Cisco MDS 9000 Family Secure Erase Configuration Guide

Transcription

1 Cisco MDS 9000 Family Secure Erase Configuration Guide For Cisco MDS 9500 and 9200 Series. Cisco MDS 9000 SAN-OS Release 3.4(1) June 2008 Americas Headquarters Cisco Systems, Inc. 170 West Tasman Drive San Jose, CA USA Tel: NETS (6387) Fax: Text Part Number: OL

2 THE SPECIFICATIONS AND INFORMATION REGARDING THE PRODUCTS IN THIS MANUAL ARE SUBJECT TO CHANGE WITHOUT NOTICE. ALL STATEMENTS, INFORMATION, AND RECOMMENDATIONS IN THIS MANUAL ARE BELIEVED TO BE ACCURATE BUT ARE PRESENTED WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED. USERS MUST TAKE FULL RESPONSIBILITY FOR THEIR APPLICATION OF ANY PRODUCTS. THE SOFTWARE LICENSE AND LIMITED WARRANTY FOR THE ACCOMPANYING PRODUCT ARE SET FORTH IN THE INFORMATION PACKET THAT SHIPPED WITH THE PRODUCT AND ARE INCORPORATED HEREIN BY THIS REFERENCE. IF YOU ARE UNABLE TO LOCATE THE SOFTWARE LICENSE OR LIMITED WARRANTY, CONTACT YOUR CISCO REPRESENTATIVE FOR A COPY. The Cisco implementation of TCP header compression is an adaptation of a program developed by the University of California, Berkeley (UCB) as part of UCB s public domain version of the UNIX operating system. All rights reserved. Copyright 1981, Regents of the University of California. NOTWITHSTANDING ANY OTHER WARRANTY HEREIN, ALL DOCUMENT FILES AND SOFTWARE OF THESE SUPPLIERS ARE PROVIDED AS IS WITH ALL FAULTS. CISCO AND THE ABOVE-NAMED SUPPLIERS DISCLAIM ALL WARRANTIES, EXPRESSED OR IMPLIED, INCLUDING, WITHOUT LIMITATION, THOSE OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OR ARISING FROM A COURSE OF DEALING, USAGE, OR TRADE PRACTICE. IN NO EVENT SHALL CISCO OR ITS SUPPLIERS BE LIABLE FOR ANY INDIRECT, SPECIAL, CONSEQUENTIAL, OR INCIDENTAL DAMAGES, INCLUDING, WITHOUT LIMITATION, LOST PROFITS OR LOSS OR DAMAGE TO DATA ARISING OUT OF THE USE OR INABILITY TO USE THIS MANUAL, EVEN IF CISCO OR ITS SUPPLIERS HAVE BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES. CCDE, CCENT, Cisco Eos, Cisco Lumin, Cisco Nexus, Cisco StadiumVision, the Cisco logo, DCE, and Welcome to the Human Network are trademarks; Changing the Way We Work, Live, Play, and Learn is a service mark; and Access Registrar, Aironet, AsyncOS, Bringing the Meeting To You, Catalyst, CCDA, CCDP, CCIE, CCIP, CCNA, CCNP, CCSP, CCVP, Cisco, the Cisco Certified Internetwork Expert logo, Cisco IOS, Cisco Press, Cisco Systems, Cisco Systems Capital, the Cisco Systems logo, Cisco Unity, Collaboration Without Limitation, EtherFast, EtherSwitch, Event Center, Fast Step, Follow Me Browsing, FormShare, GigaDrive, HomeLink, Internet Quotient, IOS, iphone, iq Expertise, the iq logo, iq Net Readiness Scorecard, iquick Study, IronPort, the IronPort logo, LightStream, Linksys, MediaTone, MeetingPlace, MGX, Networkers, Networking Academy, Network Registrar, PCNow, PIX, PowerPanels, ProConnect, ScriptShare, SenderBase, SMARTnet, Spectrum Expert, StackWise, The Fastest Way to Increase Your Internet Quotient, TransPath, WebEx, and the WebEx logo are registered trademarks of Cisco Systems, Inc. and/or its affiliates in the United States and certain other countries. All other trademarks mentioned in this document or Website are the property of their respective owners. The use of the word partner does not imply a partnership relationship between Cisco and any other company. (0805R) 2008 Cisco Systems, Inc. All rights reserved.

3 CONTENTS Preface v Audience v Organization v Document Conventions vi Related Documentation vii Release Notes vii Compatibility Information vii Regulatory Compliance and Safety Information vii Hardware Installation vii Cisco Fabric Manager vii Command-Line Interface viii Intelligent Storage Networking Services Configuration Guides Troubleshooting and Reference viii Installation and Configuration Notes viii Obtaining Documentation and Submitting a Service Request viii viii CHAPTER 1 About Secure Erase 1-1 Secure Erase Job 1-2 Secure Erase Session 1-2 Concepts and Terminology 1-3 Features and Capabilities 1-4 Requirements and Prerequisites 1-5 Software Requirements 1-5 Hardware Requirements 1-5 Software Licenses 1-5 CHAPTER 2 Configuration Overview 2-1 Configuartion Process 2-1 Obtaining Information 2-2 Setting up Cisco Secure Erase 2-3 Job Configuration 2-4 Recovering Secure Erase Configuration 2-5 iii

