7

I'm a system admin but I'm not Cisco certified and I'm not a network engineer. Basically I only use switches/routers/modems with a GUI.

I've inherited a pile of old Cisco routers that are not in use and am looking at selling them.

I don't have a console cable handy and I've just spend 30 minutes getting nowhere attempting to reset an 878 back to factory defaults (and there's about 5 more of these).

Is there a security problem selling/recycling these without factory defaulting them? They're all password protected so I assume no-one can recover data/passwords from them as they'd need to factory default them anyway?

TIA

Improve this question
3
  • 1
    If security is a concern (I mean, really, like gov or mil stuff), take the nvram and flash chips out of the router and destroy them.
    – petrus
    Dec 21, 2011 at 17:08
  • 1
    @petrus: These are usually soldered onto the main-board. Even if that is not the case the devices cannot be sold anymore if these are taken out. If the poster was in gov or mil he wouldn't be asking the question. They have disposal procedures for this sort of thing.
    – Tonny
    Dec 23, 2011 at 13:18
  • @tonny: I know they are soldered and thus not replaceable. but anyone with motivation can dump the erased config from the nvram.
    – petrus
    Dec 23, 2011 at 16:43

4 Answers 4

Reset to default
6

If you have console access to a Cisco Router you can use Cisco Password Recovery techniques to get in, then dump the cleartext config file via TFTP - you then have access to cleartext passwords, or passwords that are trivial to decrypt.

So you do need to factory reset. If you haven't got the login details for the routers (in which case you can probably get in via SSH over a network connection), then you will need to use the above techniques to get in, then issue the write erase command to drop the existing configs.

Improve this answer
2
  • Wonderful. Just picked up the Console Cable only to realise I don't have a serial port on my computer - yay. Don't-cha' just love old technology?
    – Dom
    Dec 22, 2011 at 7:41
  • Yeah - frustrating to then have to get a USB dongle, and they usually come with no documentation so you spend a while figuring out how to access. I'm sure a few people have got the blue cable with an RJ45 at one end and spent hours trying to figure out how to configure. Dell switches come with a cable with Serial connector at one end and a USB port at the other. No documentation, and I never figured out how they worked. It's a closed cult :-)
    – dunxd
    Dec 22, 2011 at 10:20
7

Password recovery methods for the majority of Cisco devices includes the ability to access the stored configuration. While enabling service-password-encryption hashes the stored passwords, it's not bullet proof.

Further, the configuration will contain sensitive information about the architecture and addressing of your network.

To answer your question directly:

Yes, selling used Cisco routers without wiping them of your data poses a security risk.

Improve this answer
7

You really need to wipe them completely as stated by various others.

Getting a Cisco console cable is easy.

Nearly any new Cisco device I have ever seen comes with on in the box. It's either a blue one with a D-sub 9-pin connector on 1 end and a RJ45 on the other. Or it is a flat black cable (not UTP) with a RJ45 on both ends with a seperate 9pin or 25-pin D-sub connector that has a socket for a RJ45 plug that goes with it.

You probably have some of them lingering around somewhere in the server-room or on a storage-shelf. (First place to look is the patch-cabinet: Many admins keep one handy in each patch-cabinet as a matter of principle.)

You can make one yourself as well from an old serial cable and a RJ45 crimp connector. Just follow the instructions here: http://www.cisco.com/en/US/products/hw/routers/ps214/products_tech_note09186a00801f5d85.shtml

Serial settings are 9600 baud, 8 bits of data, 1 stop, no parity. No flow-control.

Improve this answer
1
  • 2
    The RJ-45-contacted cable is a roll-over, so the pins are connected 1-8, 2-7, 3-6, 4-5. Trivial to make and there are RJ-45 couplers tha timplement a rollover, so you can just take two ethernet cables with the coupler in-between.
    – Vatine
    Dec 21, 2011 at 13:01
1

Save yourself from any future trouble and erase the configuration, like @mcmeel said this is sensitive information we are talking about. Keep the routers until you have access to a console cable and try again. The entire process shouldn't take long to complete on all five devices.

We all have limitations in our knowledge, if you don't feel confident enough then please find someone with a Cisco background who can do it.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .