Usage Guidelines
Warning
|
Using this command on a module may prevent failure analysis (including Cisco Engineering Failure Analysis (EFA)) from being
successful.
|
This command securely erases all customer information and logs on a module. This can be used to prevent exposure of customer
information when a module leaves the security of customer premises. The command overwrites all storage devices on the module
three times with a pattern march and then writes all zero values. After completion, the module is operable and in the same
state as when it was initially shipped from the Cisco factory.
When a module is erased, it is first removed from service, then rebooted, and the erasure process is started. After the process
has finished the module is powered down again and is ready for disposal or reuse.
The erasure process will take around 30 minutes (for linecards) to 120 minutes (for supervisors). The actual time taken depends
on the size and type of the storage devices on the module.
To erase customer information from all modules in a Director switch, erase each module individually using the module option to specify the target module. Erase modules in the order of 1) linecards, 2) the standby supervisor, and 3) the active
supervisor. If the module is a linecard that is being replaced, the new linecard will need to be powered up after it is inserted
into the slot.
This command will only work for modules that are online. Modules which cannot boot cannot be securely erased.
Examples
The following example shows how to securely erase all customer information on the active supervisor of a Director class switch.
The following output can only be seen when the command is executed on the supervisor console session.
switch# factory-reset module 5
!!!! WARNING !!!!
The factory reset operation will erase ALL persistent storage on the specified module.
This includes configuration, all log data, and the full contents of flash and SSDs.
Special steps are taken in an effort to render data non-recoverable. Please, proceed with
caution and understanding that this operation cannot be undone and will leave the system in
a fresh-from-factory state.
!!!! WARNING !!!!
Continue? (y/n) [n] y
A module reload is required for the reset operation to proceed.
Please, wait...
2021 Nov 25 05:13:43 switch %PLATFORM-2-PFM_SYSTEM_RESET: Manual system restart from Command Line Interface
>>>
>>>
>>>
NX7k SUP BIOS version ( 3.08 ) : Build - 04/23/2021 16:06:47
PM FPGA Version : 0x00000016
Power sequence microcode revision - 0x00000001 : card type - f10156EEA0
Booting Spi Flash : Primary
CPU Signature - 0x000106e4: Version - 0x000106e0
CPU - 1 : Cores - 4 : HTEn - 1 : HT - 2 : Features - 0xbfebfbff
FSB Clk - 532 Mhz : Freq - 2148 Mhz - 2128 Mhz
MicroCode Version : 0x00000005
Memory - 8192 MB : Frequency - 1067 MHZ
Loading Bootloader: Done
IOFPGA @ 0xd5800000
IO FPGA Version : 0x10001
PLX Version : 861910b5
Bios digital signature verification - Passed
Reset Reason Registers: 0x10 0x0
Filesystem type is ext2fs, partition type 0x83
GNU GRUB version 0.97
Autobooting bootflash:/m9700-sf3ek9-kickstart-mz.9.2.1.122.bin bootflash:/m9700
-sf3ek9-mz.9.2.1.122.bin...
Filesystem type is ext2fs, partition type 0x83
Booting kickstart image: bootflash:/m9700-sf3ek9-kickstart-mz.9.2.1.122.bin....
...............................................................................
...............................................................................
...............................................................Kickstart digita
l signature verification Successful
Image verification OK
INIT: version 2
boot device node /dev/sda
obfl flash device node /dev/sdb
log flash device node /dev/sdc
Checking obfl filesystem.
Checking all filesystems....r.. done.
Mounting Log Dir /logflash
mounting Log 0
[ 24.819087] in cctrl2 module
[ 24.853511] registering callback
Starting mcelog daemon
rrCreating logflash directories
Loading system software
Secure erase requested! Please, do not power off module!
Stopping the Prefetch PID [2316 3335]
/etc/rc.d/rcS.d/S09prefetch-image: line 70: 2316 Killed cat /bootflash/$isanimage &> /dev/null
Stopping mcelog
stopped process in pidfile '/var/run/mcelog.pid' (pid 2406)
Initiating the Secure Erase!
