How to Factory Reset a Cisco Switch (write erase, vlan.dat, Mode Button)

Short answer

How do you factory reset a Cisco switch? Back up the config, then from privileged EXEC run write erase (or erase startup-config), delete flash:vlan.dat, and reload, answering No at the save prompt. On Catalyst 9000 switches, factory-reset all performs a deeper wipe — it removes the IOS image but retains perpetual licenses. Password-locked switches use the Mode button instead.

A factory reset returns a Cisco switch to its as-shipped state: no startup configuration, no vlan.dat, no stored credentials. This guide covers the three procedures that matter in practice — the classic CLI wipe (write erase), the Catalyst 9000 factory-reset command, and Mode-button password recovery — verified against Cisco's own documentation.

Before You Reset: Capture Config and License State

Every reset method below is destructive and none of them are reversible. Capture the device state first, even on a switch you plan to decommission — the config is your rollback path and the license output is your proof of entitlement on resale.

show running-config — capture to a terminal log, or copy running-config tftp: / copy running-config flash:backup.cfg
show vlan brief and show vtp status — the VLAN database lives outside the config file and is easy to forget
show version — records the exact IOS/IOS-XE image and, on Catalyst 9000, the license level in use
show license summary (IOS-XE) — documents Network Essentials/Advantage and any DNA subscription state
dir flash: — note the boot image filename; if you intend to run factory-reset all, download a copy of the image to USB or a TFTP server first, because that command deletes it

If you are prepping a used switch for redeployment rather than disposal, our guide to refurbished network switches covers what a properly wiped unit should look like on arrival.

Method 1: CLI Reset — write erase, delete vlan.dat, reload

This is the standard reset on both classic IOS switches (2960, 3560, 3750) and IOS-XE Catalyst 9000 platforms. write erase and erase startup-config are the same operation — the former is the older alias, and both clear NVRAM without touching the IOS image.

Step	Command	What it does
1	`enable`	Enters privileged EXEC mode
2	`write erase`	Erases the startup configuration in NVRAM (confirm at the prompt); identical to `erase startup-config`
3	`delete flash:vlan.dat`	Deletes the VLAN database — VLANs and VTP data are stored in this separate flash file, not in the startup config
4	`reload`	Restarts the switch; answer no if asked to save the modified configuration

The reload prompt is where resets go wrong: if the switch asks "System configuration has been modified. Save?" and you answer yes, the running config is written straight back to NVRAM and the erase is undone. Answer no, then confirm the reload. The switch boots into the initial System Configuration Dialog with default VLANs only.

On a StackWise stack, run the erase on the active switch and reload the entire stack; each member keeps its own flash file system (flash-1:, flash-2:, and so on), so check each member for a leftover vlan.dat before reloading.

Method 2: factory-reset on Catalyst 9000 (IOS-XE)

Catalyst 9000 switches (9200, 9300, 9400, 9500, 9600) add a purpose-built factory-reset command, introduced in Cisco IOS XE Fuji 16.8.1a. It goes far beyond write erase — Cisco positions it for RMA returns, decommissioning, and recovering a compromised device.

Option	Effect
`factory-reset all`	Erases NVRAM, all IOS images including the current boot image, boot variables, startup/running config, and user data; Cisco's recommended option
`factory-reset config`	Resets the startup configuration only — the practical choice when redeploying a switch, since the IOS image survives
`factory-reset boot-vars`	Resets user-added boot variables only
`factory-reset all secure 3-pass`	Adds a 3-pass overwrite (keyword introduced in IOS XE 17.2.1); later releases document secure-wipe operation per NIST SP 800-88 Rev. 1 media-sanitization guidelines

Per Cisco's Catalyst 9300 system management guide, the erased-versus-retained split is explicit:

Erased	Retained
All IOS images, including the current boot image	Licenses
Startup and running configuration, user data	SUDI certificates and PKI keys
Crash info, logs, OBFL logs	Configuration register value
Removable storage contents (USB/SSD/SATA)	Data on remote FRUs
FIPS-related keys, user-added ROMMON variables	—

Warning: after factory-reset all completes, the switch reboots into ROMMON with no bootable image. You must reload IOS-XE from USB or TFTP before the switch will run again. Do not interrupt power during the operation. Factory reset on stacks and StackWise Virtual is supported from IOS XE 17.2.1; earlier releases support standalone switches only.

If you are choosing between platforms for a refresh, the erase/retain behavior is identical across the family — see our Catalyst 9300 vs 9200 comparison for the differences that actually matter.

Method 3: Mode Button — Password Recovery Without Credentials

When you cannot log in — the usual state of a switch pulled from a decommissioned rack — the Mode button gets you to the boot loader. The procedure differs between classic IOS and Catalyst 9000 hardware.

