Mac Address : 00a3.d143.5100 - Local Soft Macro Level
                                           H/W   Current
Switch#   Role    Mac Address     Priority Version  State
------------------------------------------------------------
*1       Active   00a3.d143.5100     15     V02     Ready
 2       Standby  00a3.d143.5280      1     V02     Ready
 3       Member   00a3.d143.5400      1     V02     Ready

To prevent a member switch from retaining its secondary stack number when isolated, renumber all non-master switches back to 1.

Device# switch 2 renumber 1
WARNING: Changing the switch number may result in a configuration change for that switch.
New Switch Number will be effective after next reboot. Do you want to continue?[y/n]? [yes]: yes

Device# switch 3 renumber 1
WARNING: Changing the switch number may result in a configuration change for that switch.
New Switch Number will be effective after next reboot. Do you want to continue?[y/n]? [yes]: yes

Reset switch priority ratings to default (1) across all units:

Device# configure terminal
Device(config)# switch 1 priority 1
Device(config)# exit

Step 2: Remove Provisioned Switch Declarations

If pre-provisioned interface configurations remain in NVRAM, remove them in global configuration mode:

Device(config)# no switch 2 provision
Device(config)# no switch 3 provision
Device(config)# exit

Step 3: Clear Configurations Across the Stack

Wipe the configuration and VLAN records from the cluster master:

Device# write erase
Erasing the nvram filesystem will remove all configuration files! Continue? [confirm]
Device# delete flash:vlan.dat
Delete filename [vlan.dat]? 
Delete flash:/vlan.dat? [confirm]

Step 4: Power Down and Disconnect Physical Stack Links

1. Power off all switches in the stack simultaneously by removing their AC power cables.
2. Unscrew and disconnect all StackWise physical data cables linking the rear backplanes.
3. Disconnect all StackPower cables linking the units.
4. Verify that each switch chassis is completely isolated from a cabling perspective.

Step 5: Power On Each Switch Standalone and Confirm State

1. Power on the switches individually, connecting your console cable to each switch one by one.
2. When prompted: Would you like to enter the initial configuration dialog? [yes/no]:, type no.
3. Check the switch membership table:
   “`text
   Switch# show switch
   Switch# Role Mac Address Priority Version State

*1 Active 00a3.d143.5280 1 V02 Ready
``
4. Verify interface definitions viashow ip interface brief. All interfaces must display starting with unit number 1 (e.g.,GigabitEthernet1/0/1orTenGigabitEthernet1/0/1). If an isolated switch still boots as Switch 2 or Switch 3, executeswitch renumber 1locally and issuereload`.

Troubleshooting: Cisco 9300 Stuck at the switch: ROMMON Prompt

A Catalyst 9300 drops into the switch: bootloader prompt when it cannot find a valid operating system, when boot variables are pointing to non-existent images, or when a full factory-reset all operation has cleared flash storage.

Console shows:  switch:
               |
               v
Check flash contents:  switch: dir flash:
               |
      +--------+--------+
      |                 |
(packages.conf     (Flash is empty /
 or .bin exists)    image wiped)
      |                 |
      v                 v
1. Boot manually:     1. Insert FAT32 USB with valid IOS-XE .bin
   switch: boot          image into front USB port
   flash:packages.conf   
                      2. Verify USB:
2. Once booted into      switch: dir usbflash0:
   IOS-XE, set:       
   boot system        3. Execute emergency recovery:
   flash:packages.conf   switch: emergency-install
                         usbflash0:cat9k_iosxe.<ver>.SPA.bin
3. Clear variables:   
   switch: unset         Switch formats flash, expands packages,
   MANUAL_BOOT           and boots clean into fresh setup.

Why did my Catalyst 9300 boot into ROMMON mode after a factory reset?

If you executed factory-reset all, this behavior is completely expected. The all argument wipes all installed IOS-XE software bundles, package descriptors, and user configurations from internal flash. Because the internal file system contains no bootable operating system files, the hardware drops into the ROMMON bootloader.