>>>> Wiping all storage devices ...
+++ Starting eUSB secure erase for /dev/sda +++
Successfully unmounted /dev/sda5 for erase !!
Successfully unmounted /dev/sda6 for erase !!
Successfully unmounted /dev/sda3 for erase !!
Successfully unmounted /dev/sda4 for erase !!
+++ Starting eUSB secure erase for /dev/sdb +++
Successfully unmounted /dev/sdb1 for erase !!
Successfully unmounted /dev/sdb3 for erase !!
+++ Starting eUSB secure erase for /dev/sdc +++
Successfully unmounted /dev/sdc1 for erase !!
Erasing eUSB device /dev/sda ...
---> SUCCESS
Erasing eUSB device /dev/sdb ...
---> SUCCESS
Erasing eUSB device /dev/sdc ...
---> SUCCESS
>>>> Done
+++ Starting cmos secure erase +++
---> SUCCESS
>>>> Done
+++ Starting nvram secure erase +++
---> SUCCESS
>>>> Done
>>>> Iniatilzing system to factory defaults ...
+++ Starting init-system +++
Initializing the system...
Unmounting file systems...
Making partitions on physical devices /dev/sda
Initializing Bootloader filesystem
mke2fs 1.35 (28-Feb-2004)
Checking for bad blocks (read-only test): done
Bad block 8192 out of range; ignored.
Initializing startup-config and licenses...
mke2fs 1.35 (28-Feb-2004)
Checking for bad blocks (read-only test): done
Bad block 81920 out of range; ignored.
mke2fs 1.35 (28-Feb-2004)
Checking for bad blocks (read-only test): done
Bad block 79872 out of range; ignored.
Formatting PSS:
mke2fs 1.35 (28-Feb-2004)
Checking for bad blocks (read-only test): done
Bad block 40960 out of range; ignored.
Formatting bootflash...
mke2fs 1.35 (28-Feb-2004)
Checking for bad blocks (read-only test): done
Bad block 925440 out of range; ignored.
Resetting CMOS to default configuration...
Reinitializing NVRAM contents...
Initialization completed.
---> SUCCESS
+++ Starting init-system logflash +++
Initializing the LOG flash
Formatting for LOG: /dev/hd-log
mke2fs 1.35 (28-Feb-2004)
Checking for bad blocks (read-only test): done
Bad block 3909376 out of range; ignored.
Creating directories
Reinitializing LOG contents
---> SUCCESS
>>>> Done
Copying the status file to SUP:127.1.1.6
Could not connect to 127.1.1.6: No route to host.
ncftpput: cannot open 127.1.1.6: could not connect to remote host.
Failed to copy status file to SUP:6
Sleeping for 30 sec before reload!
[ 5186.718815] reboot: Restarting system
>>>
>>>
>>>
NX7k SUP BIOS version ( 3.08 ) : Build - 04/23/2021 16:06:47
PM FPGA Version : 0x00000016
Power sequence microcode revision - 0x00000001 : card type - f10156EEA0
Booting Spi Flash : Primary
CPU Signature - 0x000106e4: Version - 0x000106e0
CPU - 1 : Cores - 4 : HTEn - 1 : HT - 2 : Features - 0xbfebfbff
FSB Clk - 532 Mhz : Freq - 2152 Mhz - 2128 Mhz
MicroCode Version : 0x00000005
Memory - 8192 MB : Frequency - 1067 MHZ
Loading Bootloader: Done
IOFPGA @ 0xd5800000
IO FPGA Version : 0x10001
PLX Version : 861910b5
Bios digital signature verification - Passed
Reset Reason Registers: 0x10 0x0
Filesystem type is ext2fs, partition type 0x83
Filesystem type is ext2fs, partition type 0x83
GNU GRUB version 0.97
Loader Version 4.3.6
loader>
The following example shows how to securely erase all customer information on a module in a Director class switch.
switch# terminal monitor
switch# factory-reset module 7
!!!! WARNING !!!!
The factory reset operation will erase ALL persistent storage on the specified module.
