Catalyst Boot Process

Mental model

Every Cisco device boots through the same sequence:

1. Power on — hardware spins up.
2. POST (Power-On Self-Test) — checks RAM, CPU, ports, ASICs.
3. ROMMON (ROM Monitor) — minimal bootloader, locates IOS image.
4. IOS load — image copied from flash into RAM, decompressed, started.
5. Config load — startup-config copied from NVRAM into RAM as running-config.
6. Operational — CLI prompt appears.

If any step fails, the boot stops there. Knowing the stages tells you where to look when a device won’t come up.

The four storage locations

The bootflash on modern Catalyst switches is large enough to hold multiple IOS images. Older devices had just enough flash for one image + a bit of headroom for upgrades.

The config register — boot behavior in one hex value

The config register is a 16-bit value (shown in hex) that controls boot behavior. Default on most modern Cisco IOS:

R1# show version
...
Configuration register is 0x2102

Two bits matter for CCNA:

• Bits 0–3 (boot field) — where to load IOS from:
  • 0x0 → stay in ROMMON
  • 0x1 → load mini-IOS from ROM
  • 0x2–0xF → check boot system commands, fall back to first valid image in flash
• Bit 6 — skip startup-config:
  • 0 (default) → load startup-config
  • 1 → ignore startup-config (device boots with empty config)

Common values:

Change it with:

R1(config)# config-register 0x2142
R1# reload

After reload, the device boots without loading the startup-config — letting you recover from a forgotten password.

Boot system commands

When the boot field is 0x2–0xF, IOS looks at boot system commands in the startup-config to decide which image to load. Multiple lines = ordered fallback:

R1(config)# boot system flash:c2960x-universalk9-mz.152-7.E3.bin
R1(config)# boot system flash:c2960x-universalk9-mz.152-7.E0.bin
R1(config)# boot system rom

Tries the first image. If missing/corrupt, tries the second. If both fail, falls back to the ROM-resident mini-IOS (limited functionality, just enough to recover).

If no boot system commands exist, IOS loads the first valid image file it finds in flash.

Password recovery — the practical use of 0x2142

Forgot the enable password? Process:

1. Console into the device.
2. Power cycle. Press Ctrl+Break during boot to interrupt and land in ROMMON.
3. From ROMMON, change the config register: confreg 0x2142
4. reset to reboot. Device now boots without the startup-config.
5. Enter privileged mode (no password — running-config is empty).
6. copy startup-config running-config — load the saved config back (now you have access).
7. Reset passwords as needed.
8. Restore normal boot: config-register 0x2102
9. copy running-config startup-config
10. reload

Console access required (it’s the rescue path). Without physical access, you can’t do this — which is also why physical security of network equipment matters.

Boot sequence troubleshooting

What it looks like when things go wrong at each stage:

Commands — observe the boot environment

R1# show version                ! IOS version, uptime, config-register, boot image
R1# show flash:                 ! list IOS files in flash
R1# show bootvar                ! current boot variables
R1# show running-config | include boot
R1# dir flash:                  ! same as show flash:, longer format

show version is the single most useful “what’s going on with this device” command. It shows hardware model, IOS version, uptime, reason for last reload, and config register — answer to “is this thing healthy?” in one screen.

Image management — upgrades

Upgrade flow:

! Copy new image from TFTP server to flash
R1# copy tftp: flash:

! Set boot variable to use new image
R1(config)# boot system flash:c2960x-universalk9-mz.152-7.E4.bin

! Save and reload
R1# wr
R1# reload

Always keep the old image as a fallback. Don’t delete it until the new one’s been running stable for a week+.

For newer Catalyst 9000 series running IOS-XE, the process is more sophisticated — install commands, packaged software (.bin or .pkg), and multiple boot modes (install vs bundle).

Common mistakes

1. Forgetting to save the config register change. config-register 0x2102 after password recovery — without it, the next reload still skips startup-config.

2. No boot system commands when needed. If you have multiple IOS images and don’t specify, IOS picks the first valid file alphabetically. Surprising results.

3. Pulling power during a flash upgrade. Bricks the device. Always use UPS, never power-cycle during firmware install.

4. Filling flash to 100%. No room for upgrade images. Always keep ~30% headroom.

5. Console access “not needed because we have SSH.” Until SSH doesn’t work and you need to do password recovery. Always maintain console access.

6. Mistaking the boot stages. “It’s stuck at ROMMON” vs “stuck at IOS load” vs “stuck at config load” — different stages, different fixes. Read the symptom carefully.

Lab to try tonight

1. Cable up a Cisco switch with a console cable. Watch the boot in your terminal.
2. Identify each stage: POST messages, ROMMON banner, IOS load, config application.
3. From the running device: show version. Note the config register.
4. From the running device: show bootvar and show flash:.
5. Power-cycle. Press Ctrl+Break during ROMMON. Run confreg 0x2142. Reset.
6. Watch it boot without your config. Enable mode, no password.
7. copy start run to restore. Note: never copy run start here — you’d save the empty config!
8. Reset config-register back to 0x2102. wr. Reload.

Cheat strip