Cisco ASA Password Recovery 2026: Firepower 1010, 2100, 3100, 4100, and 4200

Cisco Firepower and Secure Firewall platforms do not all use the same ASA password recovery process. On newer platforms, the correct recovery path depends on the hardware family, whether the device runs ASA or FTD, whether the platform uses appliance mode or platform mode, and whether ASA runs directly on the appliance or as a logical instance.

This guide covers Firepower 1010, Firepower 2100, Secure Firewall 3100, Firepower 4100, and Secure Firewall 4200 running ASA. It does not cover legacy ASA 5500 or ASA 5500-X password recovery.

The key warning is simple: on many newer Firepower and Secure Firewall platforms, password recovery is a destructive reset workflow, not a classic configuration-preserving ASA password recovery process. Do not run factory-reset, password_reset, or FXOS instance recovery commands unless you understand whether the ASA configuration will be erased, reset, or interrupted.

Which Cisco ASA Password Recovery Method Should You Use in 2026?

Platform	ASA Deployment Style	Recovery Method	Configuration Impact
Firepower 1010	ASA on appliance-mode platform	ROMMON factory-reset or older password_reset	ASA configuration is reset in the documented factory reset workflow
Firepower 2100	ASA in Appliance Mode or Platform Mode	ROMMON password_reset or newer factory-reset	Device is reimaged / reset and ASA configuration is erased
Secure Firewall 3100	Appliance Mode only	ROMMON factory-reset workflow	ASA configuration is reset in the documented factory reset workflow
Firepower 4100	ASA logical instance on chassis	FXOS CLI / chassis-level ASA instance recovery	ASA instance reboot can interrupt traffic
Secure Firewall 4200	Appliance Mode only	ROMMON factory-reset workflow	ASA configuration is reset in the documented factory reset workflow

Before touching the device, identify what access was lost.

Lost Password	What It Affects	Correct Direction
ASA enable password	Privileged ASA CLI access	ASA recovery path
ASA local user password	SSH, ASDM, or local ASA login	ASA user / enable recovery
FXOS admin password	Platform or chassis management	FXOS recovery or factory reset path
FTD admin password	Firewall Threat Defense access	FTD-specific recovery, not ASA recovery

Do not use a Firepower ASA recovery procedure until you know whether the device is running ASA or FTD.

Firepower 1010 ASA Access Recovery by Factory Reset

Use this workflow when Firepower 1010 is running ASA and you cannot access the ASA CLI or enable mode.

This is a factory reset-level recovery path. Treat it as destructive. Use it only with console access, an approved maintenance window, and a known configuration backup or rebuild plan.

Step 1: Connect to the Console Port

Connect to the firewall console port.

Common terminal settings:

9600 baud
8 data bits
no parity
1 stop bit
no flow control

Power-cycle the firewall.

Step 2: Enter ROMMON

During boot, press Esc when prompted.

You should reach a ROMMON prompt:

rommon 1 >

Step 3: Check ROMMON Version

Run:

show info

On newer ROMMON versions, use:

factory-reset

On older ROMMON versions where factory-reset is not available, the command may be:

password_reset

Step 4: Run Factory Reset or Password Reset

For newer ROMMON:

factory-reset

For older ROMMON:

password_reset

Confirm the prompts.

Example confirmation flow:

rommon 1 > factory-reset

Warning: All configuration will be permanently lost with this operation
and application will be initialized to default configuration.

Are you sure you would like to continue ? yes/no [no]: yes
Please type 'ERASE' to confirm the operation or any other value to cancel: ERASE

This is the destructive step. Do not confirm this operation if you expect to preserve the existing ASA configuration.

Step 5: Boot the Firewall

If the device does not boot automatically, run:

boot

Wait until ASA starts.

During boot, you may see FXOS-related prompts. Continue waiting until ASA comes online.