4 Contents APPENDIX A A-1 add-session vsan A-2 add-step dynamic A-3 add-step static A-4 add-tgt vsan A-5 add-vi vsan A-6 empty A-8 secure-erase abort job A-9 secure-erase create algorithm A-10 secure-erase create job A-11 secure-erase create-vi vsan A-12 secure-erase destroy algorithm A-13 secure-erase destroy job A-14 secure-erase destroy-vi vsan A-15 secure-erase start job A-16 secure-erase stop job A-17 secure-erase validate job A-18 show secure-erase algorithm A-19 show secure-erase job A-21 show secure-erase job detail A-22 show secure-erase vsan A-23 iv

5 Preface This preface describes the audience, organization, and conventions of the Cisco MDS 9000 Family Secure Erase Configuration Guide. It also provides information on how to obtain related documentation. Audience This guide is intended for experienced network administrators who are responsible for planning, installing, configuring, and maintaining Cisco MDS 9000 Secure Erase. Organization This document is organized as follows: Chapter Title Description Chapter 1 Product Overview Provides an overview of Cisco MDS Secure Erase. Chapter 2 Configuring Secure Erase Describes the installation, provisioning, and configuration tasks. Appendix A Secure Erase CLI Command Reference Syntax and usage guidelines for Cisco MDS Secure Erase CLI commands. v

6 Preface Document Conventions Command descriptions use these conventions: boldface font italic font Commands and keywords are in boldface. Arguments for which you supply values are in italics. [ ] Elements in square brackets are optional. [ x y z ] Optional alternative keywords are grouped in brackets and separated by vertical bars. Screen examples use these conventions: screen font boldface screen font italic screen font Terminal sessions and information the switch displays are in screen font. Information you must enter is in boldface screen font. Arguments for which you supply values are in italic screen font. < > Nonprinting characters, such as passwords, are in angle brackets. [ ] Default responses to system prompts are in square brackets.!, # An exclamation point (!) or a pound sign (#) at the beginning of a line of code indicates a comment line. This document uses the following conventions: Note Means reader take note. Notes contain helpful suggestions or references to material not covered in the manual. Caution Means reader be careful. In this situation, you might do something that could result in equipment damage or loss of data. vi

7 Preface Related Documentation The documentation set for the Cisco MDS 9000 Family includes the following documents. To find a document online, use the Cisco MDS SAN-OS Documentation Locator at: Release Notes Cisco MDS 9000 Family Release Notes for Cisco MDS SAN-OS Releases Cisco MDS 9000 Family Release Notes for Storage Services Interface Images Cisco MDS 9000 Family Release Notes for Cisco MDS 9000 EPLD Images Compatibility Information Cisco MDS 9000 SAN-OS Hardware and Software Compatibility Information Cisco MDS 9000 Family Interoperability Support Matrix Cisco MDS Storage Services Module Interoperability Support Matrix Cisco MDS SAN-OS Release Compatibility Matrix for Storage Service Interface Images Regulatory Compliance and Safety Information Regulatory Compliance and Safety Information for the Cisco MDS 9000 Family Hardware Installation Cisco MDS 9124 Multilayer Fabric Switch Quick Start Guide Cisco MDS 9500 Series Hardware Installation Guide Cisco MDS 9200 Series Hardware Installation Guide Cisco MDS 9100 Series Hardware Installation Guide Cisco Fabric Manager Cisco MDS 9000 Family Fabric Manager Quick Configuration Guide Cisco MDS 9000 Family Fabric Manager Configuration Guide Cisco MDS 9000 Family Fabric Manager Database Schema vii

8 Preface Command-Line Interface Cisco MDS 9000 Family Software Upgrade and Downgrade Guide Cisco MDS 9000 Family Storage Services Module Software Installation and Upgrade Guide Cisco MDS 9000 Family CLI Quick Configuration Guide Cisco MDS 9000 Family CLI Configuration Guide Cisco MDS 9000 Family Command Reference Intelligent Storage Networking Services Configuration Guides Cisco MDS 9000 Family Data Mobility Manager Configuration Guide Cisco MDS 9000 Family Storage Media Encryption Configuration Guide Troubleshooting and Reference Cisco MDS 9000 Family Troubleshooting Guide Cisco MDS 9000 Family MIB Quick Reference Cisco MDS 9000 Family SMI-S Programming Reference Cisco MDS 9000 Family System Messages Reference Installation and Configuration Notes Cisco MDS 9000 Family SSM Configuration Note Cisco MDS 9000 Family Port Analyzer Adapter Installation and Configuration Note Cisco 10-Gigabit X2 Transceiver Module Installation Note Cisco MDS 9000 Family CWDM SFP Installation Note Cisco MDS 9000 Family CWDM Passive Optical System Installation Note Obtaining Documentation and Submitting a Service Request For information on obtaining documentation, submitting a service request, and gathering additional information, see the monthly What s New in Cisco Product Documentation, which also lists all new and revised Cisco technical documentation, at: Subscribe to the What s New in Cisco Product Documentation as a Really Simple Syndication (RSS) feed and set content to be delivered directly to your desktop using a reader application. The RSS feeds are a free service and Cisco currently supports RSS version 2.0. viii

