In air-gapped deployments where your devices have no outbound internet connection, your security administrator can enable Secure Copy Protocol (SCP) to upload essential files directly to your Next-Generation Firewall (NGFW). PAN-OS® supports SCP uploads for superuser administrators only, ensuring granular control over who can perform uploads. Once SCP uploads are enabled for a superuser administrator, you can use this account to write custom scripts and automation for file uploads using the command-line interface (CLI) rather than the web interface. This ability is critical for maintaining security and operational readiness in isolated networks.

SCP uploads are supported from local devices running a Microsoft Windows, macOS, or any Linux operating system. The upload must be performed exclusively from your local device command-line. Palo Alto Networks does not support SCP applications like WinSCP and FileZilla. You can use SCP Support to upload all critical operational files, including PAN-OS software versions and patches, content updates (such as Applications and Threats, WildFire, and antivirus), XML configuration files, PAN-OS plugins, and license key files. PAN-OS generates a system log every time an SCP upload succeeds or fails, providing a clear audit trail for compliance and security monitoring.