03-22-2024 10:50 AM
Scenario:
When we chose to replace or upgrade the network devices it is also very important to erase the sensitive data from being decoded by a 3rd party.
Secure wipe is one such feature which is introduced from 9010 and above versions which helps you wipe flash memory related contents permanently.
It only erases flash memory and does not erase EEPROM.
During this process except TPM keys, all the files, configurations, licenses, and other keys would be lost.
Difference between factory defaulting and secure wipe procedure used for the ICX switches:
When a switch is factory defaulted, it will restore the switch to its original default settings but does not completely erase the data.
When we factory default the switch, the data can still be recovered if a specialized software is being used by the 3rd party.
Secure wipe is a method were all the data is thoroughly wiped out from the flash memory of the switch.
This process would take about 30 to 40 min to completely wipe out the data from the switch.
Below is how you can wipe the data from the switches completely:
Device#securewipe 7pass
**************************************************************
* SECUREWIPE Alert *
**************************************************************
* Please pay attention to the details listed below *
* 1. U-Boot params will be erased *
* 2. All flash partitions will be erased and loose all files *
* 3. FIPS will be disabled and related keys will be erased *
* 4. License and config files will be erased *
* 5. Only FI image, U-Boot and TPM keys will be restored. *
* 6. All warm memory contents will be erased *
* 7. Device may fail to boot and/or fail to connect cloud if *
* power cycled or power down during secure wipe process *
* 8. Performing secure wipe frequently may reduce the flash *
* life cycle *
**************************************************************
**************************************************************
* I have read the alert and SECUREWIPE can be performed now. *
* Please enter 'y' to confirm, 'n' to exit : *
**************************************************************
(enter 'y' or 'n'): y
Device boot source is :1
Current booted partition: Primary, UFI used for secure wipe: Primary
Prerequisite check success,securewipe is processing....
********************************************
PLEASE WAIT SYSTEM WILL GO FOR RESTART....
********************************************
Process that would occur when you run “securewipe 7pass” command.
Secondary flash partition process may take 10 to 15 min.
Checking for secure wipe feature enable status...
******************************************************************
* 7-Pass Secure Wipe enabled, secure erase will be performed now *
* This may take some time, do NOT power down/cycle the device *
* Device will be rebooted automatically after secure erase *
* Interrupting secure wipe process may cause device to fail boot *
******************************************************************
proccessing securewipe for 7 pass
1+0 records in
1+0 records out
#############################
# SESSION START #
#############################
Uboot manager: Requested for command type 0
Platform type: (ICX8150) RODAN
set_uboot_partition:264 CMD: i2cset -y -f 0 0x33 0xe 0x2 1>/dev/null 2>&1
Secondary partition setting success
Erasing 4 Kibyte @ 3ff000 -- 100 % complete
Erasing 4 Kibyte @ 3ff000 -- 100 % complete
Erasing 4 Kibyte @ 3ff000 -- 100 % complete
Erasing 4 Kibyte @ 3ff000 -- 100 % complete
Erasing 4 Kibyte @ 3ff000 -- 100 % complete
Erasing 4 Kibyte @ 3ff000 -- 100 % complete
Erasing 4 Kibyte @ 3ff000 -- 100 % complete
Erasing 4 Kibyte @ 1f000 -- 100 % complete
Erasing 4 Kibyte @ 1f000 -- 100 % complete
Erasing 4 Kibyte @ 1f000 -- 100 % complete
Erasing 4 Kibyte @ 1f000 -- 100 % complete
Erasing 4 Kibyte @ 1f000 -- 100 % complete
Erasing 4 Kibyte @ 1f000 -- 100 % complete
Erasing 4 Kibyte @ 1f000 -- 100 % complete
#############################
# SESSION START #
#############################
Primary flash partition process may take 10 to 15 min.
#############################
# SESSION START #
#############################
Uboot manager: Requested for command type 0
Platform type: (ICX8150) RODAN
set_uboot_partition:264 CMD: i2cset -y -f 0 0x33 0xe 0x1 1>/dev/null 2>&1
Primary partition setting success
Erasing 4 Kibyte @ 3ff000 -- 100 % complete
Erasing 4 Kibyte @ 3ff000 -- 100 % complete
Erasing 4 Kibyte @ 3ff000 -- 100 % complete
Erasing 4 Kibyte @ 3ff000 -- 100 % complete
Erasing 4 Kibyte @ 3ff000 -- 100 % complete
Erasing 4 Kibyte @ 3ff000 -- 100 % complete
Erasing 4 Kibyte @ 3ff000 -- 100 % complete
Erasing 4 Kibyte @ 1f000 -- 100 % complete
Erasing 4 Kibyte @ 1f000 -- 100 % complete
Erasing 4 Kibyte @ 1f000 -- 100 % complete
Erasing 4 Kibyte @ 1f000 -- 100 % complete
Erasing 4 Kibyte @ 1f000 -- 100 % complete
Erasing 4 Kibyte @ 1f000 -- 100 % complete
Erasing 4 Kibyte @ 1f000 -- 100 % complete
#############################
# SESSION START #
#############################
Boot partition process may take 10 to 15 min.
Allocating group tables: done
Writing inode tables: done
Creating journal (4096 blocks): done
Writing superblocks and filesystem accounting information: done
securewipe started for fastiron partition
mke2fs 1.43.4 (31-Jan-2017)
Discarding device blocks: done
Creating filesystem with 655360 4k blocks and 164160 inodes
Filesystem UUID: 2408ba58-7247-4cf0-ab4d-9e929399849a
Superblock backups stored on blocks:
32768, 98304, 163840, 229376, 294912
Allocating group tables: done
Writing inode tables: done
Creating journal (16384 blocks): done
Writing superblocks and filesystem accounting information: done
securewipe started for boot partition
mke2fs 1.43.4 (31-Jan-2017)
Discarding device blocks: done
Creating filesystem with 131072 4k blocks and 32768 inodes
Filesystem UUID: b3a7ad8e-7514-47c3-8403-f51d8a280153
Superblock backups stored on blocks:
32768, 98304
Allocating group tables: done
Writing inode tables: done
Creating journal (4096 blocks): done
Writing superblocks and filesystem accounting information: done
securewipe started for warm memory
securewipe done for warm memory
securewipe 7 pass completed
EEPROM Write Protect disable success
EEPROM Write success
EEPROM Write Protect enable success
INIT: Sending processes the TERM signal