Set Sophos Firewall USB setup delay correctly
During firewall provisioning or zero-touch configuration, SFOS must detect that the connected USB drive is ready. usb-setup-delay controls this waiting period. The supported range is 1 to 15 seconds, with a 3-second default.
The documented effect is limited to the waiting period before USB detection in these setup workflows. The setting neither controls boot order nor forms part of reimaging SFOS with a bootable USB drive.
⚠️ Change only for a reproducible fault: First record the current value, SFOS build, USB drive and symptom. A higher value is useful only when the provisioning drive isn’t ready within the current waiting period.
Check the current value and set it deliberately
Run the commands in 4. Device Console. In SFOS 22, show sits below the set subcommand and displays the current value:
system usb-setup-delay set show
The value is also changed below set. The number represents seconds; don’t enter the square brackets shown in the official Sophos syntax. For a controlled first test, increase the delay only as far as necessary, for example from 3 to 5 seconds:
system usb-setup-delay set 5
system usb-setup-delay set show
Use the second command to confirm that the current value is now 5. Values of 0, values above 15 and units are not part of the documented SFOS 22 syntax.
The Sophos command reference doesn’t describe a restart or an immediately triggered provisioning run when you set the value. It also doesn’t promise that a drive that’s already connected is detected again. Evaluate the changed value during the next planned provisioning or zero-touch setup run; beforehand, set show only confirms the setting.
Test provisioning and isolate the cause
Repeat the test with the same USB drive and port. A successful set show output only proves the configured waiting period, not that provisioning succeeded.
Acceptance therefore includes the provisioning result and the values that the selected provisioning configuration is meant to apply. Have an alternative management path available before the test in case the target configuration isn’t applied as expected.
If the USB drive remains undetected at 15 seconds, stop tuning the delay. Check the drive and port, then verify the requirements of the provisioning or zero-touch workflow you’re using. Values outside the documented range aren’t another option.
Rollback
If the additional wait provides no benefit, restore the recorded value. On a system without a previous customization, this is the 3-second default:
system usb-setup-delay set 3
system usb-setup-delay set show
The expected value in set show confirms that the setting has been rolled back. You can verify whether USB detection behaves as expected again only during the next planned provisioning or zero-touch setup run.