Switch# delete flash:vlan.dat\nDelete filename [vlan.dat]? \nDelete flash:\/vlan.dat? [confirm]\n<\/code><\/pre>\nPress Enter<\/strong> at each prompt to confirm the deletion. If the switch reports %Error deleting flash:vlan.dat (No such file or directory)<\/code>, the switch is operating in VTP Transparent mode without local VLAN databases, meaning no further action is required for this step.<\/p>\n<\/span>Step 4: Zeroize Cryptographic Keys (Recommended)<\/span><\/h3>\nIf the switch is being reallocated or decommissioned, purge any stored RSA, DSA, or ECDSA keys used for SSH authentication to prevent cryptographic identity leakage:<\/p>\n
Switch(config)# crypto key zeroize rsa\n% All user keys will be removed.\n% All router keys will be removed.\nDo you really want to remove these keys? [yes\/no]: yes\n<\/code><\/pre>\n<\/span>Step 5: Reload the Switch Without Saving<\/span><\/h3>\nReboot the switch using the reload<\/code> command. Critical warning:<\/strong> When the switch prompts whether to save system configuration modifications, explicitly type no<\/code>. Choosing yes<\/code> immediately writes the current running configuration into NVRAM, completely undoing the reset.<\/p>\nSwitch# reload\nSystem configuration has been modified. Save? [yes\/no]: no\nProceed with reload? [confirm]\n<\/code><\/pre>\nOnce the switch finishes its boot cycle, the prompt will display the initial System Configuration Dialog (Would you like to enter the initial configuration dialog? [yes\/no]:<\/code>), verifying that the switch has successfully loaded default factory parameters.<\/p>\n
\n<\/span>Password Recovery and Factory Reset via ROMMON Mode<\/span><\/h2>\nIf administrative credentials are unknown or the local access accounts are locked, you cannot enter privileged EXEC mode. In this scenario, you must interrupt the normal boot sequence via the physical Mode<\/strong> button on the switch faceplate to access the bootloader (switch:<\/code>) prompt and bypass configuration loading.<\/p>\n+-----------------------------------------------------------------------+\n| [Mode] [STAT] [DUPLX] [SPEED] [STACK] [PoE] CISCO CATALYST |\n| (o) ( ) ( ) ( ) ( ) ( ) 3850 |\n+-----------------------------------------------------------------------+\n<\/code><\/pre>\n<\/span>Step 1: Connect the Console Cable<\/span><\/h3>\nConnect a PC to either the RJ-45 console port or the mini-USB Type-B console port on the switch. Open a terminal emulator configured to:
\n– Baud Rate:<\/strong> 9600
\n– Data Bits:<\/strong> 8
\n– Parity:<\/strong> None
\n– Stop Bits:<\/strong> 1
\n– Flow Control:<\/strong> None<\/p>\n<\/span>Step 2: Interrupt the Bootloader<\/span><\/h3>\n\n- Disconnect the AC power cord(s) from the rear of the switch.<\/li>\n
- Press and hold the physical Mode<\/strong> button on the front left of the switch panel.<\/li>\n
- Reconnect the power cord while keeping the Mode<\/strong> button pressed.<\/li>\n
- Continue holding the Mode<\/strong> button for approximately 12 to 15 seconds until the SYST<\/strong> (System) LED turns solid amber, then release the button.<\/li>\n<\/ol>\n
The terminal window will display bootloader diagnostics and halt at the switch:<\/code> prompt:<\/p>\nThe system has been interrupted prior to initializing some filesystems.\nswitch: \n<\/code><\/pre>\n<\/span>Step 3: Initialize Flash and Set the Ignore Flag<\/span><\/h3>\nInitialize the internal flash file system so bootloader utilities can read local partitions:<\/p>\n
switch: flash_init\n<\/code><\/pre>\nSet the bootloader environmental variable that instructs Cisco IOS XE to ignore startup-config<\/code> during system initialization:<\/p>\nswitch: SWITCH_IGNORE_STARTUP_CFG=1\n<\/code><\/pre>\n(Note: If password recovery was explicitly disabled via configuration prior to lockout, the bootloader will present a warning: Would you like to reset the system back to the default configuration (y\/n)?<\/code>. Entering y<\/code> wipes the configuration automatically.)<\/em><\/p>\n<\/span>Step 4: Boot the Operating System<\/span><\/h3>\nBoot the switch into Cisco IOS XE:<\/p>\n
switch: boot\n<\/code><\/pre>\n(Alternatively, if an automatic boot path is not configured: boot flash:packages.conf<\/code>).<\/em><\/p>\n<\/span>Step 5: Wipe the System and Clear the Boot Variable<\/span><\/h3>\nThe switch will bypass authentication and load an empty configuration. Press Enter<\/strong> to bypass the initial configuration dialog.<\/p>\nEnter privileged EXEC mode (no password will be requested), wipe the existing startup configuration and VLAN database, and reset the bootloader ignore variable so subsequent boots behave normally:<\/p>\n
Switch> enable\nSwitch# write erase\nSwitch# delete flash:vlan.dat\nSwitch# configure terminal\nSwitch(config)# no system ignore startupconfig switch all\nSwitch(config)# end\nSwitch# reload\n<\/code><\/pre>\nWhen prompted to save configuration changes before reloading, type no<\/code> and confirm.<\/p>\n
