Perform a Self-Service Enhanced Factory Reset

1. Connect a console cable to the firewall's console port and open a terminal session.

   Use console settings: 9600 baud, 8 data bits, no parity, 1 stop bit (9600 8N1).
2. Insert the prepared USB flash drive into one of the firewall's USB ports.
3. Reboot the firewall.

   From the CLI:

   request restart system

   Or power-cycle the firewall using the power switch.
4. When the BIOS POST screen appears, press F11 to enter the boot menu.

   The boot menu prompt appears briefly during POST. Be ready to press F11 as soon as the BIOS screen displays. If you miss the prompt, power-cycle and try again.
5. In the boot menu, select your USB drive as the boot device.

   The USB drive typically appears as a removable device or by its vendor name. Use the arrow keys to highlight it and press Enter to boot.
6. At the GRUB menu, select Palo Alto Networks Enhanced Factory Reset and press Enter.
7. Wait while EFR reads and verifies the PAN-OS images on the USB drive.

   EFR checks the integrity, signatures, and compatibility of each image with your specific firewall model and PAN-OS version. The results are displayed on the console. If all checks pass, EFR prompts you to confirm before the wipe begins.

   If EFR reports an error:

   • Review the error message and correct the issue (for example, wrong platform image or missing base image).
   • Choose Abort or Retry without rebooting — you do not need to power-cycle the firewall to correct image errors.
8. When prompted, confirm that you want to proceed with the factory reset.

   Confirming starts the disk wipe immediately. This action cannot be undone. All data on the system disk will be permanently erased.
9. Monitor the EFR progress on the console.

   EFR displays progress messages as it:

   • Wipes the system disk
   • Formats the log disk
   • Installs the base PAN-OS image
   • Installs the maintenance release image (if present on the USB drive)

   Do not power off the firewall during this process. The reset takes approximately 20–40 minutes depending on your firewall model.
10. When EFR completes and the firewall reboots, remove the USB flash drive before the firewall finishes its first boot into PAN-OS.
11. After the firewall boots, verify the installed PAN-OS version from the console:

    show system info | match version

12. Restore your firewall configuration.

    The firewall boots to a factory-default configuration. Load your saved configuration backup and reapply your HA, cluster, or management settings as required.
13. (Optional) Verify the EFR recovery log on the firewall:

    less panrepo-log usb-efr.log

    The log records the complete EFR process for forensic review. A summary record is also appended to the history log:

    less panrepo-log history.log

    Search for keyword efr_images to locate the EFR entry in the history log.