SYSTEM RECOVERY & RESTORE OPERATIONS

TITLE: Procedures for restoring the Operating System and Configuration Settings on a Cisco
Autonomous Wireless Access Point.

Recently our company network was breached by an unknown party originating from a Chinese
IP address. As a part of this breach, the attackers connected to the Cisco Wireless Access Points
that monitor the controls for the large machines down in the manufacturing plant and
sabotaged them by erasing the NVRAM disk on each one. As a result, all the access points are
bricked and the plant has been shut down as a safety precaution.
The purpose of this procedure is to document how to unbrick and restore the OS and
Configurations on Cisco Wireless Access Points.
This policy document and procedure applies to all network admins and technicians regarding
recovering Cisco Wireless Access Points.
Phase 1: Preparing the Operating System for loading into the Access Point.
1. Download the correct Cisco IOS image file for the devices we are using. The devices
we are using require the image file “c1140-k9w7-tar.124-21a.JY.tar”.
2. Install and setup a TFTP Server if you don’t already have one. We do and it’s IP
address is “192.168.100.101”.
3. Place the IOS image file in the directory we want to load it from on the TFTP Server.
We will place it in the “TFTProot/recovery/Cisco/IOS/AP/image/” directory.
4. Keep a copy of this image file on the TFTP Server in the event this happens again.
Phase 2: Loading the Operating System into the Access Point.
1. Power on the Access Point to restore and connect to it with a console cable or a telnet
session.
2. Now we have entered the CLI and must set the IP, mask, and gateway for the device. At the
prompt “ap:” enter the following commands: (THESE COMMANDS ARE CASE SENSITIVE!)
a. Type “set IP_ADDR 192.168.100.100” to set the AP’s IP address. Then press
enter/return.
b. Type “set NETMASK 255.255.255.0” to set the AP’s subnet mask. Press
enter/return.
c. Type “set DEFAULT_ROUTER 192.168.100.1” to set the AP’s default gateway. Press
enter/return.
3. Once this has been done, we need to prepare the device for the loading process. To do this
we type the following commands and press enter/return after each one: (THESE
COMMANDS ARE ALSO CASE SENSITIVE!)
a. Type “tftp_init” to allow the AP to connect to the TFTP Server.
b. Type “ether_init” to enable the Ethernet Connection to the TFTP Server.
c. Type “flash_init” to allow the AP’s flash memory to receive the IOS image file.
 SYSTEM RECOVERY & RESTORE OPERATIONS

4. Now we will load the IOS image file onto the device’s flash memory. To do this we will need
to enter a special command to extract and load the IOS onto the AP. Type in the following
command exactly as it is shown then press enter/return:

“tar -xtract tftp://192.168.100.101/recovery/Cisco/IOS/AP/image/c1140-k9w7-tar.124-21a.JY.tar flash:”

Here is an explanation for this command:

“tar” tells the AP that the file is a .TAR or Compressed Tarball Archive File.
“-xtract” is used in conjunction with the “tar” value to tell the AP to extract the archive file.
“tftp://192.168.100.101/recovery/Cisco/IOS/AP/image/c1140-k9w7-tar.124-21a.JY.tar” tells
the AP that path to the archive file is located on our TFTP Server at “192.168.100.101” inside
the “recovery/Cisco/IOS/AP/image/” directory with the filename of
“c1140-k9w7-tar.124-21a.JY.tar” and to place the extracted files into the flash memory.
5. If you did this correctly then you should see the files and directories be displayed on the
screen as they are extracted. When the screen gets full then “-- MORE --“ will be displayed
at the bottom of the screen.
6. When “-- MORE --“ is displayed press the spacebar immediately to continue the file
extraction. Always do this when “-- MORE --“ is displayed or else the extraction will fail.
7. Once the extraction is completed we need to enter the command to tell the device to boot
using the newly extracted OS. Enter the following commands: (COMMANDS ARE CASE
SENSITIVE!)
a. Type “set BOOT flash:/ c1140-k9w7-tar.124-21a.JY” to tell the AP to boot from this
IOS image. Then press enter/return.
b. Type “set” to review the bootloader entries. If everything was done correctly then
you should see this as the output on the screen:

BOOT=flash:/c1140-k9w7-tar.124-21a.JY

DEFAULT_ROUTER=192.168.100.1

IP_ADDR=192.168.100.100

NETMASK=255.255.255.0
c. If you see the above on the screen then everything should be good. Now type
“boot” and press enter/return to reboot the AP.
8. If all went well then you should see the screen return a “AP#” as the prompt instead of
“ap:”. This means that the AP is now running a fresh copy of the operating system.