Hello All,
I am decommissioning a pair of LTM running 9.4.8. I need to remove them from the datacenter but the business is concerned that there might be PCI data on it. Credit cards were processed over the traffic that transversed these LTMs. I let them know that the LTM would not store data that is going over it’s wires but they want to be sure and want some kind of documentation confirming this. I ran several searches but can not find such documentation. Can anyone point me to information that could alleviate their PCI concerns?
Additional note: Web acceleration is not running on these. Would there be anything else I would look for that might cache traffic?
Thanks!
The only thing I can find regarding LTM and storage of PCI information is this whitepaper White Papers | F5 It doesn’t specifically state that an LTM doesn’t store PCI information.
I don’t think you will find anything on AskF5. Since the F5 is a full proxy, we would not store data on the hard drive. If you want to insure no data remains on the box, you can use wipedisk to zero the drive. This solution will give you the steps:
SOL6346: Recovering from a corrupt drive partition (9.x - 10.x) 404 Page not found | BIG-IP Documentation
F5 has another procedure to completely wipe a drive prior to RMA. Since the steps hardware dependent, open a case and refer to the procedure, “Securely erasing compact flash and hard disk drives on BIG-IP platforms”