9 CHAPTER 1 Product Overview Cisco Secure Erase is a SAN-based product that erases existing data on a specific Logical Unit Number (LUN) on a storage array. The data erased using Secure Erase cannot be reconstructed. Cisco Secure Erase runs on the Storage Service Module (SSM). The SSM must be installed on the Cisco MDS switch on which you want to run Cisco Secure Erase. This chapter includes the following sections: About Secure Erase, page 1-1 Concepts and Terminology, page 1-3 Features and Capabilities, page 1-4 Requirements and Prerequisites, page 1-5 About Secure Erase Cisco Secure Erase for the Cisco MDS 9500 or 9200 family of switches provides significant advantages over traditional data erase mechanisms. These advantages include platform independence, higher speed, lower cost, and easier deployment. Cisco Secure Erase uses special algorithms to erase data. These algorithms erase data by specifying pattern sequences that are repeatedly written to the target media. This process overcomes the traditional problem of data remanance. Figure 1-1 Cisco Secure Erase Topology Virtual Initiators on SSM FC FC Storage Arrays Cisco MDA 9000 Family Secure Erase Configuration Guide 1-1

10 About Secure Erase Chapter 1 Product Overview The Secure Erase feature runs on the SSM intelligent linecard, which is responsible for managing the data erasing process. This process is executed by virtual initiators (VIs) created on the SSM. The host or servers connected to SAN have no role in the data erasing process. The storage ports can be connected anywhere in the SAN provided they are accessible from the switch where Cisco Secure Erase is running. Secure Erase Job A Secure Erase job contains information about the following: Target Enclosures where Secure Erase functions are performed. A single target enclosure can be made up of multiple ports spanning multiple VSANs. Storage port(s) coming out of the Storage Enclosure. These storage ports can belong to separate VSANs. VIs that will execute Secure Erase operations. Like target ports, a job also contains VIs that are part of different VSANs. Secure Erase sessions. All actions such as start, stop, abort, and validate are performed at the job level. These actions impact all sessions in a job. Secure Erase Session A Secure Erase session is a unit of erase that is defined by the following parameters: Target LUN(s) where Secure Erase needs to be performed. Storage port with which you would access the above mentioned LUN. Secure Erase algorithm to be used for the erase procedure. Virtual Initiator is selected out of the VIs available in the job automatically. The selection is based on a load balancing algorithm. 1-2 Cisco MDA 9000 Family Secure Erase Configuration Guide

11 Chapter 1 Product Overview Concepts and Terminology Concepts and Terminology Cisco Secure Erase uses the following concepts and terminologies: Secure Erase Cisco Secure Erase is a SAN-based feature that erases existing data on a specific target. The data erased through Secure Erase cannot be reconstructed. Secure Erase Job Secure Erase job is an enclosure where multiple target ports and VIs that belong to different VSANs can be added. Secure Erase Session Secure Erase session is a unit of Secure Erase operation that contains the target and algorithms to be used. Secure Erase Algorithm Secure Erase is based on erase algorithms recommended by the United States Department of Defense, the Royal Canadian Police and NIST algorithm recommended by the National Institute of Standards and Technology, agency of US Department of Commerce. Secure Erase algorithms specify a sequence of patterns to be written on physical media with the objective of erasing the data and overcoming the problem of data remanence. SSM An SSM is an MDS switch module that provides intelligent services. The Secure Erase feature is executed on the SSM. VI A VI is a Virtual Initiator residing on the SSM. LUN A Logical Unit Number (LUN) is a unit of storage that you can specify for Secure Erase. The LUN is only a unique number in the content of a storage port. FUA A FUA is a Force Unit Access bit. Secure Erase turns the bit on in all the writes. Cisco MDA 9000 Family Secure Erase Configuration Guide 1-3

12 Features and Capabilities Chapter 1 Product Overview Features and Capabilities Cisco Secure Erase has the following features and capabilities: Configuration Using CLI Secure Erase provides a set of CLI commands. The CLI runs on the supervisor and the requests are directly sent to the Secure Erase process running on the SSM. Support Function Secure Erase supports multiple storage ports and multiple storage arrays. Data Erase Secure Erase supports data erase using different algorithms. Secure Erase Algorithms Secure Erase provides algorithm recommended by the United States Department of Defense, the Royal Canadian Police, and the NIST algorithm recommended by the National Institute of Standards and Technology, an agency of the US Department of Commerce. There is a provision to create and use your own proprietary algorithms. Synchronize Cache Synchronize cache is a SCSI command to request the storage controller to synchronize the data present in the cache to the physical media. This command can specify an LBA range for which the cache needs to be synchronized. Secure Erase executes this command at every step of the algorithm to instruct the storage controller to write each pattern to the physical media before next pattern is written. Please check with the array vendor to find out whether synchronize cache is supported. 1-4 Cisco MDA 9000 Family Secure Erase Configuration Guide

