<\/span><\/h2>\nA common stumbling block when resetting Cisco switches is running write erase<\/code>, rebooting, and discovering that your custom VLANs, port assignments, and trunk configurations are still active. Understanding the division between Non-Volatile RAM (NVRAM) and Flash memory clarifies why this happens and how to prevent it.<\/p>\n<\/span>What exactly does the write erase<\/code> command remove?<\/span><\/h3>\nThe write erase<\/code> command (an alias for erase startup-config<\/code> or erase nvram:<\/code>) instructs the switch to format its Non-Volatile RAM (NVRAM). This clears the stored startup-config<\/code> file. It does not touch the operating system image, local licenses, boot variables, or file directories hosted in the switch’s local Flash memory (flash:<\/code>).<\/p>\n<\/span>Why do VLAN configurations persist after wiping NVRAM?<\/span><\/h3>\nOn Catalyst switches, VLAN definitions are not stored within the startup-config<\/code> file if the switch runs in default VLAN Trunking Protocol (VTP) Client or Server mode. Instead, VTP maintains the VLAN database in a separate binary file called vlan.dat<\/code> located directly in the root of the Flash filesystem (flash:vlan.dat<\/code>). Because write erase<\/code> targets exclusively NVRAM, vlan.dat<\/code> remains untouched in Flash, and the switch re-reads all prior VLANs into the running configuration upon reboot.<\/p>\n<\/span>What happens if you run delete vlan.dat<\/code> without write erase<\/code>?<\/span><\/h3>\nDeleting only the VLAN database removes all custom VLAN numbers and names from the system. However, the interfaces still retain their configuration lines (such as switchport access vlan 20<\/code> or specific IP addresses assigned to Switch Virtual Interfaces) because those statements reside in NVRAM. To achieve a clean, factory-default state, you must clear both storage locations simultaneously.<\/p>\n<\/span>Are boot parameters and license files stored in NVRAM?<\/span><\/h3>\nBoot parameters, such as the BOOT<\/code> environmental variable specifying which Cisco IOS binary to initialize, are managed as system environment variables written to internal ROM\/NVRAM registers. Hardware and feature licenses are saved within dedicated Flash directories or protected non-volatile sectors. A standard configuration wipe will not unregister permanent licenses or break the boot path unless you format the underlying Flash storage.<\/p>\n
\n<\/span>Standard CLI Reset: Step-by-Step Guide for Classic Cisco IOS Switches<\/span><\/h2>\nIf you have administrative access (Privilege Level 15) via SSH, Telnet, or a direct serial console cable, use this sequence on classic Cisco Catalyst switches (such as the Catalyst 2960, 3560, and 3750 series) to restore factory defaults.<\/p>\n
Console \/ Terminal\n \u2502\n \u25bc\n [ Enter Enable Mode ]\n \u2502\n \u25bc\n [ `write erase` ] \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u25ba Clears NVRAM (startup-config)\n \u2502\n \u25bc\n [ `delete flash:vlan.dat` ] \u2500\u2500\u2500\u2500\u25ba Clears VLAN Database\n \u2502\n \u25bc\n [ `reload` ]\n \u2502\n \u25bc\n Save config? -> "no" \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u25ba Prevents re-writing memory\n \u2502\n \u25bc\n [ Factory-Default Boot ]\n<\/code><\/pre>\n<\/span>Step 1: Elevate to Privileged EXEC Mode<\/span><\/h3>\nConnect your terminal emulator to the switch (using standard serial settings: 9600 baud, 8 data bits, no parity, 1 stop bit, no flow control). Enter privileged mode using the enable<\/code> command:<\/p>\nSwitch> enable\nPassword: *********\nSwitch#\n<\/code><\/pre>\n<\/span>Step 2: Clear the Startup Configuration from NVRAM<\/span><\/h3>\nErase the non-volatile memory by issuing write erase<\/code> or erase startup-config<\/code>. Press Enter<\/strong> when prompted to confirm the