Factory Reset

This chapter describes Factory Reset feature and how it can be used to protect or restore a router to an earlier, fully functional state.

Feature Information for Factory Reset

The following table provides release information about the feature or features described in this module. This table lists only the software release that introduced support for a given feature in a given software release train. Unless noted otherwise, subsequent releases of that software release train also support that feature.

Use Cisco Feature Navigator to find information about platform support and Cisco software image support. To access Cisco Feature Navigator, go to https://cfnng.cisco.com/. An account on Cisco.com is not required.
Table 1. Feature Information for Factory Reset

Feature Name

Releases

Feature Information

Factory Reset

Cisco IOS XE Everest 16.6.1

This feature was introduced.

Secure Factory Reset with 3-pass or 7-pass

Cisco IOS XE Amsterdam 17.2.1

Added the factory-reset all secure {3-pass | 7-pass} command.

Option to retain RUM reports, SLR, and HSEC key using the factory-reset keep-licensing-info command

Cisco IOS XE Bengaluru 17.5.1

This feature was introduced.

Secure Factory Reset

Cisco IOS XE Dublin 17.12.1a

Added the factory-reset all secure command.

Information About Factory Reset

Factory reset is a process of clearing the current running and startup configuration information on a router, and resetting the router to an earlier, fully functional state.

From Cisco IOS XE Amsterdam XE 17.2 and later, you can use the factory-reset all secure {3-pass | 7-pass} command to clear the data in bootflash and ROMMON.

From Cisco IOS XE 17.12.1a, you can use the factory-reset all secure command to securely clear all the data in bootflash, hard disk, and ROMMON.


Note

After the factory reset process is complete, the router reboots to ROMMON mode. If you have the zero-touch provisioning (ZTP) capability setup, after the router completes the factory reset procedure, the router reboots with ZTP configuration.

Table 2. Memory Components in ISR 4000 Series Routers

Component

Type

Sanitization

DRAM

Volatile

No sanitization required.

ROMMON

Non-Volatile

A factory reset using the factory-reset all command is the most common method used to erase customer data from the router’s memory resources. The factory-reset all secure command (Cisco IOS XE 17.12.1a and later) can also be used to clear the data held in ROMMON in the same manner as the factory-reset all command.

Bootflash

Non-Volatile

A factory reset using the factory-reset all command is the most common method used to erase customer data from the router’s memory resources. If additional flash memory is installed, the factory-reset all command will not erase the onboard flash memory. The factory-reset all secure command (Cisco IOS XE 17.12.1a and later) erases both the onboard and additional bootflash.

Harddisk

Non-Volatile

The factory-reset all secure command (Cisco IOS XE 17.12.1a and later) erases customer data from the hard disk.

Prerequisites for Performing Factory Reset

  • Ensure that all the software images, configurations and personal data are backed up before performing factory reset.

  • Ensure that there is uninterrupted power supply when factory reset is in progress.

  • The factory reset process takes a backup of the boot image if the system is booted from an image stored locally (bootflash or hard disk). Ensure that you take a backup of the image before performing factory reset.

  • The factory-reset all secure command clearly erases all files, including the boot image.

Restrictions for Performing a Factory Reset

  • Any software patches that are installed on the router are not restored after the factory reset operation.

  • If the factory reset command is issued through a Virtual Teletype (VTY) session, the session is not restored after the completion of the factory reset process.

  • The factory-reset all secure command is supported only in the console, and not through a VTY session.

When to Perform Factory Reset

  • Return Material Authorization (RMA): If a router is returned back to Cisco for RMA, it is important that all sensitive information is removed.

  • Router is compromised: If the router data is compromised due to a malicious attack, the router must be reset to factory configuration and then reconfigured once again for further use.

  • Repurposing: The router needs to be moved to a new topology or market from the existing site to a different site.

How to Perform a Factory Reset

Procedure

Step 1

Log in to a Cisco 4000 Series ISR.

Important

 

If the current boot image is a remote image or is stored in a USB or a NIM-SSD, ensure that you take a backup of the image before starting the factory reset process.

Step 2

This step is divided into three parts - a, b and c. If you need to retain the licensing information while performing the factory-reset command, follow step 2. a. If you do not need to retain licensing information and want all the data to be erased, perform step 2. b. If you do not need to retain licensing information and want all the data to be erased securely, perform step 2. c.

