Cisco – Adding encrypted password on Cisco 3560-CG switch

ciscoswitchtroubleshooting

I'm trying to update the enable secret and account password on a Cisco3560-CG switch with an encrypted password shared by devices throughout the company. I use the following command for the enable secret and get the following output.

enable secret 5 <encrypted password>
ERROR: The secret you entered is not a valid encrypted secret. To
enter an UNENCRYPTED secret, do not specify type 5 encryption. When
you properly enter an UNENCRYPTED secret, it will be encrypted.

We've used this encrypted password successfully on many other devices so I know it's a valid encrypted secret, but we haven't used it on any other 3560-CG's.

We've tried updating to the latest OS (15.2.2E6) and rolling back to 15.0.2 and neither helps. I can add an enable secret in clear text, but that doesn't work for our organizational policy.

Has anyone else run into this issue on this or any other model of Cisco switch?

Best Answer

You are receiving the error because the "password" you are entering is not a proper MD5 hash. Check to verify that you are trying to enter a complete MD5 hash and that it is not another type of hash. Cleartext, Type 4 or Type 7 passwords will not suffice.

You may be trying to use a password obscured by a Vigenère cipher. The Vigenère cipher is often refered as a Type 7 password. It is associated with the service password-encryption and enable password 7 supersecretpwcommands.

Type 7 password hashes look something like this:

098f6bcd4621d373cade4e832627b4f6

Type 5 (MD5) hashes look a little something like this:

$1$jR5i$.HDBuKq.wIDOn2EYpCPYc0

Cisco Type 5 hashes will always be comprised of 3 elements, separated by $.

For the above example:

  • 1 - Denotes a salted hash
  • jR5i - 24-bit randomly generated salt value
  • .HDBuKq.wIDOn2EYpCPYc0 - MD5 hash

Jeremy Stretch does a great write-up on how Cisco leverages MD5 here:

http://packetlife.net/blog/2008/jul/9/a-bit-more-detail-on-ios-password-hashes/

Related Topic