13 Chapter 1 Product Overview Requirements and Prerequisites Requirements and Prerequisites The following prerequisites are required to set up Secure Erase: Software Requirements Cisco Secure Erase has the following software requirements: MDS switches hosting the SSM must be running SAN-OS release 3.3(1a) or later. The Fabric Manager server version must be SAN-OS 3.3(1a) or later. Hardware Requirements Cisco Secure Erase has the following hardware requirements: SSM The following switches support the SSM: All MDS 9200 family switches All MDS 9500 family switches Software Licenses Cisco Secure Erase uses the Storage Services Enabler (SSE) Package for the licensing. The SSE license package is not included with the SSM. Cisco MDA 9000 Family Secure Erase Configuration Guide 1-5

14 Requirements and Prerequisites Chapter 1 Product Overview 1-6 Cisco MDA 9000 Family Secure Erase Configuration Guide

15 CHAPTER 2 Configuring Secure Erase This chapter describes how to configure Cisco MDS Secure Erase, and has the following sections: Configuration Overview, page 2-1 Configuartion Process, page 2-1 Secure Erase is included in the SSI image. For more information on how to install SSM, refer to the Cisco MDS 9000 Family Storage Services Module Software Installation and Upgrade Guide. Configuration Overview Cisco Secure Erase runs on the SSM installed in an MDS 9500 or 9200 series switch. The Secure Erase software package is included in the SSI image, which is delivered as part of SAN-OS. For information on how to install the SSM image, refer to the Cisco MDS 9000 Family Storage Services Module Software Installation and Upgrade Guide. The Secure Erase feature must be provisioned on the SSM. Configuartion Process The following sections provide an overview of a typical Secure Erase process: Obtaining Information, page 2-2 Setting up Cisco Secure Erase, page 2-3 Job Configuration, page 2-4 Recovering Secure Erase Configuration, page

16 Configuartion Process Chapter 2 Configuring Secure Erase Figure 2-1 Secure Erase Workflow Diagram Step 1: Obtain Information Collect information about Storage Enclosures Step 2: Setup Creating Virtual Initiators, Zoning and Storage Array Configuration Step 3: Job Configuration Create Secure Erase Jobs and Sessions Obtaining Information You need to collect the following information about the target enclosure: Information about the target enclosure or storage array on which you would like to perform Secure Erase. The storage array is also called as Secure Erase storage array. Information about WWNs of the target ports you would like to use to access the target enclosure. The target ports are called Secure Erase target ports and the VSANs where the Secure Erase target ports reside are called Secure Erase VSANs. Information about one or more LUNs on the Secure Erase storage array on which you would like to perform Secure Erase. These LUNs are also called as Secure Erase LUNs. 2-2

17 Chapter 2 Configuring Secure Erase Configuartion Process Setting up Cisco Secure Erase You need to create the VIs, setup zone, and storage array configuration to preconfigure Secure Erase. The CLI configuration is preserved across reboots or switch reloads. It is preferred to have one job per storage enclosure. A storage enclosure can have multiple storage ports spanning multiple VSANs and storage LUNs. Step Command Comments Step 1 ssm enable feature se module Provisions the Secure Erase feature on the specific module. module-id Step 2 secure-erase module module-id Creates VIs in a Secure Erase VSAN. create-vi vsan secure-erase Note This command must be performed for each Secure Erase VSAN VSAN. Once created, VIs are available for all Secure Erase jobs. Also, WWNs of the VIs are persistent across reload of switch or SSM. Step 3 show secure-erase module module-id vsan secure-erase VSAN Displays the WWNs of Secure Erase VIs created in the previous step. Additionally, complete the following tasks: Set up the zone. Decide on one or more Secure Erase VIs and zone target ports that you would like to use to perform Secure Erase. Program the storage array. The Secure Erase storage array must be programed to enable Secure Erase VIs to access the Secure Erase LUNs. Secure Erase requires write commands to go directly to the physical media. Secure Erase sends all write commands with Force Unit Access (FUA) bit on. When the bit is set, the SCSI device is instructed to bypass the cache and perform the command directly on the physical media. Note Check with the storage array vendor to confirm that FUA bit is supported in SCSCI writes. Figure 2-2 Interaction of SUP and SSM Secure Erase Command Parser SUPERVISOR Command Response Secure Erase Daemon SSM All Secure Erase CLIs are performed at Supervisor. The Secure Erase configuration is stored in persistent memory on the supervisor engine. 2-3

18 Configuartion Process Chapter 2 Configuring Secure Erase Job Configuration You can configure Cisco Secure Erase jobs and sessions using the CLI. For information about the CLI, refer to the, page A-1. To create a Secure Erase job and session, follow these steps: Step Command Purpose Step 1 Step 2 Step 3 Step 4 Step 5 secure-erase module module-id create job job-id secure-erase module module-id job job-id add-vi vsan secure-erase VSAN all pwwn secure-erase VI pwwn add-tgt vsan secure-erase VSAN pwwn secure-erase target port pwwn secure-erase module module-id job job-id add-session vsan secure-erase VSAN pwwn secure-erase target port pwwn all-lun lun secure-erase LUN algorithm algorithm name/id show secure-erase module module-id job job-id details secure-erase module module-id start job job-id Creates a Secure Erase job. Adds Secure Erase VIs and Secure Erase target ports to a Secure Erase job. Note You can use the CLI commands several times to include all the Secure Erase VIs and Secure Erase target ports in all the Secure Erase VSANs. Creates Secure Erase sessions for each Secure Erase LUN. This command performs these tasks: Creates a login from the Secure Erase VIs to the Secure Erase target ports. Discovers LUNs exposed through Secure Erase target ports. For example, issue TUR, Report LUNs, Inquiry, and Read Capacity. Note The job must have one or more Secure Erase VIs in the Secure Erase VSAN. Displays information about all jobs. Starts the job. The process of writing the pattern sequence dictated by the erase algorithm is specified. To stop or abort a Secure Erase job and session, follow this step: Step 1 secure-erase module module-id stop abort job job-id You have an option to stop or abort the job. The Stop command waits for completion of the current pattern and pauses the pattern sequence. A stopped job can be restarted. Aborting the job does not wait for completion of a current pattern. An aborted job can not be restarted. 2-4

