On the ESS-3300, the Push Button is used exclusively for triggering the Zeroization process which zeroize and erase switch configuration files or entire flash file system depending on the option provided under the CLI service declassify.

The Zeroization process starts as soon as the Push Button is pressed. The CLI command, service declassify, is used to set the desired action in response to the Push Button press. To prevent accidental erasure of the system configuration/image, the default setting is set to no service declassify.

eMMC is a managed NAND. This means that our embedded switch or router system does not interact with the flash memory directly. The flash controller presents a block-style interface to our system, and it handles the flash management (analogous to the Flash Translation Layer). Our embedded switch or router system cannot access the raw flash directly.

The JEDEC standard has commands that are supposed to remove data from the raw flash. In Cisco’s implementation, the “Erase” and “Sanitize” commands are used. The eMMC standard JESD84-B51 defines “Sanitize” as follows:

Note	The Sanitize operation is a feature that is used to remove data from the device according to Secure Removal Type. The use of the Sanitize operation requires the device to physically remove data from the unmapped user address space.

Note	After the sanitize operation is completed, no data should exist in the unmapped host address space.

Important

Zeroization does NOT erase removable media such as SD Card and USB Storage. This media must be removed from the system and erased or destroyed using procedures that are outside the scope of this document.

There are two levels of Zeroization actions, erase-nvram and erase-all. The following CLI shows the options:

Switch(config)#service declassify ?
erase-nvram    Enable erasure of switch configuration as declassification action. Default is no erasure.
erase-all      Enable erasure of both flash and nvram file systems as part of declassification. Default is no erasure

The “erase-nvram” level of declassification process searches for the following files, and erases the ones found.

• flash:/nvram_config

• flash:/vlan.dat

This also erases the complete NVRAM filesystem, therefore, all configurations, including startup and running configurations will get deleted.

The perma-locked bootable image(s) in the flash file system will still be available and can be used for booting the device. See Recovery Procedures

The “erase-all” level of Zeroization process erases the entire flash file system. This also wipes out all files and perma-locked bootable image(s). All interfaces are shut down before this process. Here, erasure of individual files in the flash file system is not possible and the only option is to erase the entire flash file system. This also erases packet data, ASIC data and processors related caches along with scrubbing Main memory.

With any level of Zeroization, the switch always fall back to the ROMMON prompt on the console after the erasure of configuration files or flash file system.

The user needs to press the Push Button after configuring the level of erasure required by the above CLI commands. To make sure that the Push Button press has been identified by underlying software, the user needs to press and hold it for ONE second, or at least till the zero LED starts blinking.