operation:<\/p>\nSwitch# write erase\nErasing the nvram filesystem will remove all configuration files! Continue? [confirm]\n[OK]\nErase of nvram: complete\n<\/code><\/pre>\n<\/span>Step 3: Remove the VLAN Database from Flash Memory<\/span><\/h3>\nDelete the vlan.dat<\/code> file located in Flash. Press Enter<\/strong> through both verification prompts to confirm the file deletion:<\/p>\nSwitch# delete flash:vlan.dat\nDelete filename [vlan.dat]? \nDelete flash:\/vlan.dat? [confirm]\n<\/code><\/pre>\nNote: If the switch displays an error stating %Error deleting flash:vlan.dat (No such file or directory)<\/code>, the switch is operating in VTP Transparent mode or has not yet had custom VLANs created. You can safely proceed.<\/em><\/p>\n<\/span>Step 4: Verify Flash Memory Contents<\/span><\/h3>\nRun a directory check on the primary Flash partition to ensure the VLAN database is gone and that the valid .bin<\/code> operating system image remains present:<\/p>\nSwitch# dir flash:\nDirectory of flash:\/\n\n 2 -rwx 11732480 Mar 1 1993 00:02:18 +00:00 c2960-lanbasek9-mz.150-2.SE4.bin\n 3 -rwx 2072 Mar 1 1993 00:02:45 +00:00 multiple-fs\n\n57931776 bytes total (46197248 bytes free)\n<\/code><\/pre>\n<\/span>Step 5: Reload the Switch Without Saving<\/span><\/h3>\nInitiate a reboot of the switch using the reload<\/code> command. Pay close attention to the system prompts:<\/strong><\/p>\nSwitch# reload\nSystem configuration has been modified. Save? [yes\/no]: no\nProceed with reload? [confirm]\n<\/code><\/pre>\nCritical Action:<\/strong> When the system prompts System configuration has been modified. Save? [yes\/no]:<\/code>, type no<\/code><\/strong>. Typing yes<\/code> at this prompt will write the current running-config<\/code> back into NVRAM, undoing the write erase<\/code> command you just executed. Confirm the final prompt to begin the reboot cycle.<\/p>\n
\n<\/span>Password Recovery and Factory Wipe: Resetting via Mode Button and ROMMON<\/span><\/h2>\nWhen locked out of a switch without administrative credentials, you cannot issue CLI reset commands. You must interact directly with the bootstrap firmware (ROMMON) using physical access to bypass the configuration register.<\/p>\n
[ Disconnect Power ]\n \u2502\n \u25bc\n [ Hold Physical "Mode" Button ]\n \u2502\n \u25bc\n [ Reconnect Power ]\n \u2502\n \u25bc\n [ Release Button at Solid Green ]\n \u2502\n \u25bc\n Terminal in ROMMON:\n `switch:`\n \u2502\n \u25bc\n Execute `flash_init`\n \u2502\n \u25bc\n Delete \/ Rename `config.text`\n \u2502\n \u25bc\n Issue `boot`\n<\/code><\/pre>\n<\/span>Step 1: Set Up Console Access and Disconnect Power<\/span><\/h3>\nAttach a rollover console cable from your computer to the switch’s RJ-45 or USB console port. Open your terminal emulator session. Disconnect the AC power cord from the rear of the switch chassis.<\/p>\n
<\/span>Step 2: Interrupt the Boot Loader Using the Mode Button<\/span><\/h3>\n\n- Press and hold down the physical Mode<\/strong> button located on the front panel of the switch.<\/li>\n
- While holding the button, reconnect the AC power cord.<\/li>\n
- Continue holding the Mode<\/strong> button until the
SYST<\/code> (System) LED flashes amber and then turns solid green (typically 10 to 15 seconds).<\/li>\n- Release the Mode<\/strong> button. Your terminal screen will present the ROMMON prompt:<\/li>\n<\/ol>\n
The system has been interrupted, or encountered an error \nduring initialization. The following commands will finish \nloading the operating system software:\n\n flash_init\n boot\n\nswitch:\n<\/code><\/pre>\n<\/span>Step 3: Initialize the Flash File System<\/span><\/h3>\nBy default, ROMMON does not mount local storage. Run the flash_init<\/code> command to initialize the internal Flash memory:<\/p>\nswitch: flash_init\nInitializing Flash...\n...The flash is already initialized.\n<\/code><\/pre>\n<\/span>Step 4: Identify and Remove the Stored Configuration<\/span><\/h3>\nList the contents of Flash to confirm the exact names of the configuration and VLAN files:<\/p>\n