  1. Execute factory-reset keep-licensing-info command to retain the licensing data.

    The system displays the following message when you use the factory-reset keep-licensing-info command: 

    Router# factory-reset keep-licensing-info

The factory reset operation is irreversible for Keeping license usage. Are you sure? [confirm]
This operation may take 20 minutes or more. Please do not power cycle.

Dec 1 20:58:38.205: %PMAN-5-EXITACTION: R0/0: pvp: Process manager is exiting: process exit with
reload chassis code
/bootflash failed to mount
Dec 01 20:59:44.264: Factory reset operation completed.
Initializing Hardware ...

Current image running: Boot ROM1

Last reset cause: LocalSoft

ISR4331/K9 platform with 4194304 Kbytes of main memory
rommon 1

  2. Execute the factory-reset all command to erase all data.

    The system displays the following message when you use the factory-reset all command: 

    Router#factory-reset all

The factory reset operation is irreversible for all operations. Are you sure? [confirm]

This operation may take 20 minutes or more. Please do not power cycle.

*Jun 26 08:21:58.750: %SYS-5-RELOAD: Reload requested by Exec. Reload Reason: Factory Reset.
Jun 26 08:22:18.168: %PMAN-5-EXITACTION: R0/0: pvp: Process manager is exiting: process exit with reload chassis code

  3. Execute one of the following commands: factory-reset all secure command, factory-reset all secure 3-pass command, or factory-reset all secure 7-pass command.

    The system displays the following message when you use the factory-reset all secure command: 

    Router# factory-reset all secure
The factory reset operation is irreversible for securely reset all. Are you sure? [confirm]

This operation may take hours. Please do not power cycle.

*Feb 13 02:36:11.574: %SYS-5-RELOAD: Reload requested by Exec. Reload Reason: Factory Reset.Feb 13 02:36:19.379: %PMAN-5-EXITACTION: R0/0: pvp: Process manager is exiting: process exit with reload chassis code

Enabling factory reset for this reload cycle

Feb 13 02:36:28.944: NIST 800 88r1 compliant factory reset starts.
Feb 13 02:36:29.027: #CISCO DATA SANITIZATION REPORT:# ISR4321/K9
Feb 13 02:36:29.112: start to purge non-volatile storage.
Executing Data Sanitization...
!!! Please, wait - mount bootflash !!!
!!! Please, wait - lsblk grep bootflash !!!
!!! Please, wait - umount bootflash !!!
bootflash:sdb, type:eusb-emmc found
!!! Please, wait - check spare flash info !!!
spare bootflash:sdc, type:eusb-emmc found
!!! Please, wait - lsblk -ln /dev/harddisk !!!
harddisk:sda, type:ssd found
eUSB-eMMC Data Sanitization started ...
!!! Please, wait - Reading eUSB-eMMC Info !!!
!!! Please, wait - Inquiring Unit Ready !!!
!!! Please, wait - Reading EXT_CSD !!!
!!! Please, wait - Reading EXT_CSD !!!
!!! Please, wait - Inquiring Unit Ready !!!
!!! Please, wait - Erasing(Secure-Trim1) /dev/sdb !!!
      Start Secure Trim1 (CMD38) and Wait for a Maximum 0f 120 Seconds for Good Completion
!!! Please, wait - Erasing(Secure-Trim1) /dev/sdb !!!
      Start Secure Trim1 (CMD38) and Wait for a Maximum 0f 120 Seconds for Good Completion
!!! Please, wait - Erasing(Secure-Trim1) /dev/sdb !!!
      Start Secure Trim1 (CMD38) and Wait for a Maximum 0f 120 Seconds for Good Completion
!!! Please, wait - Erasing(Secure-Trim1) /dev/sdb !!!
      Start Secure Trim1 (CMD38) and Wait for a Maximum 0f 120 Seconds for Good Completion
!!! Please, wait - Erasing(Secure-Trim2) /dev/sdb !!!
      Start Secure Trim2 (CMD38) and Wait for a Maximum 0f 120 Seconds for Good Completion
!!! Please, wait - Erasing(Secure-Trim2) /dev/sdb !!!
      Start Secure Trim2 (CMD38) and Wait for a Maximum 0f 120 Seconds for Good Completion
!!! Please, wait - Erasing(Secure-Trim2) /dev/sdb !!!
      Start Secure Trim2 (CMD38) and Wait for a Maximum 0f 120 Seconds for Good Completion
!!! Please, wait - Erasing(Secure-Trim2) /dev/sdb !!!
      Start Secure Trim2 (CMD38) and Wait for a Maximum 0f 120 Seconds for Good Completion
!!! Please, wait - Sanitizing /dev/sdb !!!
!!! Please, wait - Validating Erase for /dev/sdb !!!
eUSB-EMMC Data Sanitization completed ...
eUSB-eMMC Data Sanitization started ...
!!! Please, wait - Reading eUSB-eMMC Info !!!
!!! Please, wait - Inquiring Unit Ready !!!
!!! Please, wait - Reading EXT_CSD !!!
!!! Please, wait - Reading EXT_CSD !!!
!!! Please, wait - Inquiring Unit Ready !!!
!!! Please, wait - Erasing(Secure) /dev/sdc !!!
      Start Secure Erase (CMD38) and Wait for a Maximum 0f 120 Seconds for Good Completion
!!! Please, wait - Erasing(Secure) /dev/sdc !!!
      Start Secure Erase (CMD38) and Wait for a Maximum 0f 120 Seconds for Good Completion
!!! Please, wait - Sanitizing /dev/sdc !!!
!!! Please, wait - Validating Erase for /dev/sdc !!!
eUSB-EMMC Data Sanitization completed ...
SSD Data Sanitization started ...
!!! Please, wait - Reading SSD Info !!!
!!! Please, wait - Reading SSD Info !!!
return code = 2
---
!!! Please, wait - Checking Sanitize Support-2 !!!
return code = 22
---
!!! Please, wait - Checking Sanitize Support-1 !!!
!!! Please, wait - Checking Enh Secure Support !!!
!!! Please, wait - Check SSD Frozen !!!
!!! Please, wait - Check SSD Frozen !!!

