Enable Secure Data Wipe Capabilities

Enable the secure data wipe capability

Use this task to configure secure data wipe on IoT platforms to ensure storage devices are properly purged using NIST SP 800-88r1 compliant secure erase commands.

Secure data wipe is a Cisco-wide initiative to ensure that storage devices on all IOS XE based platforms are properly purged using NIST SP 800-88r1 compliant secure erase commands. Whenever possible, IoT platforms leverage the corresponding ENG design and implementation available on their platforms.

This feature is supported on the following IoT platforms:

  • IR1101

  • IR1800

  • IR8140

  • ESR6300

When secure data wipe is executed, the following are wiped out:

  • IR1101, IR1800, IR8140: NVRAM, rommon variables, and bootflash.

  • ESR6300: NVRAM, rommon variables, and bootflash.

Procedure

Step 1

Use the factory-reset all secure command to execute the secure data wipe. When prompted to confirm, enter Y.

Example:

Router# factory-reset all secure
The factory reset operation is irreversible for securely reset all. Are you sure? [confirm]Y
This operation may take hours. Please do not power cycle.

Step 2

Use the show platform software factory-reset secure log command after the command is executed and IOS XE boots up, to check the log.

Example:

Router# show platform software factory-reset secure log
Factory reset log:
#CISCO DATA SANITIZATION REPORT:# IR1800
Purge ACT2 chip at 12-08-2022, 15:17:28
ACT2 chip Purge done at 12-08-2022, 15:17:29
mtd and backup flash wipe start at 12-08-2022, 15:17:29
mtd and backup flash wipe done at 12-08-2022, 15:17:29.

The router is in the rommon prompt with default factory settings (baud rate 9600) after the command is executed. The bootflash is not formatted until booting with an IOS image through usbflash or TFTP download, if the platform is supported.