switch: dir flash:\n<\/code><\/pre>\nLocate config.text<\/code> (which contains the encrypted passwords and startup configuration) and vlan.dat<\/code>. Delete them directly from the boot loader:<\/p>\nswitch: delete flash:config.text\nAre you sure you want to delete "flash:config.text" (y\/n)? y\n\nswitch: delete flash:vlan.dat\nAre you sure you want to delete "flash:vlan.dat" (y\/n)? y\n<\/code><\/pre>\nAlternative (Password Recovery without Configuration Loss):<\/em> If you need to recover passwords rather than destroy the configuration, rename the file using rename flash:config.text flash:config.text.old<\/code>. This allows you to boot the system cleanly, rename the file back in standard CLI, and modify only the enable secret<\/code> line.<\/p>\n<\/span>Step 5: Boot the Operating System<\/span><\/h3>\nStart the standard Cisco IOS software by entering boot<\/code>:<\/p>\nswitch: boot\n<\/code><\/pre>\nBecause the switch cannot locate config.text<\/code> or vlan.dat<\/code> during boot, it loads with factory-default parameters and displays the initial setup dialog prompt: Would you like to enter the initial configuration dialog? [yes\/no]:<\/code>.<\/p>\n
\n<\/span>Modern Catalyst 9000 and 3850 Series: Executing factory-reset<\/code> in Cisco IOS-XE<\/span><\/h2>\nEnterprise switches built on Cisco IOS-XE (such as the Catalyst 3650, 3850, 9200, 9300, 9400, 9500, and 9600 series) feature an integrated factory reset engine. Rather than relying on multi-step deletions of individual files, Cisco IOS-XE includes the automated factory-reset<\/code> privileged EXEC command.<\/p>\n+-----------------------------------------------------------------------------------+\n| IOS-XE `factory-reset all` Workflow |\n+-----------------------------------------------------------------------------------+\n| |\n| 1. Purges `startup-config` and `running-config` from NVRAM. |\n| 2. Deletes all user files, crashinfo, tracelogs, and core dumps in `flash:`. |\n| 3. Removes all custom VLANs and Layer 2 databases. |\n| 4. Deletes digital certificates, trustpoints, and generated crypto keys. |\n| 5. Preserves valid operating system packages \/ images (`packages.conf`). |\n| 6. Performs automated system restart into initial setup dialog. |\n| |\n+-----------------------------------------------------------------------------------+\n<\/code><\/pre>\n<\/span>Step 1: Verify Image Integrity and Boot Mode<\/span><\/h3>\nBefore triggering a comprehensive reset on Catalyst 9000 hardware, verify that your boot environment is stable and that you are operating in Install Mode:<\/p>\n
Switch# show version | include Installation Mode\nInstallation Mode: INSTALL\n\nSwitch# dir flash:*.bin\n<\/code><\/pre>\nEnsure that the operational system files (packages.conf<\/code> and associated sub-packages) are present in root Flash so the switch can boot reliably after the wipe.<\/p>\n<\/span>Step 2: Execute the Factory Reset Command<\/span><\/h3>\nRun the factory-reset<\/code> command with the all<\/code> parameter:<\/p>\nSwitch# factory-reset all\n<\/code><\/pre>\nFor modular or multi-member Cisco Catalyst Switch Stacks (StackWise-480\/160), this command cascades across all stack members automatically.<\/p>\n
<\/span>Step 3: Confirm System Prompts<\/span><\/h3>\nThe switch will outline what data will be destroyed and request explicit confirmation:<\/p>\n
The factory-reset all command will reset the system to factory default \nand remove all configurations, data files, trace logs, crash dumps, and \nkeys. The system will be reloaded.\n\nDo you want to continue? [confirm] y\n<\/code><\/pre>\n<\/span>Step 4: Allow Automated Sanitization and Reload<\/span><\/h3>\n