Foundry Switch Default IP, Console Access and Password Recovery

01 /There is no default IP address

Foundry devices did not ship with a factory IP address or a DHCP client. A new or freshly erased unit has an empty configuration and answers nothing on the network. The old site kept a resource-center page on this because the question arrived constantly from people who had plugged in a used FastIron and scanned for it. The answer is the console.

02 /Console cable and terminal settings

Modern laptops need a USB to serial adapter. If the port is RJ-45, the common rollover console cable with a DB-9 adapter usually works. If the console is DB-9, try a straight-through serial cable first and a null modem cable if no prompt appears.

03 /Assigning the first management IP

On a Layer 2 image the address is global; on a Layer 3 image it belongs to a virtual interface. The shape below is for a Layer 2 image; the CLI reference shows the Layer 3 form.

enable
configure terminal
hostname sw1
ip address 192.168.1.20 255.255.255.0
ip default-gateway 192.168.1.1
username admin password NEW-PASSWORD
enable super-user-password NEW-PASSWORD
write memory

Connect a network port to the same VLAN as your workstation and the device answers pings on the new address. Move the address to a dedicated management VLAN (VLANs) before production.

04 /Password recovery procedure

Recovery requires physical access to the console and a power cycle; there is no network path, by design. The general shape is stable across IronWare platforms, but the interrupt key, the prompt text and the exact boot command vary by model and release.

1. 01

   Attach the console

   Connect at 9600 8N1 with no flow control and confirm you see output. Recovery is impossible without a working console session.

2. 02

   Power cycle and interrupt the boot

   Pull power and reapply. Watch for the boot monitor banner and press b during the countdown to stop the normal boot. Some platforms show a different key or a menu; use what the banner says.

3. 03

   Clear the password check

   At the boot monitor prompt enter no password. This does not erase the configuration; it tells the system image to skip the password check on the next boot only.

4. 04

   Boot the system image

   Enter boot system flash primary. The device boots IronWare and drops you at a privileged prompt without asking for a password.

5. 05

   Set new credentials

   Enter configure terminal, set enable super-user-password, replace or remove username entries you do not recognise, and check for stray SNMP communities and telnet settings.

6. 06

   Save and verify

   write memory, then reload and log in with the new password to prove the recovery took.

05 /Enabling SSH after recovery

Telnet is often on by default on older releases. Generate a host key, confirm SSH answers, then disable telnet and the web interface; the security advisories archive has the full hardening set.

configure terminal
crypto key generate rsa
aaa authentication login default local
no telnet server
no web-management http
write memory

06 /Power supplies and connectors

The old resource-center page carried a power plug diagram. Generic guidance: fixed units and small chassis use the IEC C13/C14 coupling, the same cord as a server. High-draw chassis supplies use the larger IEC C19/C20 coupling and sometimes dedicated circuits; some large chassis were also sold with DC supplies for carrier racks. Most chassis accept two or more supplies for redundancy. Read the label on each supply for its input rating; this site does not publish per-model figures.

07 /Safety notes for second-hand gear

• Wipe the configuration. erase startup-config and reload, then confirm with show configuration. A previous owner may have left credentials, SNMP communities or a management address on your subnet.
• Verify the firmware. Record the image names from show version and show flash. An unexpected or renamed image is a reason to reflash from a known copy before trusting the unit.
• Assume no support. Firmware downloads for Foundry-era hardware require successor support contracts that are not sold for these platforms; see the acquisition page. Keep the management plane on an isolated VLAN.