Router Hardware Management Guide for Cisco 8000 Series Routers, Cisco IOS XR Release

PDF

Router Hardware Management Guide for Cisco 8000 Series Routers, Cisco IOS XR Release

Secure erase of router SSD data

Updated: July 1, 2026

Want to summarize with AI?

Log in

Describes the secure erase data security feature that removes all customer-sensitive data, configurations, and keys from the solid state drive on a line card, route processor, or the entire router in compliance with NIST 800-88 guidelines and then shuts the node down.

Secure erase is a data security feature that:

  • securely erases solid-state drive (SSD) data on a particular node or the entire router, and

  • removes all customer-sensitive data, configurations, and keys from the storage device (SSD) in compliance with National Institute for Standards and Technology (NIST) 800-88 guidelines for media sanitization.

The secure erase feature is ideal for scenarios where the router is to be decommissioned. It is also useful when the data needs to be completely removed for security reasons.

Table 1. Feature history table

Feature Name

Release Information

Feature Description

Secure erase of router SSD data

Introduced in this release on: Centralized Systems (8400 [ASIC: K100])(select variants only*)

*This feature is now supported on the Cisco 8404-SYS-D router.

Secure erase of router SSD data

Release 25.1.1

Introduced in this release on: Fixed Systems (8200 [ASIC: Q200, P100], 8010 [ASIC: A100]); Centralized Systems (8600 [ASIC:Q200]); Modular Systems (8800 [LC ASIC: Q100, Q200, P100])

You can now efficiently and securely manage the data and configuration settings on your routers by ensuring complete removal of sensitive data from the routers that are to be decommissioned, or for security purposes. This feature securely erases the solid state drive (SSD) data on a particular card such as a line card or a route processor, or on the entire router and shuts it down.

The feature introduces these changes:

CLI:

YANG Data Model:

  • Cisco-IOS-XR-secure-erase-act

Benefits of secure erase functionality

The secure erase functionality on Cisco IOS XR routers provides these benefits:

  • Complete data removal from the device for security purposes

  • Suitable for device decommissioning or re-purposing

  • Can be applied to individual nodes or to the entire router

Restriction for secure erase functionality

Secure erase functionality on routers is subjected to a restriction that you cannot initiate it if the entire system is down or if no active RP is booted to IOS XR OS.

Perform secure erase on a router

Before you begin

  • Ensure the active RP is operational to initiate the secure erase process.

  • Ensure that there is no immediate requirement for the router after the secure erase process, since it involves complete data removal and shutdown of the router.

  • Keep a backup of the router data as a precautionary measure.

Procedure

1.

Initiate secure erase process on the router CLI.

Example:

Router#secure-erase location 0/RP1/CPU0
Tue Mar 11 11:17:51.294 UTC
Performing secure erase operation will erase the SSD and shut down the card. Proceed?
[confirm]
2.

Check system logs to confirm that the secure erase process is completed.

Example:


RP/0/RP0/CPU0:Mar 11 11:28:55.862 UTC: shelfmgr[159]: %PLATFORM-CPA_INTF_SHELFMGR-4-CARD_REIMAGE_CFG_DONE : Successfully configured card 0/RP1/CPU0 for reimage operation, boot mode: IPXE_INTERNAL
RP/0/RP0/CPU0:Mar 11 11:31:08.610 UTC: shelfmgr[159]: %PLATFORM-SHELFMGR-4-DISK_ERASE_START : Started disk erase operation on 0/RP1/CPU0
RP/0/RP0/CPU0:Mar 11 11:31:10.455 UTC: shelfmgr[159]: %PLATFORM-SHELFMGR-4-DISK_ERASE_IN_PROGRESS : [bash(1119)] Performing NIST recommended purge sanitization method on /dev/nvme0n1 on 0/RP1/CPU0
RP/0/RP0/CPU0:Mar 11 11:52:12.890 UTC: shelfmgr[159]: %PLATFORM-SHELFMGR-4-DISK_ERASE_DONE : Disk erase operation finished successfully on 0/RP1/CPU0
RP/0/RP0/CPU0:Mar 11 11:52:18.553 UTC: shelfmgr[159]: %PLATFORM-SHELFMGR-6-INFO_LOG : 0/RP1/CPU0 is shutdown