19 Chapter 2 Configuring Secure Erase Configuartion Process Recovering Secure Erase Configuration The SSM and supervisor engine configuration recovery process consists of the following tasks: All Secure Erase configuration is stored in persistent memory and is automatically recovered on a crash or reload of the SSM or a reload of the Cisco MDS supervisors. After the recovery process is complete, the recovered data is validated by performing a discovery process using this command: secure-erase module module-id validate job job-id 2-5

20 Configuartion Process Chapter 2 Configuring Secure Erase 2-6

21 APPENDIXA The Cisco MDS Secure Erase provides CLI commands that support scripting and advanced operations. This appendix contains a list of alphabetically arranged commands that are unique to Cisco MDS Secure Erase. For information about other commands that apply to the Cisco MDS 9000 Family of multilayer directors and fabric switches, refer to the Cisco MDS 9000 Family CLI Configuration Guide. A-1

22 add-session vsan Appendix A add-session vsan To add sessions to a job, use the add-session vsan command in configuration mode. add-session vsan vsan-id pwwn tgt-pwwn all-luns lun lun-id algorithm name/id Syntax Description vsan-id pwwn tgt-pwwn all-luns lun lun-id algorithm name/id Specifies the VSAN ID of the target. Specifies the pwwn of the target. Specifies all of the LUNs in the Secure Erase session. Specifies the LUN ID of the Secure Erase session. Specifies the algorithm that should be used for the session. Defaults Command Modes Configuration Secure Erase job submode Command History Release 3.3(1a) Modification This command was introduced. Usage Guidelines Examples The following example shows how to add a VI to a specific Secure Erase job: switch# config terminal Enter configuration commands, one per line. End with CNTL/Z. switch(config)# secure-erase module 2 job 1 switch(config-se-job)# add-session vsan 1 pwwn 20:04:00:a0:b8:16:92:18 all-luns algorithm RCMP Related Commands Command add-session job Description Adds sessions to the job. A-2

23 Appendix A add-step dynamic add-step dynamic To add a dynamic pattern step to a specific algorithm, use the add-step dynamic command in configuration mode. add-step dynamic [0 1] Syntax Description 0 (Optional) Specifies that the pattern is generated using a random number generator. 1 (Optional) Specifies that the pattern is complimentary to the previous pattern. Defaults Command Modes Configuration Secure Erase algorithm submode Command History Release 3.3(1a) Modification This command was introduced. Usage Guidelines Examples The following example shows how to add a dynamic pattern step to a specific algorithm: switch# config terminal Enter configuration commands, one per line. End with CNTL/Z. switch(config)# secure-erase module 2 algorithm 0 switch(config-se-algo)# switch(config-se-algo)# add-step dynamic 0 Related Commands Command add-step static Description Adds static pattern step to a specific algorithm. A-3

24 add-step static Appendix A add-step static To add a static pattern step to a specific algorithm, use the add-step static command in configuration mode. add-step static pattern Syntax Description pattern Specifies the static pattern step. The pattern is to write ranges from 1 to 512 bytes and can consist of only characters 0 to 9 and A to F. Defaults Command Modes Configuration Secure Erase algorithm submode Command History Release 3.3(1a) Modification This command was introduced. Usage Guidelines Examples The following example shows how to add a static step to a specific algorithm: switch# config terminal Enter configuration commands, one per line. End with CNTL/Z. switch(config)# secure-erase module 2 algorithm 0 switch(config-se-algo)# switch(config-se-algo)# add-step static 1 Related Commands Command add-step dynamic Description Adds a dynamic pattern step to a specific algorithm. A-4

25 Appendix A add-tgt vsan add-tgt vsan To define target enclosure and add multiple target ports for a specific Secure Erase job, use the add-tgt vsan command in configuration mode. add-tgt vsan vsan-id pwwn target port pwwn Syntax Description vsan-id pwwn target port pwwn Specifies the VSAN ID of the target port added to a Secure Erase job. Specifies the port world-wide name (pwwn) of the target port. Defaults Command Modes Configuration Secure Erase job submode Command History Release 3.3(1a) Modification This command was introduced. Usage Guidelines The target ports added to a specific job can be part of a different VSAN. The Secure Erase application creates VIs in a specific VSAN. Note VIs and targets from different VSANs can be added to a job. A storage array may have multiple storage ports belonging to a different VSAN. You can create one job for one storage array. Examples The following example shows how to define a target enclosure and add multiple target ports for a specific Secure Erase job: switch# config terminal Enter configuration commands, one per line. End with CNTL/Z. switch(config)# secure-erase module 2 job 1 switch(config-se-job)# add-tgt vsan 1 pwwn 20:04:00:a0:b8:16:92:18 Related Commands Command Description add-session vsans Adds sessions to a job. add-vi job Adds a VI to a specific Secure Erase job. secure-erase create job Creates a Secure Erase job. A-5