Catalyst 2960 (and 2970): per Cisco's fixed-configuration password recovery document:

Step	Action
1	Connect to the console (9600/8/N/1), unplug power, then hold the Mode button while reconnecting the power cable
2	Release the Mode button when the SYST LED blinks amber and then turns solid green; you land at the `switch:` boot loader prompt
3	Run `flash_init`, then `load_helper`, then `dir flash:` to list files
4	`rename flash:config.text flash:config.old` — the passwords live in config.text; renaming hides it from boot
5	`boot`, answer n to the setup dialog, enter enable mode, then `rename flash:config.old flash:config.text` and `copy flash:config.text system:running-config`
6	Set new passwords (`enable secret`, line passwords) and save with `write memory`

To fully wipe a 2960 instead of recovering it, at the same switch: prompt run flash_init and then delete flash:config.text and flash:vlan.dat before booting. Note that if no service password-recovery was configured, the boot loader only offers a reset that deletes the configuration outright — recovery with config intact is not possible.

Catalyst 9200/9300 (IOS-XE): per Cisco's Catalyst 9000 password recovery document, power-cycle the switch and press Ctrl-C during "Preparing to autoboot" — or press the Mode button repeatedly as the switch boots — to reach the switch: ROMMON prompt. Then:

SWITCH_IGNORE_STARTUP_CFG=1 — tells the switch to boot ignoring the startup config (and its passwords)
boot — switch boots to a default config; enter enable
copy startup-config running-config — restores the original config without its login lockout
Set a new credential, e.g. username admin privilege 15 secret NEWPASSWORD
no system ignore startupconfig switch all — clears the ROMMON variable so the config loads on the next reboot
copy running-config startup-config, then verify with show romvar that SWITCH_IGNORE_STARTUP_CFG is 0

On a StackWise stack, power off all members and recover on the active switch alone, then power the members back on — otherwise the standby re-syncs the old config and the recovery fails.

What Happens to Licenses on a 9300

The short answer: nothing. Cisco's factory-reset documentation for the Catalyst 9300 lists licenses under data retained, alongside SUDI certificates. The Network Essentials or Network Advantage network-stack license is perpetual and tied to the chassis serial number, so it survives factory-reset all, ROMMON recovery, and resale.

The DNA subscription is a separate, term-based add-on. On IOS-XE 17.3.2a and later, Catalyst 9000 switches use Smart Licensing Using Policy, which has no evaluation mode and does not require registration for the switch to boot or forward traffic — a lapsed DNA term does not disable switching. This is why a used unit such as the Catalyst 9300 48-port PoE+ (C9300-48P-A) arrives fully functional at its Network Advantage feature level with no license transfer paperwork required for basic operation.

Verifying a Clean Switch: Refurb Acceptance Checklist

Whether you just wiped a switch or received one that a vendor claims is factory-fresh, verification takes five minutes on the console:

The switch boots to the initial System Configuration Dialog ("Would you like to enter the initial configuration dialog?") rather than a hostname prompt
show startup-config returns "startup-config is not present"
show vlan brief shows only the default VLANs (1, 1002-1005)
dir flash: shows no config.text, vlan.dat, or private-config files (check every flash-N: on stack members)
show romvar (IOS-XE) shows no leftover SWITCH_IGNORE_STARTUP_CFG=1 — a switch that ignores its startup config on every boot is a common post-recovery defect in the secondary market

Every switch we ship is wiped and verified against this checklist before it leaves the bench — browse current inventory in our networking catalog.

Frequently asked questions

Does write erase delete VLANs on a Cisco switch?

No. VLAN and VTP information is stored in a separate flash file, vlan.dat, not in the startup configuration. After write erase you must also run delete flash:vlan.dat before reloading, or the switch comes back up with all its VLANs intact.

Does a factory reset remove the IOS image?

Depends on the method. write erase / erase startup-config never touches the image. On Catalyst 9000 switches, factory-reset config keeps the image, but factory-reset all deletes every IOS image including the current boot image — the switch reboots into ROMMON and you must reinstall IOS-XE from USB or TFTP.

Does factory-reset all erase the licenses on a Catalyst 9300?

No. Cisco's Catalyst 9300 documentation explicitly lists licenses as data retained during factory reset, along with SUDI certificates and PKI keys. The perpetual Network Essentials or Network Advantage license is tied to the chassis and survives a full wipe and resale; only the term-based DNA subscription expires separately.

How do I reset a Catalyst 2960 if I don't know the password?

Hold the Mode button while reconnecting power and release it when the SYST LED blinks amber then turns solid green. At the switch: prompt, run flash_init and load_helper, then either rename flash:config.text to recover the config with new passwords, or delete flash:config.text and flash:vlan.dat for a full wipe, then boot.

Can I factory reset a stacked Catalyst 9300?

Yes, on Cisco IOS XE 17.2.1 and later, which added factory-reset support for StackWise stacks and StackWise Virtual. On earlier releases the command is supported only on standalone switches. For Mode-button password recovery on a stack, power off all members and recover on the active switch alone.

What if service password-recovery is disabled on the switch?

If an administrator configured no service password-recovery, the boot loader will not let you recover the existing configuration. The Mode-button procedure then only offers a reset that deletes the startup config and vlan.dat outright — you regain access, but the configuration is unrecoverable.

How to factory reset a Cisco switch (write erase, vlan.dat & Mode button)