We have two old devices: Fortigate 111C and FortiAnalyzer 100B. They are currently offline (as they have been replaced by other models). We are going to try sell them via auction (being a public organization we have such rules). But we need to safely remove our data and yet have it still usable, so it is worth a purchase for someone. I have read about Factory reset command, but i'm not sure it will wipe all the data. Is it only resetting a configuration? Should i still wipe the logs and other stuff somehow? I have also read in the forums about running format on FortiAnalyzer to get rid of logs, but won't it render the device unusable after that?
With personal computers we are just wiping out HDDs securely as installing OS is a trivial task. Probably not so trivial with Fortigate. Or is it possible to completely wipe its memory and then install fresh FortiOS?
Solved! Go to Solution.
Nominating a forum post submits a request to create a new Knowledge Article based on the forum post topic. Please ensure your nomination includes a solution within the reply.
Hi
one hint more.....if you point to low level format you can use based on 5.2 as 5.4 following command:
# execute erase-disk
This will overwrite the disk block 3 X with rubish so that the data available whatever it is "based on normale status" will gone! After that you can stage from scratch the device again over Bios by TFTP formating the boot device and staging by new FortiOS image.
hope this helps
have fun
Andrea
Hi
For FAZ use following:
# execute erase-disk flash <erase-times>
Overwrite the flash (boot device) with random data a specified number of times. When you run this command,
you will be prompted to confirm the request. Executing this command will overwrite all information on the FortiAnalyzer system’s flash drive. The FortiAnalyzer system will no longer be able to boot up.
# execute format <disk | disk-ext3 | disk-ext4> <RAID level> deep-erase <erase-times>
deep-erase --> Overwrite the hard disk with random data. Selecting this option will take
longer than a standard format.
The CLI of FAZ is your friend :) Search for "erase"
hope this helps
have fun
Andrea
Hi
You friend is your CLI Refrence means the Handbook for CLI which can be donwloaded over following link:
http://docs.fortinet.com/fortianalyzer/reference
Look that you get the CLI for your corresponding product meaning version or FortiOS.
hope this helps
have fun
Andrea
Factory Reset will wipe all data. It's reset back to core default setup values and the logs/drive/memory are totally cleaned. I've wiped hundreds, if not thousands of Fortigate devices.
I'd like to get hold of a FortiAnalyzer 'cleaned' by a factoryreset only
You will have to format the log disks of course.
For both FGT and FAZ, the internal flash disk holds configuration data, perhaps revisions, and the firmware. So if you additionally format the boot device as well (via CLI during boot) you'd have to reload a firmware via TFTP to make the device useable for the common eBayer.
So. I have done factory reset on both devices. I don't really want to format them and make unusable (have no desire to reinstall it myself). I wonder what is left after the reset. Is it only logs? I think it probably is not critical if those logs contain who browsed where, etc. But passwords, users and settings should be gone?
Hi
one hint more.....if you point to low level format you can use based on 5.2 as 5.4 following command:
# execute erase-disk
This will overwrite the disk block 3 X with rubish so that the data available whatever it is "based on normale status" will gone! After that you can stage from scratch the device again over Bios by TFTP formating the boot device and staging by new FortiOS image.
hope this helps
have fun
Andrea
When i run this command it shows:
boot
HDD1
Should i only delete HDD1 (which i suppose contains logs, other data)? Boot probably only contains a boot image?
Hi
boot for bootdevice and HDD for atual disk. I would recommend to use HDD. If you reboot after and you install again from scratch a FortiOS use "format boot device" within the bios and after "transfer by TFTP".
hope this helps
have fun
Andrea
What about the FortiAnalyzer? exec erase-disk is not working on it.
Hi
For FAZ use following:
# execute erase-disk flash <erase-times>
Overwrite the flash (boot device) with random data a specified number of times. When you run this command,
you will be prompted to confirm the request. Executing this command will overwrite all information on the FortiAnalyzer system’s flash drive. The FortiAnalyzer system will no longer be able to boot up.
# execute format <disk | disk-ext3 | disk-ext4> <RAID level> deep-erase <erase-times>
deep-erase --> Overwrite the hard disk with random data. Selecting this option will take
longer than a standard format.
The CLI of FAZ is your friend :) Search for "erase"
hope this helps
have fun
Andrea
PCNSE
NSE
StrongSwan
Select Forum Responses to become Knowledge Articles!
Select the “Nominate to Knowledge Base” button to recommend a forum post to become a knowledge article.
User | Count |
---|---|
1633 | |
1063 | |
751 | |
443 | |
210 |
The Fortinet Security Fabric brings together the concepts of convergence and consolidation to provide comprehensive cybersecurity protection for all users, devices, and applications and across all network edges.
Copyright 2024 Fortinet, Inc. All Rights Reserved.