>
    Strata Copilot
    Prepare a USB Drive for Enhanced Factory Reset
    Focus
    Download PDF
    Focus
    1. Home
    2. Next-Generation Firewall
    3. Firewall Administration
    4. Self-Service Enhanced Factory Reset (EFR)
    5. Prepare a USB Drive for Enhanced Factory Reset
    Download PDF
    Next-Generation Firewall

    Prepare a USB Drive for Enhanced Factory Reset

    Table of Contents

    Prepare a USB Drive for Enhanced Factory Reset

    Prepare a bootable USB flash drive with the EFR image and PAN-OS images required for a self-service Enhanced Factory Reset.
    Where Can I Use This?What Do I Need?
    • Supported NGFWs (see list of supported platforms)
    • PAN-OS 12.2.2 and PAN-OS 12.1.11 or later
    • USB flash drive (16 GB minimum)
    • A Windows, Linux, or macOS computer with a USB port
    • EFR image and PAN-OS images downloaded from the Customer Support Portal
    Before performing a self-service Enhanced Factory Reset (EFR), you must prepare a bootable USB flash drive that contains the EFR image for your firewall platform family and the PAN-OS images you want to reinstall.
    When preparing the USB drive, follow these rules for the PAN-OS images you place in the IMAGES folder:
    • The USB drive can contain a maximum of two PAN-OS images: one base image and one maintenance release (MR) image.
    • A base image is required. An MR image is optional but if included, the corresponding base image must also be present.
    • The base image and MR image must be from the same release train (same major.minor version). For example, PAN-OS 12.2.2 and PAN-OS 12.2.5 for the same model are compatible, but PAN-OS 12.1.2 and PAN-OS 12.2.2 are not.
    • Both images must match the platform family of the firewall being recovered.
    • EFR cannot be used to upgrade to a new major.minor release. For example, if the firewall is running 12.2.x, you can only reinstall 12.2.x images.
    Before you begin:
    • Save all firewall configuration, HA state, and cluster configurations before the EFR process. The EFR wipes the system disk completely. You must manually reapply your configuration after the firewall restores.
    • Identify your firewall's platform family and the PAN-OS version currently running on the device (review 
      show system info
      or Dashboard > General Information).
    1. Download the EFR image from the Customer Support Portal.
      1. Go to support.paloaltonetworks.com and sign in.
      2. Select UpdatesSoftware Updates.
      3. For Content Type, choose PAN-OS Enhanced Factory Reset (EFR).
      4. Download the EFR image that matches your firewall platform family (for example, PanOS_1400-EFR-1.0.0.img.gz for PA-1400 Series firewalls).
    2. Download the PAN-OS images from the Customer Support Portal.
      1. Select UpdatesSoftware Updates.
      2. For Content Type, choose PAN-OS for the PA-<platform> platform.
      3. Download the base image for your firewall platform and the PAN-OS version you want to restore (for example, PanOS_1400-12.2.2). If you also want to install a maintenance release, download the corresponding MR image (for example, PanOS_1400-12.2.5).
      4. Verify the SHA-256 checksum of each downloaded image against the checksum displayed on the Customer Support Portal.
        EFR cannot be used to upgrade to a new major.minor release. The PAN-OS images you download must be from the same release train as the version currently running on the firewall.
    3. Write the EFR image to the USB drive using the instructions for your operating system.

      Linux

      Write the EFR image to a USB flash drive using a Linux computer.
      1. Open a terminal and create a staging directory:
        mkdir ~/USBEFR_STAGING
cd ~/USBEFR_STAGING
      2. Copy the downloaded EFR image to the staging directory.
      3. Verify the SHA-256 checksum of the EFR image:
        sha256sum <EFR_IMAGE_FILE.img.gz>
        Compare the output against the checksum from the Customer Support Portal.
      4. Extract the compressed EFR image:
        gunzip <EFR_IMAGE_FILE.img.gz>
        This produces an uncompressed file: <EFR_IMAGE_FILE.img> (approximately 8 GB).
      5. Connect the USB flash drive to your Linux computer.
      6. Identify the USB drive device path:
        lsblk -S -o NAME,TYPE,VENDOR,MODEL,SIZE,TRAN
        Identify your USB drive by its size and note the device name (for example, /dev/sda).
      7. Unmount any partitions on the USB drive that are automatically mounted:
        sudo umount /dev/sdX*
        Replace sdX with your device name.
      8. Write the EFR image to the USB drive:
        The dd command will overwrite all data on the target USB drive. Double-check the device identifier before running the command. Targeting the wrong device can permanently overwrite your file system.
        sudo dd if=<EFR_IMAGE_FILE.img> of=/dev/sdX bs=4M status=progress conv=fdatasync
        Replace sdX with your device name. The operation completes when dd displays a summary of records transferred.
      9. Verify the USB drive file structure by mounting it and listing its contents:
        sudo mkdir -p /mnt/usbefr
sudo mount -L USBEFR /mnt/usbefr
ls -R /mnt/usbefr
        The USB drive should contain the following directory structure:
        EFI/
  BOOT/
    BOOTX64.EFI
    grubx64.efi
  centos/
    SHIMX64.EFI
    grubx64.efi
  fonts/
    unicode.pf2
boot/
  resusys.vmlinuz
  resusys.cpio
  resusys.cpio.sig
IMAGES/
  README

