Device# factory-reset { all [ secure [ 3-pass ] ] | boot-vars | config }\n<\/code><\/pre>\nFor StackWise configurations where targeting a specific cluster node or every interconnected unit is necessary, use the stacking keyword extension:<\/p>\n
Device# factory-reset switch { <switch-number> | all } { all [ secure 3-pass ] | boot-vars | config }\n<\/code><\/pre>\n<\/span>Parameter Definitions<\/span><\/h3>\n\nall<\/code><\/strong>: Erases all NVRAM content, all user and system data directories, core dumps, crash files, boot variables, and all installed Cisco IOS-XE software bundles (including the running image). The switch terminates in ROMMON mode.<\/li>\nsecure<\/code><\/strong>: Initiates cryptographic data sanitization across non-volatile solid-state drives and embedded multimedia cards (eMMC). It executes media purge sequences conforming to NIST SP 800-88 Rev. 1 guidelines. Note that the secure<\/code> parameter is supported only on standalone switches and cannot be run across active stacking backplanes simultaneously.<\/li>\n3-pass<\/code><\/strong>: Augments the secure<\/code> parameter by performing a three-pass pseudo-random character write cycle compliant with legacy DoD 5220.22-M storage sanitization specifications.<\/li>\nconfig<\/code><\/strong>: Erases startup-config, running-config, interface configurations, and local credentials while deliberately keeping all IOS-XE software packages intact in flash memory. This keyword is not supported while the switch actively runs in multi-chassis StackWise or StackWise Virtual Link (SVL) operational mode.<\/li>\nboot-vars<\/code><\/strong>: Resets all user-defined boot variables (BOOT<\/code>, CONFIG_FILE<\/code>, etc.) to default system bootstrap vectors without modifying files stored on local disks.<\/li>\n<\/ul>\n<\/span>Preserved vs. Wiped Artifacts<\/span><\/h3>\nUnder an all<\/code> or all secure<\/code> directive, internal storage partitions are formatted. However, Cisco hardware roots of trust remain unaffected:<\/p>\n\n- Scrubbed Data<\/strong>: All system logs, Onboard Failure Logging (OBFL) user buffers, Cisco DNA \/ Catalyst Center staging credentials, local SSH\/RSA key pairs, customer-installed certificates, temporary files, and downloaded IOS-XE
.bin<\/code> and .pkg<\/code> files.<\/li>\n- Retained Data<\/strong>: Factory MAC addresses, serial numbers, hardware EEPROM settings, Secure Unique Device Identifier (SUDI) X.509 cryptographic certificates embedded during manufacturing, and Smart Licensing device registration reservations.<\/li>\n<\/ul>\n
\n<\/span>Step-by-Step CLI Factory Reset via Privileged EXEC Mode<\/span><\/h2>\nWhen privileged EXEC access (Device#<\/code>) is available via local console or out-of-band management, administrators can perform either a configuration wipe (retaining the OS) or an absolute system purge.<\/p>\n +--------------------------------------+\n | Privileged EXEC Access Available? |\n +--------------------------------------+\n |\n +-----------------+-----------------+\n | |\n v v\n [Routine Redeployment] [Asset Disposal \/ RMA]\n | |\n 1. write erase 1. factory-reset all\n 2. delete flash:vlan.dat 2. System reboots\n 3. reload (Answer 'no' to save) 3. Reloads into ROMMON\n | |\n v v\n (Boots fresh into setup) (Flash wiped; ready for\n clean OS re-installation)\n<\/code><\/pre>\n<\/span>Option 1: Standard Configuration Wipe (Keeps IOS-XE Intact)<\/span><\/h3>\nUse this method when re-staging the switch within your organization. It ensures the switch can reboot directly into the operating system without requiring an external USB drive or TFTP server.<\/p>\n
\n- Enter Privileged EXEC Mode<\/strong>
\ntext
\nDevice> enable
\nDevice#<\/code><\/li>\n- Erase the NVRAM File System<\/strong>
\nExecute the write erase<\/code> (or erase startup-config<\/code>) command to delete the startup configuration file.
\ntext
\nDevice# write erase
\nErasing the nvram filesystem will remove all configuration files! Continue? [confirm] <Press Enter>
\n[OK]
\nErase of nvram: complete<\/code><\/li>\n- Delete the VLAN Database<\/strong>
\nVLAN definitions in Cisco Catalyst switches are stored independently from the startup configuration in a separate file named vlan.dat<\/code> located in flash memory.