This includes configuration, all log data, and the full contents of flash and SSDs.
Special steps are taken in an effort to render data non-recoverable. Please, proceed with
caution and understanding that this operation cannot be undone and will leave the system in
a fresh-from-factory state.
!!!! WARNING !!!!
Continue? (y/n) [n] y
A module reload is required for the reset operation to proceed.
Please, wait...
reloading module 7 ...
.2021 Nov 24 14:27:40 switch %PLATFORM-2-PFM_MODULE_RESET: Manual restart of Module 7 from Command Line Interface
.2021 Nov 24 14:27:43 switch %PLATFORM-2-MOD_DETECT: Module 7 detected (Serial number JAE2205011S) Module-Type 1/10/40G IPS,2/4/8/10/16G FC Module Model DS-X9334-K9
.....2021 Nov 24 14:27:52 switch %PLATFORM-2-MOD_PWRUP: Module 7 powered up (Serial number JAE2205011S)
........................................................................................................................................................................................................................................................
All detected storage devices on module 7 have been wiped and reinitialized!
switch# 2021 Nov 24 14:36:10 switch %PLATFORM-2-MOD_PWRDN: Module 7 powered down (Serial number JAE2205011S)
The following example shows how to securely erase all customer information on a Fabric class switch. The following output
can only be seen when the command is executed on the supervisor console session.
switch# factory-reset
!!!! WARNING !!!!
The factory reset operation will erase ALL persistent storage on the specified module.
This includes configuration, all log data, and the full contents of flash and SSDs.
Special steps are taken in an effort to render data non-recoverable. Please, proceed with
caution and understanding that this operation cannot be undone and will leave the system in
a fresh-from-factory state.
!!!! WARNING !!!!
Continue? (y/n) [n] y
A module reload is required for the reset operation to proceed.
Please, wait...
2021 Nov 24 10:49:17 switch %PLATFORM-2-PFM_SYSTEM_RESET: Manual system restart from Command Line Interface
>> NX7--LC-loader-02.01.18 (Apr 6 2020 - 14:48:38), Build: 02.01.18
CPU0: 8572E, Version: 2.2, (0x80e80022)
Core: E500, Version: 3.0, (0x80210030)
Clock Configuration:
CPU:1066.672 MHz, CCB:533.336 MHz,
DDR:266.668 MHz (533.336 MT/s data rate), LBC:33.334 MHz
L1: D-cache 32 kB enabled
I-cache 32 kB enabled
Board: 9044, IOFPGA: 0x0000001A, SPROM: 0xAB
Boot flash : Primary
I2C: ready
DRAM: Initializing
DDR: dimm type 10, registered 1
DDR: dimm type 10, registered 1
DDR: 4 GB
Skipping PCIe controller reset
FPGA asic init done
L2: 1024 KB enabled
Using default environment
PCIE1 connected to Slot 2 as Root Complex (base address ff70a000)
Scanning PCI bus 01
PCIE1 on bus 00 - 0d
In: serial
Out: serial
Err: serial
Net: INFO: Net boot mode = 1
INFO: Net boot mode = 1
INFO: Board will come up MGMT interface
INFO: MAC address is: 3c:13:cc:1c:a7:20
eTSEC2 board phy 3
INFO: Net boot mode = 1
eTSEC2
USB: USB0: USB EHCI 1.00
scanning bus 0 for devices... 1 USB Device(s) found
scanning bus for storage devices... 0 Storage Device(s) found
IDE: Bus 0: OK
Device 0: Model: UB30STC4000CZ7-BTB-GBY Firm: 100511h Ser#: UNIGEN4 40002992
Type: Hard Disk
Capacity: 3924.7 MB = 3.8 GB (8037792 x 512)
Booting image bootflash://m9250-s5ek9-kickstart-mz.9.2.1.122.bin .......................................................................................................................................................................................
31598080 bytes read
NBI at 08000000 size 134217728
Booting image at addr 0x00800000 ...