26 add-vi vsan Appendix A add-vi vsan To add a VI to a specific Secure Erase job, use the add-vi vsan command in configuration mode. add-vi vsan vsan-id all pwwn VI pwwn Syntax Description vsan-id all pwwn VI pwwn Specifies the VSAN ID of the target where a VI exists. Adds all the VSAN IDs of the target. Adds a specific VI in a given VSAN to the job. Defaults Command Modes Configuration Secure Erase job submode Command History Release 3.3(1a) Modification This command was introduced. Usage Guidelines You must add at least one VI in each VSAN where a Secure Erase target is present. All VIs that are part of the same job and the VSAN must have same target view. The same set of targets and LUNs must be exposed for all VIs in the same VSAN. Note VI-CPP can not be added to a job. To know the WWN of the VI-CPP, please run the show isapi virtual-nport database command on SSM module. Examples The following example shows how to add all VIs to a given Secure Erase job: switch# config terminal Enter configuration commands, one per line. End with CNTL/Z. switch(config)# secure-erase module 2 job 1 switch(config-se-job)# add-vi vsan 1 all The following example shows how to add a VI to a given Secure Erase job: switch# config terminal Enter configuration commands, one per line. End with CNTL/Z. switch(config)# secure-erase module 2 job 1 switch(config-se-job)# add-vi vsan 1 pwwn 2c:0d:00:05:30:00:43:64 Related Commands Command add-session job Description Adds sessions to the job. A-6

27 Appendix A add-vi vsan Command Description add-vi job Adds a VI to a specific Secure Erase job. secure-erase create job Creates a Secure Erase job. A-7

28 empty Appendix A empty To remove all steps of the user-configured algorithm, use the empty command in configuration mode. empty Syntax Description This command has no arguements or keywords. Defaults Command Modes Configuration Secure Erase algorithm submode Command History Release 3.3(1a) Modification This command was introduced. Usage Guidelines Examples The following example shows how to remove all steps of the user-configured algorithm: switch# config terminal Enter configuration commands, one per line. End with CNTL/Z. switch(config)# secure-erase module 2 algorithm 0 switch(config-se-algo)# switch(config-se-algo)# empty Related Commands Command add-step dynamic add-step static Description Adds a dynamic pattern step to a specific algorithm. Adds static pattern step to a specific algorithm. A-8

29 Appendix A secure-erase abort job secure-erase abort job To abort a Secure Erase job, use the secure-erase abort job command in configuration mode. secure-erase module-id abort job job-id Syntax Description module-id job-id Specifies the desired module number of the SSM on which Secure Erase is provisioned. Specifies the job ID of the target. Defaults Command Modes Configuration mode Command History Release 3.3(1a) Modification This command was introduced. Usage Guidelines This command does not wait for the completion of current patterns. An aborted job cannot be restarted. A job can be aborted only when it has one or more sessions in the running state. Examples The following example shows how to abort a Secure Erase job: switch# config terminal Enter configuration commands, one per line. End with CNTL/Z. switch(config)# secure-erase module 2 abort job 1 Related Commands Command secure-erase start job secure-erase stop job secure-erase validate job Description Restarts all sessions in a job. Stops all sessions in a job. Validates a job in a session. A-9

30 secure-erase create algorithm Appendix A secure-erase create algorithm To configure a Secure Erase algorithm on a specific slot of the intelligent linecard where Secure Erase is provisioned, use the secure-erase module create algorithm command in configuration mode. secure-erase module module-id create algorithm algorithm-id Syntax Description module-id Specifies the desired slot number of the intelligent linecard on which Secure Erase is provisioned. algorithm-id Specifies the algorithm ID. The range is 0 to 9. Defaults Command Modes Configuration mode Command History Release 3.3(1a) Modification This command was introduced. Usage Guidelines Examples The following example shows how to create a Secure Erase algorithm: switch# config terminal Enter configuration commands, one per line. End with CNTL/Z. switch(config)# secure-erase module 2 create algorithm 3 Related Commands Command secure-erase create-vi vsan Description Creates a VI for a specific VSAN. A-10

31 Appendix A secure-erase create job secure-erase create job To create a Secure Erase job, use the secure-erase create job command in configuration mode. secure-erase module module-id create job job-id Syntax Description module module-id job-id Specifies the desired module number of the Storage Services Module (SSM) on which Secure Erase is provisioned. Specifies a unique number to identify a Secure Erase job. The range is 1 to Note You will be prompted to choose a different ID if the job ID chosen already exists. Defaults Command Modes Configuration mode Command History Release 3.3(1a) Modification This command was introduced. Usage Guidelines A Secure Erase job contains the following information: The target enclosure where Secure Erase needs to be performed. Multiple target ports spanning multiple VSANs can be a part of one target enclosure. Multiple target ports, VIs, and Secure Erase sessions can be added. These target ports and VIs can be a part of different VSANs. Examples The following example shows how to create a Secure Erase job: switch# config terminal Enter configuration commands, one per line. End with CNTL/Z. switch(config)# secure-erase module 2 create job 1 Related Commands Command add-tgt job Description Defines a target enclosure and adds multiple target ports for a specific Secure Erase job. A-11