Step 6: Set the New ASA Enable Password

When ASA comes online, enter enable mode:

ciscoasa> enable

If the enable password is not set, ASA prompts you to create one:

The enable password is not set. Please set it now.
Enter Password: ********
Repeat Password: ********
ciscoasa#

Save the configuration:

write memory

or:

copy running-config startup-config

Step 7: Rebuild or Restore ASA Configuration

After reset, verify whether the original ASA configuration still exists.

Check:

show running-config
show startup-config
show version
show interface ip brief
show route
show access-list
show nat
show running-config aaa

If the configuration was reset, restore from backup or rebuild the firewall before returning it to production.

Firepower 2100 ASA Password Reset by Reimage or Factory Reset

Firepower 2100 requires special care because it may run ASA in Appliance Mode or Platform Mode.

If you still have ASA CLI access, check the mode:

show fxos mode

If you cannot log in, identify the mode from the deployment record, console behavior, or previous documentation before choosing the recovery path.

For Firepower 2100, the documented password reset workflow is a destructive recovery path. It reimages or resets the device and erases the ASA configuration.

Firepower 2100 Appliance Mode Password Reset

In Appliance Mode, ASA is the main configuration layer. Recovery is usually handled through the appliance / ROMMON reset path.

Step 1: Connect to Console and Power-Cycle

Power-cycle the firewall and press Esc when prompted.

Expected prompt:

rommon 1 >

Step 2: Run Password Reset or Factory Reset

On older ROMMON versions:

password_reset

On newer ROMMON versions:

factory-reset

Example:

rommon 1 > password_reset

WARNING: User configurations can be lost with this operation.
Are you sure ? yes/no [no]: yes

or:

rommon 1 > factory-reset

Warning: All configuration will be permanently lost with this operation.
Are you sure you would like to continue ? yes/no [no]: yes
Please type 'ERASE' to confirm the operation or any other value to cancel: ERASE

Step 3: Boot the Device

Run:

boot

The recovery or reimage process can take significant time. Do not power-cycle the firewall during recovery.

Step 4: Log In After Reset

After reset, the platform may present a default admin login depending on software state and recovery path.

Common post-reset credential pattern:

Username: admin
Password: Admin123

If ASA starts and prompts for an enable password, set a new enable password and save the configuration:

ciscoasa> enable
The enable password is not set. Please set it now.
Enter Password: ********
Repeat Password: ********
ciscoasa# write memory

Step 5: Restore or Rebuild Configuration

Because the Firepower 2100 reset workflow erases ASA configuration, restore from backup or rebuild the firewall.

At minimum, verify:

show running-config
show startup-config
show version
show interface ip brief
show route
show access-list
show nat
show running-config aaa
show failover

If the firewall was in production, do not return it to service until NAT, ACLs, routing, VPN, management access, licensing, and failover state are verified.

Firepower 2100 Platform Mode Password Reset

In Platform Mode, FXOS is a separate management layer. Losing the FXOS admin password is not the same as losing the ASA enable password.

Use this decision path:

Lost Access	What to Do
ASA enable password lost, FXOS access still available	Check whether ASA application recovery is possible from the platform layer
FXOS admin password lost	Use FXOS / ROMMON password reset or factory reset workflow
Both ASA and FXOS access lost	Treat as full platform recovery and expect configuration loss
No backup available	Do not proceed until configuration loss risk is accepted

On Firepower 2100, ROMMON password reset or factory reset should be treated as a destructive recovery action. Expect the ASA configuration to be erased unless you have verified another supported recovery path for your exact deployment.

Secure Firewall 3100 ASA Access Recovery by Factory Reset

Secure Firewall 3100 runs in appliance mode only. It does not use Firepower 2100 Platform Mode behavior and should not be treated as a chassis platform.

Use this workflow when the 3100 is running ASA.

Step 1: Confirm ASA Is Installed

From console behavior, confirm the firewall is running ASA, not FTD.

ASA prompt example:

ciscoasa>

FTD prompt example:

firepower login:

If the firewall is running FTD, do not use an ASA password recovery procedure.