Memory <- <0x0 0x0 0x1 0x0> (4096MB)
ethernet0: local-mac-address <- 3c:13:cc:1c:a7:20
ethernet1: local-mac-address <- 00:e0:0c:00:01:fd
ethernet2: local-mac-address <- 00:e0:0c:00:02:fd
CPU clock-frequency <- 0x3f941f80 (1067MHz)
CPU timebase-frequency <- 0x3f941f8 (67MHz)
CPU bus-frequency <- 0x1fca0fc0 (533MHz)
zImage starting: loaded at 0x00800000 (sp: 0x7fedc4c0)
Allocating 0x62b830 bytes for kernel ...
gunzipping (0x00000000 <- 0x00816000:0x00e20d84)...done 0x5fa560 bytes
Using loader supplied ramdisk at 0x2800000-0x404e000
initrd head: 0x1f8b0808
Linux/PowerPC load: rw root=/dev/ram0 rdbase=0x7000000 card_index=9044 maxcpus=2 ip=off ramdisk_size=262144 noquiet obfl_type_ide=1 kgdboc=ttyS0,9600,B console=ttyS0,9600n8nn loader_ver="02.01.18" card_index=9044 quiet bootdev=ide0 server_ip=171.69.21.28 ksimg=/m9250-s5ek9-kickstart-mz.9.2.1.122.bin isanimg=/m9250-s5ek9-mz.9.2.1.122.bin Finalizing device tree... flat tree at 0xe2d140
setup_arch: initmem
mpc85xx_ds_setup_arch()
arch: exit
[ 0.055208] Host controller irq 26
[ 0.122932] Assign root port irq 26
[ 0.584898] physmap-flash physmap-flash.0: Could not reserve memory region
[ 0.887536] Enabling all PCI devices
INIT: Checking all filesystems....r.retval=[0]
done.
Loading system software
Secure erase requested! Please, do not power off module!
Calling the serase.sh script!
>>>> Wiping all storage devices ...
+++ Starting eUSB secure erase for /dev/hda +++
Successfully unmounted /dev/hda5 for erase !!
Successfully unmounted /dev/hda6 for erase !!
Successfully unmounted /dev/hda3 for erase !!
Successfully unmounted /dev/hda4 for erase !!
Successfully unmounted /dev/hda1 for erase !!
Successfully unmounted /dev/hda1 for erase !!
Erasing eUSB device /dev/hda ...
---> SUCCESS
+++ Starting cmos secure erase +++
---> SUCCESS
>>>> Done
+++ Starting nvram secure erase +++
---> SUCCESS
>>>> Done
>>>> Iniatilzing system to factory defaults ...
+++ Starting init-system +++
Initializing the system
umount filesystem /mnt/plog
umount filesystem /mnt/pss
umount: /mnt/pss: not mounted
Disk /dev/hda doesn't contain a valid partition table
proc on /proc type proc (rw)
none on /sys type sysfs (rw)
nodev on /debugfs type debugfs (rw,mode=755)
none on /isan type tmpfs (rw,size=500m,mode=755)
none on /var type tmpfs (rw,size=50m,mode=777)
none on /nxos/tmp type tmpfs (rw,size=20m,mode=777)
none on /var/log type tmpfs (rw,size=50m,mode=777)
none on /var/home type tmpfs (rw,size=5m,mode=777)
none on /var/tmp type tmpfs (rw,size=300m,mode=777)
none on /var/sysmgr type tmpfs (rw,size=300m,mode=777)
none on /var/sysmgr/ftp type tmpfs (rw,size=300m,mode=777)
none on /dev/shm type tmpfs (rw,size=200m,mode=777)
none on /volatile type tmpfs (rw,size=200m,mode=777)
none on /debug type tmpfs (rw,size=2m,mode=777)
none on /lc type tmpfs (rw,size=500m,mode=777)
none on /lc/var/tmp type tmpfs (rw,size=48m,mode=777)
none on /lc/var/log type tmpfs (rw,size=50m,mode=777)