32 secure-erase create-vi vsan Appendix A secure-erase create-vi vsan To create a VI for a specific VSAN, use the secure-erase create-vi vsan command in configuration mode. secure-erase module module-id create-vi vsan vsan-id Syntax Description module module-id vsan-id Specifies the desired slot number of the SSM on which Secure Erase is provisioned. Specifies the VSAN ID of the target port being added. Defaults Command Modes Configuration mode Command History Release 3.3(1a) Modification This command was introduced. Usage Guidelines You do not need to provide the job ID because VIs can be used commonly across jobs. Examples The following example shows how to create VIs for a VSAN: switch# config terminal Enter configuration commands, one per line. End with CNTL/Z. switch(config)# secure-erase module 2 create-vi vsan 1 Related Commands Command create job Description Creates a Secure Erase job. A-12

33 Appendix A secure-erase destroy algorithm secure-erase destroy algorithm To destroy a Secure Erase algorithm, use the secure-erase destroy algorithm command in configuration mode. secure-erase module module-id destroy algorithm algorithm-id Syntax Description module module-id Displays the slot number of the SSM on which Secure Erase is provisioned. algorithm-id Displays the algorithm ID. The range is 0 to 9. Defaults Command Modes Configuration mode Command History Release 3.3(1a) Modification This command was introduced. Usage Guidelines Examples The following example shows how to destroy an algorithm: switch# config terminal Enter configuration commands, one per line. End with CNTL/Z. switch(config)# secure-erase module 2 destroy algorithm 1 Related Commands Command secure-erase destroyvi vsan Description Destroys a Secure Erase VSAN. A-13

34 secure-erase destroy job Appendix A secure-erase destroy job To destroy a Secure Erase job, use the secure-erase destroy job command in configuration mode. secure-erase module-id destroy job job-id Syntax Description module-id job-id Specifies the desired module number of the SSM on which Secure Erase is provisioned. Specifies the job ID of the target. Defaults Command Modes Configuration mode Command History Release 3.3(1a) Modification This command was introduced. Usage Guidelines This command destroys a Secure Erase job. A job can be destroyed only when there are no active sessions running. Examples The following example shows how to validate a Secure Erase job: switch# config terminal Enter configuration commands, one per line. End with CNTL/Z. switch(config)# secure-erase module 2 destroy job 1 Related Commands Command secure-erase start job secure-erase stop job Description Starts all sessions in a job. Stops all sessions in a job. A-14

35 Appendix A secure-erase destroy-vi vsan secure-erase destroy-vi vsan To destroy a VI for a specific VSAN, use the secure-erase destroy-vi vsan command in configuration mode. secure-erase module module-id destroy-vi vsan vsan-id Syntax Description module module-id vsan-id Displays the slot number of the SSM on which Secure Erase is provisioned. Displays the VSAN-ID of the target. Defaults Command Modes Configuration mode Command History Release 3.3(1a) Modification This command was introduced. Usage Guidelines Examples The following example shows how to destroy a VSAN: switch# config terminal Enter configuration commands, one per line. End with CNTL/Z. switch(config)# secure-erase module 2 destroy-vi vsan 1 Related Commands Command secure-erase destroy algorithm Description Destroys a Secure Erase algorithm. A-15

36 secure-erase start job Appendix A secure-erase start job To restart all sessions in a job, use the secure-erase start job command in configuration mode. secure-erase module module-id start job job-id Syntax Description module module-id job-id Specifies the desired module number of the SSM on which Secure Erase is provisioned. Starts a specific job ID of the target. Defaults Command Modes Configuration mode Command History Release 3.3(1a) Modification This command was introduced. Usage Guidelines This command starts all sessions in a job. If the active sessions have reached the maximum limit, the remaining sessions are queued. The queued sessions start when one or more sessions are complete or aborted. A job can be started only when it has one or more sessions in the stopped state or ready state. Examples The following example shows how to start a session in a Secure Erase job: switch# config terminal Enter configuration commands, one per line. End with CNTL/Z. switch(config)# secure-erase module 2 start job 1 Related Commands Command secure-erase stop job Description Stops all sessions in a job. A-16

37 Appendix A secure-erase stop job secure-erase stop job To stop all sessions in a job, use the secure-erase stop job command in configuration mode. secure-erase module-id stop job job-id Syntax Description module-id job-id Specifies the desired module number of the SSM on which Secure Erase is provisioned. Stops the specific job ID of the target. Defaults Command Modes Configuration mode Command History Release 3.3(1a) Modification This command was introduced. Usage Guidelines This command waits for the completion of the current pattern and pauses the pattern sequence. A stopped job can be restarted. A job can be stopped only when it has one or more sessions in the running state. Examples The following example shows how to stop a session in a Secure Erase job: switch# config terminal Enter configuration commands, one per line. End with CNTL/Z. switch(config)# secure-erase module 2 stop job 1 Related Commands Command secure-erase start job Description Restarts all sessions in a job. A-17

