| 13.6 |  | PIX Security Appliance Password Recovery and Upgrades |
| 13.6.1 |  | Password recovery |

| For administrators to adequately manage PIX Security Appliances, they must be capable of performing a password recovery and an image and activation key upgrade on the PIX Security Appliances in the network. This section explains how to perform a password recovery operation. The following section will discuss upgrading the image and activation keys.

Password recovery overview
To recover password for PIX Security Appliance models 501, 506E, 515E, 525, and 535, follow the steps below:

1. Install a serial terminal or a PC with terminal emulation software on the PIX Security Appliance console port .
2. Connect the PC to the Ethernet 1 interface directly or through a hub. A switch can be used if portfast is enabled on the switch ports connecting the PC and the PIX Security Appliance. Set a static IP address and subnet mask.
3. Download the PIX Password Lockout Utility. For example, the np62.bin (for PIX Security Appliance version 6.2). Load this on the PC running a TFTP server.
4. Immediately after you power on the PIX Security Appliance and the startup messages appear, send a BREAK character or press the ESC key. The monitor> prompt is displayed. If needed, type ? (question mark) to list the available commands.
5. Use the interface command to specify which interface the ping traffic should use. The PIX Security Appliance defaults to the inside interface (interface 1).
6. Use the address command to specify the IP address of the PIX Security Appliance's interface. Set this to the same IP network configured statically on the PC
7. Use the server command to specify the IP address of the remote TFTP server containing the PIX Security Appliance password recovery file.
8. Use the file command to specify the filename of the PIX Security Appliance password recovery file. For example, the 5.1 release uses a file named np62.bin.
9. If needed, enter the gateway command to specify the IP address of a router gateway through which the server is accessible.
10. If needed, use the ping command to verify accessibility. If this command fails, fix access to the server before continuing.
11. Use the tftp command to start the download.
12. As the password recovery file loads, the following message is displayed:
13. Do you wish to erase the passwords? [yn] y
    Passwords have been erased.
    (answer no to any other questions)
14. Reboot the PIX Security Appliance
    The corresponding demonstration activity illustrates this process on a step-by-step basis.

| Lab Activity Lab Exercise: Perform password recovery In this lab exercise, students will perform password recovery procedures and upgrade the PIX Security Appliance Image.

| Web Links CCO password recovery procedures http://www.cisco.com/warp/ public/474/index.shtml