When I was preparing this article I found the latest post about Packet Life Community Lab and its FAQ. May be somebody will find these notes interesting especially ifyou do not use Opengear CM4116 console server.

Password recovery procedure requires terminal to be attached to the console port. Let’s assume that terminal is a terminal server attached to a monitored Cisco router. There is a step in password recovery procedure that is sending "Break" to the console in order to put the router into ROMMON. The problem is to send the "BREAK" via telnet. In live environment it means that if you don't know how to send "BREAK" to remote end, you have to get in the car with you laptop and make the drive (let say to another city), even you have a terminal server. The problem can be solved by reducing line speed of the terminal to 1200. It is a key point of the trick. In this example we assume that terminal server is a Cisco router too, which is connected via serial line to a console port of the router that is under recover. Refer to Terminal server

So your password recovery procedure goes like this:

1. Reduce the speed of the terminal line.

line 40
 location Another-City-Router-Console
 transport input telnet
 speed 1200

1. Open telnet session to a terminal server on port 2000+ line number, in my example port 2040. Of course you won't get the prompt, this is normal.

2. Call to local staff that is able to find and identify the router correctly and ask them to power off/on it. (The better and safer choice is remotely controlled power outlets - you don't have to call anyone).

3. When the router is powering on, press "SPACE" continuously for a minute or two.

4. Close the terminal session and change line speed to 9600.

line 40
 location Another-City-Router-Console
 transport input telnet
 speed 9600

1. Open telnet session to the line 2040 again. If you see rommon 1> prompt, continue Password Recovery Procedure according documentation.

NOTE. It works with console speed set to 9600.

Refer to break sequences