Restoring a Missing or Corrupt IOS Image

There may also come a time where you router doesn’t have a valid IOS image in Flash memory – perhaps because you have accidentally erased Flash, upgraded your router’s Flash memory, or the image contained in Flash has become corrupted. This leaves you with a couple of options, one of which is to use ROM Monitor mode to download a new IOS image to the router over its console port. Unfortunately, at a speed of 9600 bps, this will take a fairly long time. A more common way to restore an IOS image to Flash is to use the boot image (RxBoot) to download a new image to the router from a TFTP server.

This means that you’ll need a properly configured TFTP server that contains a valid IOS file to begin with. The next step involves booting the router into the boot image, which may mean that you will need to first change the router’s configuration register via ROM Monitor mode. After booting into the boot image, you can then download an IOS image to your router via TFTP.

For the purpose of this illustration, we’ll assume that our router is a Cisco 2500. Our goal is to install a new IOS image on a system that currently has no IOS image in Flash. We’ll start by accessing ROM Monitor mode to change the router’s configuration register. Recall that the configuration register value to boot the system from the boot image in ROM ends with the hex digit 1. As such, we’ll change the register to 0x2101.

19:44:26: %SYS-5-RELOAD: Reload requested
System Bootstrap, Version 5.2(8a), RELEASE SOFTWARE
Copyright (c) 1986-1995 by cisco Systems
2500 processor with 16384 Kbytes of main memory
Abort at 0x10EA880 (PC)
>o/r 0x2101

After issuing the i command, the router will reset and boot from the boot image, as specified by the new configuration register value. Once it finishes booting, you should find yourself at the Router(boot)> prompt.

The first step is entering enable mode. Although the router doesn’t have a valid IOS image in Flash, it may still have a valid startup configuration file in NVRAM. As such, you may still be prompted for a password. To avoid the startup configuration file as well, you would need to set the configuration register to 0x2141.

It is also worth testing whether or not the router can ping the TFTP server you intend to download the new IOS image from. If it can’t, you may need to change (or add) an IP address of a router interface.

Router (boot)>en
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echoes to, timeout is 2 seconds:
Success rate is 100 percent (5/5), round-trip min/avg/max = 1/200/1000 ms

In this case, the ping was successful, meaning that the router is capable of communicating with the TFTP server. The next step is issuing the copy tftp flash command. This prompts us for the IP address of the TFTP server, as well as the name of the IOS image that we wish to download to Flash. If Flash memory already contains IOS images, they may need to be erased as well.

Router (boot)#copy tftp flash
Address or name of remote host []?
Source file name? d2500.bin
Destination file name [d2500.bin]?
Erase flash device before writing? [confirm] yes/no yes

I’ve saved some space by not showing the output of the command – those exclamation points that you usually see when copying files to or from the router. Once the copy operation is complete, there is still an additional step to undertake – changing the configuration register back to our original value, 0x2102. Follow this up with the reload command, being sure to think carefully about whether you want to save any changes that you have made to the running configuration file. If your startup configuration file already contains correct settings, make a point of not saving any changes when prompted.

Router(boot)#configure terminal
Enter configuration commands, one per line. End with CNTL/Z.
Router(boot)(config)#config-register 0x2102
System configuration has been modified. Save? [yes/no]

With the router configuration register changed back to 0x2102, the router should boot into the recovered IOS image normally, using the startup configuration file stored in NVRAM.

Author: Dan DiNicolo

Dan DiNicolo is a freelance author, consultant, trainer, and the managing editor of He is the author of the CCNA Study Guide found on this site, as well as many books including the PC Magazine titles Windows XP Security Solutions and Windows Vista Security Solutions. Click here to contact Dan.