!!! Please, wait - Shredding !!!
SSD Data Sanitization completed ...
Data Sanitization Success! Exiting...
Feb 13 04:07:33.171: purge non-volatile storage done.
========================
#CISCO ISR4000 DATA SANITIZATION REPORT#
START : 13-02-2023, 02:36:32
  END : 13-02-2023, 04:07:30
-eUSB-eMMC-
MID : SMART(Hynix)
PNM : eUSB(JHBG4a2)
PRV : 2.11
Status : SUCCESS
NIST : PURGE
-eUSB-eMMC-
MID : CISCO(Hynix)
PNM : eMMC(JHAG2eeot)
PRV : 2.11
Status : SUCCESS
NIST : PURGE
-SSD-
MNM : SH9MST6D200GLE32C
SN : STP23340X9T
Status : SUCCESS
NIST : CLEAR
========================
Feb 13 04:07:33.746: start to check bootflash.
Feb 13 04:15:03.292: bootflash check done.
Feb 13 04:15:03.349: start to cleanup ROMMON variables.
Feb 13 04:15:07.629: ROMMON cleanup variables done.
Feb 13 04:15:07.699: start to cleanup ACT2/AIKIDO chip
Feb 13 04:15:10.879: ACT2/AIKIDO cleanup done.
Feb 13 04:15:10.953: report size:527
Feb 13 04:15:13.474: report save done.
Feb 13 04:15:13.525: Factory reset operation completed.

    The system displays the following message when you use the factory-reset all secure 3-pass command: 

    Router# factory-reset all secure 3-pass

The factory reset operation is irreversible for securely reset all. Are you sure? [confirm]

This operation may take hours. Please do not power cycle.

*Jun 26 09:00:10.463: %SYS-5-RELOAD: Reload requested by Exec. Reload Reason: Factory Reset.Jun 26 09:00:19.461: %PMAN-5-EXITACTION: R0/0: pvp: Process manager is exiting: process exit with reload chassis code
Enabling factory reset for this reload cycle

Jun 26 09:00:28.813: Factory reset secure operation. Write 0s. Please do not power cycle.
3812622336 bytes (3.8 GB, 3.6 GiB) copied, 132 s, 28.9 MB/s
dd: error writing '/dev/bootflash': No space left on device
913+0 records in
912+0 records out
3825205248 bytes (3.8 GB, 3.6 GiB) copied, 132.47 s, 28.9 MB/s
Jun 26 09:02:58.458: Factory reset secure operation. Write 1s. Please do not power cycle.
3821010944 bytes (3.8 GB, 3.6 GiB) copied, 145 s, 26.3 MB/s
dd: error writing '/dev/bootflash': No space left on device
913+0 records in
912+0 records out
3825205248 bytes (3.8 GB, 3.6 GiB) copied, 145.281 s, 26.3 MB/s
Jun 26 09:05:41.000: Factory reset secure operation. Write random. Please do not power cycle.
3825205248 bytes (3.8 GB, 3.6 GiB) copied, 164 s, 23.3 MB/s
dd: error writing '/dev/bootflash': No space left on device
913+0 records in
912+0 records out
3825205248 bytes (3.8 GB, 3.6 GiB) copied, 164.079 s, 23.3 MB/s
Jun 26 09:08:42.913: Factory reset operation completed.

