Configuration Management & Recovery¶

Where a Cisco switch actually stores its configuration and IOS image, how it boots, and how to back up, restore, wipe, or recover one — the operational side of switch management that sits underneath the CLI reference.

File Locations¶

A switch has three distinct storage areas, and mixing them up is the source of most "I saved it but it didn't stick" confusion:

Location	Contents	Persists on reboot?
RAM	`running-config` — the active configuration currently in effect	No — wiped on reload
NVRAM	`startup-config` — the configuration loaded at boot	Yes
Flash	The IOS image itself, plus (on some platforms) `vlan.dat` — the VLAN database	Yes

VLAN database caveat: on many Catalyst switches, VLAN definitions (vlan 10, name Office, etc.) are stored separately in vlan.dat on flash, not inside startup-config. This means erase startup-config alone does not remove your VLANs — see Erasing / Factory Reset below.

Boot Process¶

POST (Power-On Self-Test) — hardware check
Bootstrap — loaded from ROM, locates and loads the IOS image from flash
IOS loads — decompresses and starts running from flash into RAM
Startup-config loads — NVRAM's startup-config is copied into RAM, becoming the initial running-config
If no startup-config is found (blank NVRAM), the switch drops into setup mode (interactive initial-configuration dialog) or a basic unconfigured prompt

show version          ! Confirm IOS version, uptime, and config register value
show flash:           ! List files in flash (IOS image, vlan.dat, etc.)

Saving Configuration¶

Changes made in configuration mode go straight to running-config (RAM) and are lost on reload unless saved to NVRAM:

copy running-config startup-config

Shorthand (equivalent, older/common usage):

write memory
wr

Loading / Restoring Configuration¶

Reload from NVRAM¶

reload

Discards running-config and reboots, reloading startup-config from NVRAM. Always prompts to save unsaved changes first — don't reflexively answer "yes" if the running config has changes you didn't intend to keep.

Merge Startup-Config Back Into Running-Config¶

copy startup-config running-config

Caution: this merges NVRAM's saved config into the current running config rather than replacing it — leftover running-config lines not present in startup-config are not removed. If you need a clean known-good state, reload (which fully replaces running-config) is safer than this merge.

Backup and Restore via TFTP¶

Push a copy of the config to a TFTP server for safekeeping, or pull one down to restore:

! Backup running-config to a TFTP server
copy running-config tftp://10.0.99.5/sw01-running.cfg

! Restore a saved config from TFTP into running-config (merges, same caveat as above)
copy tftp://10.0.99.5/sw01-running.cfg running-config

! Restore directly into startup-config (takes effect on next reload)
copy tftp://10.0.99.5/sw01-startup.cfg startup-config

This is the practical way to keep off-switch backups — pair it with the logging server setup so both config and log history live somewhere other than the switch itself.

Erasing / Factory Reset¶

To fully return a switch to factory defaults (no VLANs, no hostname, no passwords):

erase startup-config    ! Wipes NVRAM config
delete vlan.dat         ! Wipes the separately-stored VLAN database (confirm the flash: prompt)
reload                  ! Reboots into an unconfigured state

erase nvram: is functionally equivalent to erase startup-config on most platforms.

Caution: this is destructive and immediate on reload — confirm you have a TFTP backup or genuinely intend a factory reset before running this on a live switch. Forgetting delete vlan.dat is the most common reason a "factory reset" switch still shows old VLANs after erase + reload.

Password Recovery¶

If the enable/console password is lost, recovery requires physical console access and interrupting the normal boot sequence — this cannot be done remotely.

Connect via console, power-cycle the switch, and send a break signal (key combo depends on terminal software) during the first ~60 seconds of boot to enter ROMMON mode
Change the config register to skip loading startup-config on boot:
```
confreg 0x2142
reset
```
Switch boots with no startup-config applied — you're in setup mode / basic enable access with no password

Restore the real config and reset the register back to normal:

copy startup-config running-config    ! Bring back the real config (passwords included)
config-register 0x2102                ! Restore normal boot behavior
copy running-config startup-config    ! Save
reload

0x2102 is the standard "boot normally, load startup-config" value on most Cisco platforms; 0x2142 tells it to ignore startup-config on the next boot only. Physical access to the console port is a prerequisite for this whole procedure — it's also why console/AUX port physical security matters as much as network-side hardening (see the Security Hardening checklist).

IOS Image Management¶

Before upgrading, always confirm flash has enough free space for the new image alongside (or instead of) the old one:

show flash:                              ! Check free space and existing image(s)
copy tftp://10.0.99.5/ios-image.bin flash:   ! Copy new image to flash

Point the boot process at the new image explicitly (otherwise the switch may pick whichever image it finds first):

boot system flash:ios-image.bin
copy running-config startup-config
reload

Verify after reload:

show version    ! Confirm the running IOS version matches the intended image