How to disable usb port on ASA 5525-X

[h.dam]

Hi everyone,

I would like to disable the usb port on the firewall in order to block physical access. But I didn't find the CLI command (ASA v9.8.1)

Having tried to search in this forum, people said it is impossible to do.

Did someone succeed to do it?

Thanks.

Regards.

[Dennis Mink]

hw-module usb disable   try that

[h.dam]

I've already tried this.

This command is not recognized.

Regards.

[h.dam]

I have inserted a usb key with FAT format on one usb port (below the mngt port), nothing happened. 

When I run the command DIR, I saw only disk0.

[Florin Barhala]

Can you state here your HW and SW version pleasE?
Also you want to enable or disable USB port?

[h.dam]

Hi Florin,

The firewall is ASA 5525-X with v9.8(1).

I'd like to disable the usb key as said on the title.

But I cannot disable it if I don't see disk1.

Regards.

[Marvin Rhoads]

By default the "dir" command will only show you disk0 (internal compact flash card).

If a FAT-formatted USB storage device is connected to the external USB port, you should be able to see its contents with "dir disk1:"

You cannot disable the ASA USB port in software. If you order the FIPS kit it will include a set of tamper resistant stickers - you can apply one of those over the physical port to prevent/detect its use. You can also disable access to it it physically - I have seen epoxy used to fill the port in high security environments!

[h.dam]

Thank you for your response.

I don't know what are the uses of these usb ports designed originally.

Especially on a security appliance where physical access is not permitted in most cases.

So I have to put sticker on it. Sorry that I have no other choice.

[Ronit Bhattacharjee]

We requested Cisco to add this feature for FPR1120 running ASA code and it is now available cisco-asa-fp1k.9.22.1.1.SPA and above. Not sue if it is also compatible with older ASA5xxx series firewalls