\ntext
\nDevice# delete flash:vlan.dat
\nDelete filename [vlan.dat]? <Press Enter>
\nDelete flash:\/vlan.dat? [confirm] <Press Enter><\/code>
\nNote: If vlan.dat<\/code> is not present, the switch is operating in VTP transparent mode or storing VLANs in the configuration file; disregard any “file not found” message.<\/em><\/li>\n- Verify Boot Path Integrity<\/strong>
\nConfirm that the boot environment variable is pointing to the active packages.conf<\/code> file to avoid an inadvertent drop to ROMMON:
\ntext
\nDevice# show boot<\/code>
\nIf the boot variable is unassigned, point it to the local package file:
\ntext
\nDevice(config)# boot system flash:packages.conf
\nDevice(config)# exit<\/code><\/li>\n- Reload the Switch Without Saving<\/strong>
\nIssue the reload<\/code> command. When IOS-XE prompts to save the modified system configuration, you must respond no<\/code><\/strong>. Answering yes<\/code> will copy the active running configuration into the startup configuration, undoing the erase operation.
\ntext
\nDevice# reload
\nSystem configuration has been modified. Save? [yes\/no]: no
\nProceed with reload? [confirm] <Press Enter><\/code><\/li>\n<\/ol>\nUpon rebooting, the switch will display the system setup dialog:<\/p>\n
--- System Configuration Dialog ---\nWould you like to enter the initial configuration dialog? [yes\/no]:\n<\/code><\/pre>\n
\n<\/span>Option 2: Full System Sanitization (factory-reset all<\/code>)<\/span><\/h3>\nUse this procedure to decommission hardware or sanitize storage for compliance. Ensure you have a console connection established, as all network management sessions will drop.<\/p>\n
\n- Execute the Factory Reset Routine<\/strong>
\ntext
\nDevice# factory-reset all<\/code>
\n(Optional for cryptographic sanitization: Device# factory-reset all secure 3-pass<\/code>)<\/em><\/li>\n- Acknowledge Confirmation Warnings<\/strong>
\nThe CLI will emit an explicit security warning that all customer data, licenses, and operating system packages will be permanently removed. Confirm the execution prompt.<\/li>\n- Allow Zeroization to Finish<\/strong>
\nThe switch will dismantle storage partitions, zeroize flash sectors, and execute a hardware reboot. Do not disconnect physical power during this phase. Once completed, the switch will stop at the switch:<\/code> bootloader prompt.<\/li>\n<\/ol>\n
\n<\/span>Password Recovery and Factory Reset via ROMMON Mode<\/span><\/h2>\nIf administrative passwords have been lost or the switch is locked due to an AAA misconfiguration, privileged EXEC access is unavailable. You can bypass authentication and wipe the system by physically interrupting the bootloader sequence via the front-panel Mode<\/strong> button.<\/p>\nPower On \/ Cycle Switch\n |\n v\nHold front-panel MODE button (10-15s) until SYST LED blinks amber\n |\n v\nDrops into ROMMON bootloader: switch:\n |\n v\nswitch: SWITCH_IGNORE_STARTUP_CFG=1\n |\n v\nswitch: boot flash:packages.conf\n |\n v\nBoots IOS-XE bypassing startup configuration\n |\n v\nDevice> enable (No password required)\n |\n v\nDevice# write erase\nDevice# delete flash:vlan.dat\nDevice(config)# no system ignore startupconfig switch all\n |\n v\nDevice# reload (Answer 'no' to configuration save prompt)\n<\/code><\/pre>\n<\/span>Step 1: Establish Physical and Console Connectivity<\/span><\/h3>\n\n- Attach an RJ-45 roll-over or USB Type-C console cable to the switch’s console port.<\/li>\n
- Open a terminal emulator with standard serial parameters:<\/li>\n
- Baud Rate<\/strong>: 9600<\/li>\n
- Data Bits<\/strong>: 8<\/li>\n
- Parity<\/strong>: None<\/li>\n
- Stop Bits<\/strong>: 1<\/li>\n
- Flow Control<\/strong>: None<\/li>\n<\/ol>\n
<\/span>Step 2: Interrupt the Boot Sequence<\/span><\/h3>\n\n- Disconnect the power cord from the power supply unit(s) to turn off the switch.<\/li>\n
- Reconnect the power cord.<\/li>\n
- Immediately press and hold the physical Mode<\/strong> button on the front left of the switch chassis.<\/li>\n
- Continue holding the button for approximately 10 to 15 seconds until the SYST<\/strong> (System) LED transitions to solid amber and then begins blinking amber. Release the button.<\/li>\n