none on /lc/var/home type tmpfs (rw,size=5m,mode=777)
/var/log/external on /lc/var/log/external type none (rw,bind)
none on /lc/mnt/pss type tmpfs (rw,size=100m,mode=777)
none on /lc/var/sysmgr type tmpfs (rw,size=180m,mode=777)
/var/sysmgr/ftp/cores on /lc/var/sysmgr/ftp/cores type none (rw,bind)
/bin on /lc/bin type none (rw,bind)
/sbin on /lc/sbin type none (rw,bind)
/lib on /lc/lib type none (rw,bind)
/usr/lib on /lc/usr/lib type none (rw,bind)
/usr/bin on /lc/usr/bin type none (rw,bind)
/proc on /lc/proc type none (rw,bind)
/debugfs/tracing on /lc/debugfs/tracing type none (rw,bind)
/dev on /lc/dev type none (rw,bind)
/isanboot on /lc/isanboot type none (rw,bind)
/etc on /lc/etc type none (rw,bind)
/sys on /lc/sys type none (rw,bind)
none on /lc/dev/shm type tmpfs (rw,size=200m,mode=777)
devpts on /dev/pts type devpts (rw,gid=5,mode=620)
/dev/pts on /lc/dev/pts type none (rw,bind)
none on /var/sysmgr/startup-cfg type tmpfs (rw,size=40m,mode=777)
none on /data_store type ramfs (rw)
Formatting compact flash partitions.
This can take several minutes...(10mts)
Formatting and Checking Bad Blocks /dev/hd-cfg0 ... done.
Formatting and Checking Bad Blocks /dev/hd-cfg1 ... done.
Formatting and Checking Bad Blocks /dev/hda7 ... done.
Formatting and Checking Bad Blocks /dev/hd-pss ... done.
Formatting and Checking Bad Blocks /dev/hd-obfl ... done.
Formatting and Checking Bad Blocks /dev/hd-bootflash ... done.
mount filesystem /mnt/obfl
mount filesystem /mnt/cfg/0
mount filesystem /mnt/cfg/1
mount filesystem /mnt/pss
mount filesystem /bootflash
Resetting CMOS to default configuration
Reinitializing NVRAM contents
Initialization completed
---> SUCCESS
>>>> Done
Reloading the switch!
Sleeping for 30 sec before reload!
[ 4700.171922] reboot: Restarting system
>> NX7--LC-loader-02.01.18 (Apr 6 2020 - 14:48:38), Build: 02.01.18
CPU0: 8572E, Version: 2.2, (0x80e80022)
Core: E500, Version: 3.0, (0x80210030)
Clock Configuration:
CPU:1066.672 MHz, CCB:533.336 MHz,
DDR:266.668 MHz (533.336 MT/s data rate), LBC:33.334 MHz
L1: D-cache 32 kB enabled
I-cache 32 kB enabled
Board: 9044, IOFPGA: 0x0000001A, SPROM: 0xAB
Boot flash : Primary
I2C: ready
DRAM: Initializing
DDR: dimm type 10, registered 1
DDR: dimm type 10, registered 1
DDR: 4 GB
Skipping PCIe controller reset
FPGA asic init done
L2: 1024 KB enabled
Using default environment
PCIE1 connected to Slot 2 as Root Complex (base address ff70a000)
Scanning PCI bus 01
PCIE1 on bus 00 - 0d
In: serial
Out: serial
Err: serial
Net: INFO: Net boot mode = 1
INFO: Net boot mode = 1
INFO: Board will come up MGMT interface
INFO: MAC address is: 3c:13:cc:1c:a7:20
eTSEC2 board phy 3
INFO: Net boot mode = 1
eTSEC2
USB: USB0: USB EHCI 1.00
scanning bus 0 for devices... 1 USB Device(s) found
scanning bus for storage devices... 0 Storage Device(s) found
IDE: Bus 0: OK
Device 0: Model: UB30STC4000CZ7-BTB-GBY Firm: 100511h Ser#: UNIGEN4 40002992
Type: Hard Disk
Capacity: 3924.7 MB = 3.8 GB (8037792 x 512)
loader>