>
    Strata Copilot
    Configure USB Port Access
    Focus
    Download PDF
    Focus
    1. Home
    2. Next-Generation Firewall
    3. Firewall Administration
    4. Configure USB Port Access
    Download PDF
    Next-Generation Firewall

    Configure USB Port Access

    Table of Contents

    Configure USB Port Access

    Control which USB devices can connect to the firewall by enabling or disabling USB port access using USBGuard.
    Where Can I Use This?What Do I Need?
    • Supported NGFWs (see list of supported platforms)
    • PAN-OS 12.2.2 or later
    • Administrator access
    PAN-OS 12.2.2 introduces USBGuard, a software framework that controls which USB devices can connect to the firewall. By default, the USB port is enabled and restricted to USB mass storage devices. You can disable the USB port entirely using the CLI when USB access is not required.
    The USB port setting does not persist through a factory reset or private data reset. After either of these operations, the USB port returns to its default state (enabled, storage devices only).
    • Enable the USB port (allow USB mass storage devices only):
      configure
set deviceconfig system usb-port state enable
commit
      When enabled, USBGuard allows only USB mass storage devices (USB class 08, subclass 06, protocol 50). All other USB device types are blocked.
    • Disable the USB port (block all USB devices):
      configure
set deviceconfig system usb-port state disable
commit
      When disabled, all USB devices are blocked. A system log entry is generated when the USB port setting changes.
      Even when the USB port is disabled through the OS, the physical USB port can still be used during early boot (before PAN-OS loads) to perform an Enhanced Factory Reset via the BIOS menu. USB port access control at the OS level does not prevent BIOS-level USB boot.

    © 2026 Palo Alto Networks, Inc. All rights reserved.