      macOS

      Write the EFR image to a USB flash drive using a macOS computer.
      1. Open Terminal and create a staging directory:
        mkdir ~/USBEFR_STAGING
cd ~/USBEFR_STAGING
      2. Copy the downloaded EFR image to the staging directory.
      3. Verify the SHA-256 checksum of the EFR image:
        shasum -a 256 <EFR_IMAGE_FILE.img.gz>
        Compare the output against the checksum from the Customer Support Portal.
      4. Extract the compressed EFR image:
        gunzip <EFR_IMAGE_FILE.img.gz>
        This produces an uncompressed file: <EFR_IMAGE_FILE.img> (approximately 8 GB).
      5. Connect the USB flash drive to your Mac.
      6. Identify the USB drive device identifier:
        diskutil list
        Identify your USB drive by its size and note the disk identifier (for example, /dev/disk4).
      7. Unmount all partitions on the USB drive:
        diskutil unmountDisk /dev/diskX
        Replace diskX with your disk identifier.
      8. Write the EFR image to the USB drive:
        The dd command will overwrite all data on the target USB drive. Double-check the disk identifier before running the command. Targeting the wrong disk can permanently overwrite your file system.
        sudo dd if=<EFR_IMAGE_FILE.img> of=/dev/rdiskX bs=4m
        Use /dev/rdiskX (raw disk) rather than /dev/diskX for faster write speeds. Replace diskX with your disk identifier. The operation may take several minutes. When it completes, dd displays a summary of records transferred.
        After writing completes, run:
        sync
      9. If macOS displays a dialog that the disk is unreadable, click Ignore — do not click Erase. The EFI partition written by dd is not recognized by macOS.
      10. Verify the USB drive file structure by mounting the USBEFR volume and listing its contents:
        ls -R /Volumes/USBEFR
        The USB drive should contain the following directory structure:
        EFI/
  BOOT/
    BOOTX64.EFI
    grubx64.efi
  centos/
    SHIMX64.EFI
    grubx64.efi
  fonts/
    unicode.pf2
boot/
  resusys.vmlinuz
  resusys.cpio
  resusys.cpio.sig
IMAGES/
  README

      Windows

      Write the EFR image to a USB flash drive using a Windows computer.
      1. Create a staging folder on your Windows computer (for example, C:\USBEFR_STAGING) and copy the downloaded EFR image and PAN-OS images into it.
      2. Verify the SHA-256 checksum of the EFR image using PowerShell:
        Get-FileHash C:\USBEFR_STAGING\<EFR_IMAGE_FILE.img.gz> -Algorithm SHA256
        Compare the output against the checksum from the Customer Support Portal.
      3. Extract the compressed EFR image.
        Use a tool that supports .gz extraction, such as 7-Zip or a similar utility. Right-click the .gz file, choose your extraction tool, and extract to the staging folder.
        This produces an uncompressed file: <EFR_IMAGE_FILE.img> (approximately 8 GB).
      4. Connect the USB flash drive to your Windows computer.
      5. Write the EFR image to the USB drive using Rufus or a similar raw disk imaging tool.
        1. Download and launch Rufus.
        2. For Device, choose your USB drive. Confirm the drive letter and size carefully — writing to the wrong device will overwrite its contents.
        3. For Boot selection, choose Disk or ISO image, then click SELECT and navigate to your extracted <EFR_IMAGE_FILE.img> file.
        4. Leave all other settings at their defaults and click START.
        5. When prompted, choose Write in DD Image mode, then click OK to confirm.
          All data on the USB drive will be erased. Confirm you have selected the correct device before proceeding.
        6. Wait for Rufus to complete. The status bar displays READY when finished.
      6. After Rufus completes, use Windows File Explorer to verify the USB drive contains an IMAGES folder with a README file.
        Windows may only show one partition of the USB drive. This is expected — the EFI and boot partitions are not visible in File Explorer but are present and required for the EFR boot process.
    4. Copy PAN-OS images to the USB drive.
      After writing the EFR image to the USB drive, copy your PAN-OS images into the USB drive's IMAGES folder.
      On Linux and macOS, copy the images directly from the terminal:
      Linux:
      sudo cp ~/USBEFR_STAGING/PanOS_1400-12.2.2 /mnt/usbefr/IMAGES/
sudo cp ~/USBEFR_STAGING/PanOS_1400-12.2.5 /mnt/usbefr/IMAGES/
sync
      macOS:
      sudo cp ~/USBEFR_STAGING/PanOS_1400-12.2.2 /Volumes/USBEFR/IMAGES
sudo cp ~/USBEFR_STAGING/PanOS_1400-12.2.5 /Volumes/USBEFR/IMAGES
sync
      Run sync after copying to prevent data loss from removing the drive before the copy completes.
      On Windows, use your partition explorer tool to navigate to the IMAGES folder of the USB drive, then copy the PAN-OS image files into it.
      Verify the IMAGES folder contents:
      IMAGES/
  README
  PanOS_1400-12.2.2
  PanOS_1400-12.2.5
    5. Cleanly unmount and eject the USB drive before removing it from the computer.
      Linux:
      sudo umount /mnt/usbefr
      macOS:
      diskutil eject /dev/diskX
      On Windows, use the Safely Remove Hardware option in the system tray before unplugging the USB drive.

    © 2026 Palo Alto Networks, Inc. All rights reserved.