38 secure-erase validate job Appendix A secure-erase validate job To validate a Secure Erase job, use the secure-erase validate job command in configuration mode. secure-erase module-id validate job job-id Syntax Description module-id job-id Specifies the desired module number of the SSM on which Secure Erase is provisioned. Specifies the job ID of the target. Defaults Command Modes Configuration mode Command History Release 3.3(1a) Modification This command was introduced. Usage Guidelines None Examples The following example shows how to validate a Secure Erase job: switch# config terminal Enter configuration commands, one per line. End with CNTL/Z. switch(config)# secure-erase module 2 validate job 1 Related Commands Command secure-erase abort job secure-erase start job secure-erase stop job Description Aborts a job in a session. Restarts all sessions in a job. Stops all sessions in a job. A-18

39 Appendix A show secure-erase algorithm show secure-erase algorithm To display the list of all Secure Erase algorithms, use the show secure-erase algorithm command. show secure-erase module module-id algorithm algorithm name Syntax Description module module-id algorithm name Displays the slot number of the SSM on which Secure Erase is provisioned. Displays the algorithm name. Defaults Command Modes Exec mode Command History Release 3.3(1a) Modification This command was introduced. Usage Guidelines Examples The following example displays the list of Secure Erase algorithms: switch# show secure-erase module 4 algorithm name 1 switch# Algorithm : 1 Step 0: faa8bd6c1e838b6b9b0818f30d48f5eecc7e7f572d9d8ac50a9a78b73bf128eb7a71ff40a7c07f55dda1d31f87 5bca26b170d6b3c e06d6229f6a5dedeaa0583f0d1ebe28fca8a7cac936d6f0a453af4174fbbcba29f711047cb48e984a3c a628bc6e662bd3d28237d09 1f68a8df05f50effc55390a12ee2c6 Step 1: e17c749464f7e70cf2b70a a8d262753af c40ed714858e00bf583f80aa225e2ce078 a435d94e8f294c3f8ca aa1f929dd6095a212155fa7c0f2e141d c9290f5bac50be8b044345d608eefb834b7167b5c3f68ae 6ec759d d42c2d7dc82f6 e fa0af1003aac6f5ed11d39 Step 2: The following example displays all available Secure Erase algorithms on a module: switch# show secure-erase module 4 algorithm A-19

40 show secure-erase algorithm Appendix A Related Commands Command Description show secure-erase job Displays the contents of a particular Secure Erase job. A-20

41 Appendix A show secure-erase job show secure-erase job To display the contents of a particular job, use the show secure-erase job command. show secure-erase module module-id job job-id Syntax Description module module-id job-id Displays the slot number of the SSM on which Secure Erase is provisioned. Displays the unique number to identify a Secure Erase job. Defaults Command Modes Exec mode Command History Release 3.3(1a) Modification This command was introduced. Usage Guidelines Examples The following example displays the contents of a particular Secure Erase job: switch# show secure-erase module 4 job 2 The following example displays the contents of all Secure Erase jobs configured on a module: switch# show secure-erase module 16 job Related Commands Command show secure-erase algorithm Description Displays the list of Secure Erase algorithms. A-21

42 show secure-erase job detail Appendix A show secure-erase job detail To display the contents of a particular job in detail, use the show secure-erase job detail command. show secure-erase module module-id job job-id detail Syntax Description module module-id job-id Displays the slot number of the SSM on which Secure Erase is provisioned. Displays the unique number to identify a Secure Erase job. Defaults Command Modes Exec mode Command History Release 3.3(1a) Modification This command was introduced. Usage Guidelines Examples The following example displays the contents of a Secure Erase job in a brief form: switch# show secure-erase module 4 job 2 detail Related Commands Command show secure-erase job Description Displays the contents of a Secure Erase job. A-22

43 Appendix A show secure-erase vsan show secure-erase vsan To display a list of all VIs in the VSAN, use the show secure-erase vsan command. show secure-erase module module-id vsan vsan-id Syntax Description module module-id vsan-id Displays the slot number of the SSM on which Secure Erase is provisioned. Displays the VSAN ID of the target. Defaults Command Modes Exec mode Command History Release 3.3(1a) Modification This command was introduced. Usage Guidelines Examples The following example displays the list of all VIs in the VSAN: switch# show secure-erase module 4 vsan 1 Related Commands Command show secure-erase algorithm show secure-erase job Description Displays the list of Secure Erase algorithms. Displays the contents of a particular Secure Erase job. A-23

44 show secure-erase vsan Appendix A A-24

45 INDEX A Algorithm about 1-3 data erase 1-4 recommended 1-4 C Cache Synchronization 1-4 Configuration commands 1-4 overview 2-1 process 2-1 job configuration 2-4 obtaining information 2-2 recovering configuration 2-5 set up 2-3 storage array, program 2-3 VI,creating 2-3 Zones, set up 2-3 J Job 2-4 about 1-2, 1-3 L LUN 1-3 O Overview 1-1 R Requirements hardware 1-5 Licenses, Software 1-5 software 1-5 S D Data Erase 1-4 documentation additional publications related documents i-vii F FUA 1-3 i-vii SCSI command 1-4 Session about 1-2, 1-3 SSM 1-3 V VI 1-3 creating 2-3 IN-1

46 Index IN-2