If you used write erase, the switch drops to ROMMON because the BOOT variable was not persistently written or the MANUAL_BOOT parameter was set to active in the environment variables.

How do I manually boot IOS-XE if the package files are still stored on internal flash?

1. Inspect the contents of your internal flash memory:
   text
switch: dir flash:
2. Look for the consolidated provisioning file named packages.conf or a monolithic installation binary ending in .bin (such as cat9k_iosxe.17.09.04a.SPA.bin).
3. If packages.conf is present, boot the switch directly:
   text
switch: boot flash:packages.conf
4. If individual sub-package files (.pkg) are missing or damaged, locate the backup .bin bundle and boot it:
   text
switch: boot flash:cat9k_iosxe.17.09.04a.SPA.bin

How do I recover a wiped switch using a USB flash drive and emergency-install?

When flash is empty following an absolute sanitization wipe, you must recover the operating system using an external USB drive.

1. Obtain a standard USB 2.0/3.0 flash drive formatted strictly with a FAT32 file system (drives larger than 32 GB formatted as exFAT or NTFS will not mount reliably in ROMMON).
2. Download a validated Cisco Catalyst 9300 IOS-XE .bin release from the Cisco Software Central repository and copy it directly to the root of the USB drive.
3. Insert the USB drive into the front-panel USB Type-A port of the Catalyst 9300.
4. Verify that ROMMON detects the external drive and its contents:
   text
switch: dir usbflash0:
5. Initiate an emergency recovery install. This built-in bootloader utility formats the internal flash memory, expands the binary bundle into its underlying sub-packages, creates a valid packages.conf manifest, and automatically boots the switch into IOS-XE:
   text
switch: emergency-install usbflash0:cat9k_iosxe.17.09.04a.SPA.bin
   Do not interrupt power while the ROMMON recovery utility partitions the drive and extracts system software.

Why does the switch continue returning to the switch: prompt on every reboot?

If the switch successfully loads IOS-XE when manually commanded but falls back into ROMMON after every power cycle or reboot, an environment variable override is active.

1. At the switch: prompt, check the environment variables:
   text
switch: set
2. Locate the MANUAL_BOOT and SWITCH_IGNORE_STARTUP_CFG entries:
3. If MANUAL_BOOT=yes (or 1), the bootstrap is explicitly configured to stop and wait for manual user input on every boot.
4. If SWITCH_IGNORE_STARTUP_CFG=1, the switch ignores NVRAM every boot.
5. Clear these variables:
   text
switch: unset MANUAL_BOOT
switch: unset SWITCH_IGNORE_STARTUP_CFG
6. Verify the persistent boot variable is defined:
   text
switch: set BOOT=flash:packages.conf
7. Issue the reset command to restart the switch:
   text
switch: reset

How do I fix the boot path permanently inside IOS-XE once the switch has booted?

Once you are logged into privileged EXEC mode in IOS-XE, ensure the system never loses track of its boot source:

1. Enter global configuration mode:
   text
Device# configure terminal
2. Clear any stale boot statements and set the primary boot image to packages.conf:
   text
Device(config)# no boot system
Device(config)# boot system flash:packages.conf
Device(config)# exit
3. Commit the change to NVRAM:
   text
Device# write memory
4. Verify the active boot variables:
   text
Device# show boot
   Both BOOT variable and Configuration register must reflect the primary package path, ensuring that all subsequent reboots load the clean, factory-default configuration automatically.

Factory resetting a Cisco Catalyst 9300 switch requires aligning the chosen method with your operational objective: use write erase alongside delete flash:vlan.dat for fast, non-destructive enterprise redeployment, or deploy factory-reset all secure when compliance mandates complete cryptographic storage sanitization. Following the post-reset verification steps ensures your switches boot cleanly into the initial configuration dialog—ready for immediate standalone provisioning or automated onboarding into Cisco Catalyst Center.

Please follow and like us: