Rotating router and firewall credentials without an outage

Rotating credentials on production routers and firewalls is a critical security practice, but it carries real risk: a misconfigured command, a typo, or poor sequencing can lock you out or trigger an unexpected failover. The key is understanding your device architecture, preparing both the old and new credentials in advance, and following a vendor-specific procedure that preserves access at every step. This guide covers the practical mechanics of zero-downtime credential rotation across Cisco IOS, Juniper Junos, Palo Alto Networks, and Fortinet FortiOS.

Why credential rotation matters

Periodic password changes reduce the blast radius of a compromised account and help meet compliance requirements (PCI-DSS, SOC 2, HIPAA). However, network devices are different from servers: they are the path through which all traffic flows. A failed credential change can isolate your entire network. The solution is not to skip rotation, but to execute it methodically using parallel access methods and staged rollout.

Pre-rotation checklist

• →Document all current credentials (admin, read-only, service accounts) in a vault or secrets manager
• →Verify out-of-band access: console port, serial connection, or IPMI to each device
• →Confirm you have a secondary admin account or recovery method enabled
• →Test SSH and SNMP access from your management station before making changes
• →Schedule the rotation during a maintenance window if possible; if emergency rotation is needed, notify stakeholders
• →Generate strong, unique passwords (20+ characters, mixed case, numbers, symbols) using a dedicated tool
• →Back up the running configuration to an external server
• →Prepare a rollback plan: know how to revert using console access if needed

Cisco IOS credential rotation

On Cisco routers and switches, the standard approach is to create a new admin account while keeping the old one active, verify the new account works, then disable the old one. This two-step process eliminates lockout risk.

! Step 1: Create new admin account
config t
username admin-new privilege 15 secret <new-password>
exit

! Step 2: Verify new account works (log out and log back in as admin-new)
! If successful, proceed to step 3

! Step 3: Disable old account
config t
no username admin
end
write memory

For enable password (privileged EXEC mode), use the same pattern: set a new enable secret, test it, then remove the old one. Never change both at once.

Juniper Junos credential rotation

Junos uses a hierarchical user and class model. Create a new admin user in the same class, test access, then delete the old user.

! Step 1: Create new admin user
config
set system login user admin-new class super-user authentication encrypted-password "<hash>"
commit
exit

! Step 2: Test login as admin-new
! If successful, proceed to step 3

! Step 3: Delete old user
config
delete system login user admin
commit
exit

Use the 'request system login' command to generate a password hash before committing, or paste an encrypted hash directly. Always commit changes and verify connectivity before deleting the old account.

Palo Alto Networks credential rotation

Palo Alto firewalls separate admin accounts from the system. Rotate admin credentials in the web UI or CLI, and always maintain at least one backup admin account.

! Step 1: Create new admin account
config
set mgt-config users admin-new phash <hashed-password>
commit
exit

! Step 2: Test login via web UI or SSH as admin-new
! If successful, proceed to step 3

! Step 3: Delete old admin account
config
delete mgt-config users admin
commit
exit

For Panorama-managed firewalls, perform credential changes on Panorama first, then push policies to managed devices. Test each device individually before removing the old account.

Fortinet FortiOS credential rotation

FortiOS uses local admin accounts and optional LDAP or RADIUS integration. Rotate local admin passwords using the same create-test-delete pattern.

! Step 1: Create new admin account
config system admin
edit admin-new
set password <new-password>
set accprofile "super_admin"
end

! Step 2: Test login as admin-new
! If successful, proceed to step 3

! Step 3: Delete old admin account
config system admin
delete admin
end

Post-rotation validation

• →Confirm new credentials work from a separate terminal session before closing the old one
• →Verify SSH, Telnet, and web UI access with the new account
• →Check that SNMP community strings or v3 credentials are updated if applicable
• →Test API access if scripts or automation rely on device credentials
• →Review syslog and audit logs for any failed login attempts or configuration changes
• →Update your credential vault or secrets manager with the new password
• →Document the rotation date, time, and operator in your change log

Automation and best practices

For large networks, automate credential rotation using Ansible, Terraform, or your vendor's API. Store credentials in HashiCorp Vault, AWS Secrets Manager, or CyberArk, and rotate them on a fixed schedule (every 90 days is common). Always generate strong, unique passwords; avoid reusing credentials across devices. Use SSH keys for service accounts where possible, and rotate those keys quarterly.

Test your rotation procedure in a lab environment first. Elematron's free network tools and multi-vendor config generator can help you build and validate configurations before pushing to production.