Step 2: Enter ROMMON

Power-cycle the firewall and press Esc during boot.

rommon 1 >

Step 3: Run Factory Reset

Check ROMMON version:

show info

Then run:

factory-reset

If factory-reset is not available:

password_reset

Confirm the prompts:

yes
ERASE

Step 4: Boot ASA

boot

Wait for ASA to start.

Step 5: Set the Enable Password

ciscoasa> enable
The enable password is not set. Please set it now.
Enter Password: ********
Repeat Password: ********
ciscoasa# write memory

Step 6: Verify or Restore Configuration

Check whether configuration remains or must be restored:

show running-config
show startup-config
show interface ip brief
show route
show access-list
show nat
show running-config aaa

If the configuration was erased, restore from backup before returning the firewall to service.

Secure Firewall 4200 ASA Access Recovery by Factory Reset

Secure Firewall 4200 also runs in appliance mode only. It can run ASA or FTD, so the first step is confirming the installed application.

Step 1: Confirm ASA or FTD

ASA prompt:

ciscoasa>

FTD prompt:

firepower login:

If the device is running FTD, this ASA recovery guide does not apply.

Step 2: Interrupt Boot

Power-cycle the firewall and press Esc during boot.

rommon 1 >

Step 3: Run Factory Reset

show info
factory-reset

If the ROMMON version does not support factory-reset, use:

password_reset

Confirm:

yes
ERASE

Step 4: Boot ASA

boot

Step 5: Set a New Enable Password

ciscoasa> enable
The enable password is not set. Please set it now.
Enter Password: ********
Repeat Password: ********
ciscoasa# write memory

Step 6: Restore Firewall Configuration

Verify:

show running-config
show startup-config
show version
show interface ip brief
show route
show access-list
show nat
show running-config aaa

If the ASA configuration was reset, restore the approved backup or rebuild the configuration before reconnecting production traffic.

Do not use Firepower 4100 chassis-instance recovery steps on Secure Firewall 4200. The 4200 is an appliance-mode platform, not a chassis platform running ASA as a logical device.

Firepower 4100 ASA Instance Password Recovery Through FXOS CLI

Firepower 4100 is different from Firepower 1010, 2100, 3100, and 4200. ASA usually runs as a logical device instance on the chassis.

This procedure assumes you still have FXOS admin access. If FXOS access is also lost, recover FXOS access first.

Step 1: Log In to FXOS CLI

FPR4110#

Step 2: Identify the ASA Instance

scope ssa
show app-instance

Example:

FPR4110# scope ssa
FPR4110 /ssa # show app-instance

App Name  Identifier  Slot ID  Admin State  Oper State  Running Version
--------  ----------  -------  -----------  ----------  ---------------
asa       ASA         1        Enabled      Online      9.x

Record the actual values from your output:

<app_name>
<identifier>
<slot_id>

In many deployments, the app name may be asa, the identifier may be ASA, and the slot may be 1, but do not hard-code these values. Use the values shown by show app-instance.

Step 3: Set the New ASA Bootstrap Password

Use the actual logical device identifier and app name from the previous step.

scope logical-device <identifier>
scope mgmt-bootstrap <app_name>
scope bootstrap-key-secret PASSWORD
set value

Enter and confirm the new password when prompted.

Then save:

commit-buffer
exit
exit

Step 4: Clear Management Bootstrap

Go to the slot and ASA app instance using the values from show app-instance:

scope slot <slot_id>
scope app-instance <app_name> <identifier>
clear-mgmt-bootstrap
commit-buffer

Step 5: Restart the ASA Instance

restart
commit-buffer

The ASA instance restarts. This can interrupt traffic.

Step 6: Log In to ASA

After the ASA instance returns online, log in with the new password.

Verify:

show version
show running-config
show interface ip brief
show route
show access-list
show nat
show running-config aaa
show failover

Step 7: Confirm ASA Instance Status from FXOS

Return to FXOS:

scope ssa
show app-instance

Confirm the ASA instance is online.

