4

Does anyone know what this is? Can't read it or delete it, both del and erase nvram do not appear to work on it. I am erasing switches and need to confirm that it does not contain sensitive information.

The name of the file is "persistent-data". It is located at "nvram: persistent-data". It appears when running the latest IOS release for the Cisco 2821 as well as IOS XE.

Will edit post to show output and the additional models of switch I have spotted it on soon.

4
  • What Switch type and model are you using? Could you copy paste the result of what you are trying to do? – user36472 Jan 22 '18 at 18:18
  • What is the name of the file? You need to edit the question to give us more information, otherwise we a simply guessing, which is off-topic here. – Ron Maupin Jan 22 '18 at 18:19
  • I see an "erase /all nvram:" exec-mode command on my router. Can you see if it (a) exists on your device, and (b) works ? – mere3ortal Jan 23 '18 at 8:09
  • Did any answer help you? If so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you could provide and accept your own answer. – Ron Maupin Apr 1 '18 at 20:05
1

The router’s NVRAM used to contain the startup configuration file only, but this is no longer strictly the case. Recent IOS releases also use the same NVRAM space to store information such as private keys for SSH or IPSec (private-config), and interface numbers for SNMP (ifIndex-table).

Router1#dir nvram: 
Directory of nvram:/

   20  -rw-        5068              <no date>  startup-config
   21  ----        2302              <no date>  private-config
    1  ----           0              <no date>  persistent-data
    2  -rw-         133              <no date>  ifIndex-table

You cannot delete nor read these two files as they strictly belong to the IOS system on your switch or router. Those files do not contain anything sensitive. It is strictly system information that has no relation to any configuration.

Update: OK so i've been searching all over for this and i found this thread:

https://supportforums.cisco.com/t5/borderless-networks/what-is-quot-persistent-media-ifs-general-error-quot/td-p/2402199

There's an error generating the following message:

%PRST_IFS-3-GENERAL: persistent media IFS general error: Open Read - can't open  nvram:persistent-data errno is 16

Searching for this lead me to believe that the Cisco IOS File System (IFS) saves some persistent date (variables) about the Cisco image in the NVRAM. This data is used upon booting the switch or router.

5
  • I thought interface numbers for SNMP are in the ifIndex-table, no? There doesn't seem to be much information on the 'net about the persistent-data: that plus the fact that there seems to be no way to clear it out (as the OP reports) is a worry. Before you scrap or otherwise dispose of your old gear, you do need a way to make absolutely sure there is no data anywhere on the device. – mere3ortal Jan 23 '18 at 7:41
  • @mere3ortal It's all i could find in my Cisco book, sorry. The only thing that i'm 100% sure of is the fact that those files do not contain anything sensitive. It's strictly system information that has no relation to any configuration. – user36472 Jan 23 '18 at 7:45
  • @mere3ortal you were right about the ifIndex. See my update. – user36472 Jan 23 '18 at 9:25
  • I believe that file holds the self-generated certs. You can delete the certs, but the device will generate them again. – Ron Maupin Jan 23 '18 at 15:06
  • @RonMaupin you might be correct and that is also how i read it in my CCNP books, but then i found several threads saying it's the private-config that holds the certificates. Bit confused. The router output i pasted has the certs generated and the persistent data is 0 bytes.. so might be something with that. – user36472 Jan 23 '18 at 15:39
1

I wipe clients' sensitive information off of switches for a living. The primary types of switches we work on are the Cisco Catalysts, mainly the 4948 series. Model: WS-C4948E. There are different version numbers, and varied model numbers, but for the most part there a minor differences. You can write the list of commands by entering "help" or "?". You can also see how to complete certain commands by writing a command, such as "write", and then add a "?". For example, entering "erase ?" will write out a list of commands to complete the "erase" command. After entering the command+?, any results that you see show "cr"(with < and > on either side) indicates that you can hit enter with the typed command to execute that prompt. The main commands we use for erasing information off of these switches are "write erase" and "erase /all nvram:". You also want to erase any vlan information by issuing the "erase cat4000_flash:" command. As a double check, we write the command "dir /all all", which will list all the files in each file-system. When it comes to the persistent-data located in the nvram:, it is not possible to delete it. The only possible outcome for a sure-fire reset is to format the system, but that results in a total device wipe, erasing everything including boot files. If you went this route, then the only way it can be booted properly is to add the necessary files back on from the Internet. At that point, it is out of our hands. I hope this helps!

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.