    The system displays the following message when you use the factory-reset all secure 7-pass command: 

    Router# factory-reset all secure 7-pass

The factory reset operation is irreversible for securely reset all. Are you sure? [confirm]
    
This operation may take hours. Please do not power cycle.

*Jun 26 10:01:53.942: %SYS-5-RELOAD: Reload requested by Exec. Reload Reason: Factory Reset.Jun

Enabling factory reset for this reload cycle

Enabling
Jun 26 10:03:42.826: Factory reset secure operation. Write 0s. Please do not power cycle.
3816816640 bytes (3.8 GB, 3.6 GiB) copied, 137 s, 27.9 MB/s
dd: error writing '/dev/bootflash': No space left on device
913+0 records in
912+0 records out
3825205248 bytes (3.8 GB, 3.6 GiB) copied, 137.333 s, 27.9 MB/s
Jun 26 10:06:17.336: Factory reset secure operation. Write 1s. Please do not power cycle.
3804233728 bytes (3.8 GB, 3.5 GiB) copied, 142 s, 26.8 MB/s
dd: error writing '/dev/bootflash': No space left on device
913+0 records in
912+0 records out
3825205248 bytes (3.8 GB, 3.6 GiB) copied, 142.887 s, 26.8 MB/s
Jun 26 10:08:57.461: Factory reset secure operation. Write random. Please do not power cycle.
3816816640 bytes (3.8 GB, 3.6 GiB) copied, 163 s, 23.4 MB/s
dd: error writing '/dev/bootflash': No space left on device
913+0 records in
912+0 records out
3825205248 bytes (3.8 GB, 3.6 GiB) copied, 163.532 s, 23.4 MB/s
Jun 26 10:11:58.844: Factory reset secure operation. Write random. Please do not power cycle.
3825205248 bytes (3.8 GB, 3.6 GiB) copied, 164 s, 23.3 MB/s
dd: error writing '/dev/bootflash': No space left on device
913+0 records in
912+0 records out
3825205248 bytes (3.8 GB, 3.6 GiB) copied, 164.145 s, 23.3 MB/s
Jun 26 10:15:00.804: Factory reset secure operation. Write 0s. Please do not power cycle.
3808428032 bytes (3.8 GB, 3.5 GiB) copied, 131 s, 29.1 MB/s
dd: error writing '/dev/bootflash': No space left on device
913+0 records in
912+0 records out
3825205248 bytes (3.8 GB, 3.6 GiB) copied, 131.586 s, 29.1 MB/s
Jun 26 10:17:29.774: Factory reset secure operation. Write 1s. Please do not power cycle.
3825205248 bytes (3.8 GB, 3.6 GiB) copied, 145 s, 26.4 MB/s
dd: error writing '/dev/bootflash': No space left on device
913+0 records in
912+0 records out
3825205248 bytes (3.8 GB, 3.6 GiB) copied, 145.048 s, 26.4 MB/s
Jun 26 10:20:12.169: Factory reset secure operation. Write random. Please do not power cycle.
3825205248 bytes (3.8 GB, 3.6 GiB) copied, 164 s, 23.3 MB/s
dd: error writing '/dev/bootflash': No space left on device
913+0 records in
912+0 records out
3825205248 bytes (3.8 GB, 3.6 GiB) copied, 164.111 s, 23.3 MB/s
Jun 26 10:23:14.166: Factory reset operation completed.

Step 3

Enter confirm to proceed with the factory reset.

Note

 

  • If you want to quit the factory reset process, press the Escape key.

  • The duration of the factory reset process depends on the storage size of the router. It can extend between 30 minutes and up to 3 hours on a high availability setup. If you want to quit the factory reset process, press the Escape key.

What Happens after a Factory Reset

After the factory reset is successfully completed, the router boots up. However, before the factory reset process started, if the configuration register was set to manually boot from ROMMON, the router stops at ROMMON.

After you configure Smart Licensing, execute the #show license status command, to check whether Smart Licensing is enabled for your instance.


Note

If you had Specific License Reservation enabled before you performed the factory reset, use the same license and enter the same license key that you received from the smart agent.