\n<\/span>Resetting Cisco Catalyst 3850 Stacks and Member Switches<\/span><\/h2>\nCisco Catalyst 3850 switches utilize StackWise-480 architecture to combine up to nine physical switches into a single logical management entity. Resetting stacked hardware requires distinguishing between resetting the entire logical stack versus detaching an individual member to return it to standalone operation.<\/p>\n
<\/span>Scenario A: Resetting an Entire StackWise-480 Stack<\/span><\/h3>\nWhen you issue reset commands on the active switch (stack master), the configuration changes apply across all connected members:<\/p>\n
\n- Connect to the active switch console.<\/li>\n
- Clear the synchronized startup configuration:
\ntext
\nStack-Master# write erase<\/code><\/li>\n- Remove the stack VLAN database:
\ntext
\nStack-Master# delete flash:vlan.dat<\/code><\/li>\n- Reset individual stack member hardware priorities back to default (1) to prevent legacy role elections in future topologies:
\ntext
\nStack-Master(config)# switch 1 priority 1
\nStack-Master(config)# switch 2 priority 1
\nStack-Master(config)# switch 3 priority 1<\/code><\/li>\n- Reload the stack without saving:
\ntext
\nStack-Master# reload<\/code><\/li>\n<\/ol>\n<\/span>Scenario B: Unpairing a Stack Member for Standalone Use<\/span><\/h3>\nWhen a single switch is physically unplugged from an existing stack, it often retains its stack member identification (e.g., Switch 3) and port numbering format (GigabitEthernet3\/0\/x<\/code>). To restore an unpaired unit to an independent, factory-default “Switch 1”:<\/p>\n[Stack Ring] ---> [Power Down Member] ---> [Disconnect Stack Cables] ---> [Boot Standalone]\n<\/code><\/pre>\n\n- Power down<\/strong> the target switch and disconnect both StackWise-480 data cables and StackPower cables.<\/li>\n
- Power on the standalone switch and connect via console.<\/li>\n
- Verify the current member identity using
show switch<\/code>:
\n“`text
\nSwitch# show switch
\nSwitch\/Stack Mac Address : 00a3.d14c.2200
\nH\/W Current
\nSwitch# Role Mac Address Priority Version State<\/li>\n<\/ol>\n
\n*3 Active 00a3.d14c.2200 1 V01 Ready
\n4. Renumber the switch back to `1`:<\/code>text
\nSwitch# switch 3 renumber 1
\n5. Reset the hardware priority to `1`:<\/code>text
\nSwitch(config)# switch 1 priority 1
\n6. Clear any remaining offline provisioned module profiles left over from the original stack:<\/code>text
\nSwitch(config)# no switch 2 provision
\nSwitch(config)# no switch 3 provision
\n7. Perform standard file sanitization, erase NVRAM, and reload:<\/code>text
\nSwitch# write erase
\nSwitch# delete flash:vlan.dat
\nSwitch# reload
\n``
\nUpon reboot, the switch will identify as standalone Switch 1 with default port allocations (<\/code>GigabitEthernet1\/0\/x`).<\/p>\n
\n<\/span>Data Persistence FAQ: What write erase Removes vs. Retains<\/span><\/h2>\nPerforming a routine configuration wipe does not erase every data structure residing within flash memory. Understanding file persistence is crucial for enterprise security and data privacy.<\/p>\n
<\/span>Does write erase<\/code> delete vlan.dat<\/code>?<\/span><\/h3>\nNo.<\/strong> The write erase<\/code> command formats the nvram:<\/code> filesystem where startup-config<\/code> is saved. The Layer 2 VLAN database (vlan.dat<\/code>) is stored on the local flash:<\/code> file system. Because flash storage is separate from NVRAM, VLAN IDs and VTP domain data persist across reboots unless explicitly removed using delete flash:vlan.dat<\/code>.<\/p>\n<\/span>Are Cisco IOS XE software images or boot packages deleted?<\/span><\/h3>\nNo.<\/strong> The underlying operating system binaries (such as .bin<\/code> installation files or extracted packages.conf<\/code> subroutines) reside on flash:<\/code> and remain untouched. Erasing startup configurations will not leave your switch without a bootable operating system.<\/p>\n<\/span>Do permanent licenses and Smart Licensing registrations survive a reset?<\/span><\/h3>\nYes.<\/strong> Right-To-Use (RTU) permanent licenses, evaluation entitlements, and hardware-bound Universal Unique Device Identifier (UDI) certificates persist across standard resets. However, Cisco Smart Licensing tokens and local cloud registration states are cleared when the startup configuration is removed, requiring re-registration with Cisco Smart Software Manager (SSM) upon deployment.<\/p>\n<\/span>Do SSH private keys and SSL certificates persist?<\/span><\/h3>\nPartially.<\/strong> While the startup configuration referencing SSH\/SSL certificates is removed, generated private keys stored within the non-volatile private-config<\/code> partition can remain readable. Running crypto key zeroize rsa<\/code> prior to reloading is required to purge these keys permanently.<\/p>\n<\/span>What is the difference between write erase<\/code> and the factory-reset<\/code> command?<\/span><\/h3>\nIn later Cisco IOS XE releases (16.12.x and later), Cisco introduced the high-level factory-reset<\/code> execution command. The table below contrasts the impact of each method:<\/p>\n\n\n\n| Feature \/ Data Component<\/th>\n | write erase<\/code> + delete flash:vlan.dat<\/code><\/th>\n |