Will Firepower ASA Password Recovery Erase the Configuration?

It can. In several workflows covered here, it should be expected.

Platform	Configuration Risk
Firepower 1010	Factory reset resets ASA configuration
Firepower 2100	Password reset or factory reset reimages / resets the device and erases ASA configuration
Secure Firewall 3100	Factory reset resets ASA configuration
Secure Firewall 4200	Factory reset resets ASA configuration
Firepower 4100 ASA instance	Instance recovery restarts ASA and can interrupt traffic

The safest rule:

Do not run factory-reset, password_reset, or FXOS instance recovery commands until you know whether the action preserves or erases the ASA configuration.

If no backup exists, stop and decide whether recovery, rebuild, or replacement is the better path.

Can Firepower ASA Password Recovery Be Done Without Downtime?

Usually no.

Password recovery can require:

• reboot
• ROMMON access
• factory reset
• password reset
• failsafe recovery
• ASA instance restart
• configuration restore
• HA or cluster failover planning

For production firewalls, use a maintenance window.

Firepower ASA Password Recovery in HA, Failover, or Cluster Environments

Password recovery in HA or clustered deployments requires planning.

Environment	What to Confirm
Active/standby failover	Which unit is active before reboot
ASA cluster	Role of the unit before recovery
Firepower 4100 ASA instance	Whether instance reboot affects production traffic
Secure Firewall 3100 / 4200 cluster	Whether reset affects cluster membership
FMC-managed FTD environment	This ASA guide does not apply
ASA management access	Whether SSH, ASDM, AAA, or local users still work

Basic rules:

Do not reboot both units at the same time.
Do not reset a production active unit without a window.
Recover one unit at a time where possible.
Verify failover or cluster status after recovery.
Confirm management access before returning to service.

What to Check After Firepower ASA Password Recovery

After access is restored, verify the firewall is safe to operate.

Check	Command or Action
ASA enable access	enable
Local users	show running-config username
AAA behavior	show running-config aaa
Interfaces	show interface ip brief
Routes	show route
NAT	show nat
ACLs	show access-list
VPN	Verify site-to-site or remote access configuration
Failover	show failover
License state	show license all or platform-specific license check
Startup config	show startup-config
Save config	write memory

For Firepower 4100 ASA instances, also check from FXOS:

scope ssa
show app-instance

Common Firepower ASA Password Recovery Mistakes

1. Using old ASA recovery assumptions
   These platforms are not handled like legacy ASA appliances.
2. Not confirming ASA vs FTD
   ASA and FTD recovery are different.
3. Confusing ASA password with FXOS password
   ASA and FXOS can be separate management layers.
4. Ignoring Firepower 2100 mode
   Appliance Mode and Platform Mode have different management behavior.
5. Running factory reset without backup
   This can erase ASA configuration.
6. Restarting a production firewall without a maintenance window
   Recovery can interrupt traffic.
7. Treating Firepower 4100 like a standalone appliance
   ASA runs as a logical instance on the chassis.
8. Skipping post-recovery checks
   SSH, ASDM, AAA, routing, NAT, ACLs, failover, and licensing must be verified.

When to Rebuild or Replace Instead of Recovering the Password

Password recovery is not always the best path.

A rebuild or replacement may be more practical when:

• no configuration backup exists
• factory reset already erased the ASA configuration
• the firewall came from an unknown source
• license status is unclear
• hardware is failing
• the firewall is out of support
• the project is already planned for migration
• the recovery process creates more risk than redeployment

If password recovery leads to a hardware replacement, spare unit requirement, or migration project, Layer23-Switch can help verify Cisco Secure Firewall availability, compatible licenses, optics, power supplies, and shipping options before purchase.

FAQ

About Layer23-Switch

Layer23-Switch is a global provider of network equipment supply and infrastructure solutions, supporting enterprises, system integrators, and resellers with reliable sourcing, technical assistance, and worldwide delivery for network deployment, expansion, replacement, and upgrade projects.