Latest News

Throughput Requirements - Firewall vs threat protection

Concurrent Sessions - Max number of simultaneous connections

New Connections Per Second - Speed in establishing new sessions

Number of Users & Devices -Total internal clients, IoT devices, servers and guest devices

Network Architecture & Segmentation - Number of zones, VLANs, DMZs

Security Services Enabled - DPI, IPS, Anti-malware, application control, SSL/TLS Decryption

Redundancy & High Availability - Active/Passive or Active/Active

VPN & Remote Access Needs - Number Of concurrent remote VPN users

Understanding Throughput Metrics

Firewall Throughput - Routing/switching vs real-world security

Threat Prevention Throughput - Includes all major security services

IPS Throughput - Only IPS/IDS engine is active

TLS/SSL Inspection (DPI-SSL) - Most CPU and memory-intensive operation

IPSec VPN Throughput - Measures data transfer capability tor encrypted site-to-site or client VPNs

Sessions and Connections - Firewall Sizing Considerations

Concurrent Sessions

• Total number of active sessions at any given time
• Essential in high user/device density or heavy internal traffic environment
• Need to account for Internal and external connections (e.g.. LAN Internet. LAN LAN)

New Connections Per Second (CPS)

• Number of new sessions pet second
• Important for bursty environments like web servers. application gateways. or VoIP
• Low CPS capacity can create bottlenecks

Session Table Capacity

• Tracks every connection's state — once full. new connections are dropped or delayed
• Need to account for peak usage and expected growth

Session Persistence and Cleanup

• Long-lived sessions (e.g., VPNs, streaming) consume resources longer
• Proper timeout settings and idle session cleanup help optimize resource use

Impact of Security Services

• DPI, AV, SSL Inspection. etc. increase session processing load
• Must handle session state tracking and inspection concurrently

Check numbers multiple times a day to get an average number,
8am, 1 pm, and 3pm are good times to record the connections and connections per second, compare with SonicWall's datasheet.

User & Application Profiles - Impact on Firewall Sizing

Application Usage Impact

• Applications using real-time traffic (VoIP, video conferencing) are sensitive to latency and need low-lag inspection
• SaaS-heavy environments generate frequent SSL sessions, requiring DPI-SSL handling capacity
• Legacy apps using non-standard ports/protocols require flexible inspection and exception handling
• Firewalls must accommodate both session quantity and throughput demand per application type

Use Case- Small Business

Deployment Overview

• 30 users
• 1 Gbps bi-directional fibre internet
• Moderate web and VPN usage
• Full security services enabled (except DPI-SSL)

Key Assumptions

• "Basic firewall + antivirus" is a misnomer — all best-practice security services are considered enabled.
• Threat throughput should be used as the base for sizing unless DPI-SSL is implemented.
• VPN adds overhead, similar to attaching a trailer to a car — this impacts performance.
• SSL VPN is still in use (though ideally offloaded to CSE).

Current Option: TZ380

• Threat throughput: 1.5 Gbps
• May be insufficient once VPN overhead is considered.
• Limited headroom for future growth,

Recommended Upgrade: TZ480

• Threat throughput: 2 Gbps
• More powerful CPU for handling VPN load
• Headroom for growth and consistent performance under full inspection load

Use Case - Mid-Size Org

Deployment Overview

• 250 users
• SSL inspection, IPS, cloud applications in use
• Dual internet links:
  • 1 Gbps fibre (bi-directional)
  • 2 Gbps broadband (200 Mbps upload)

Traffic Calculation

• 1G up + 1G down + 2G down + 0.2G up = 4.2 Gbps Internet Traffic
• Additional intra-zone traffic assumed: 4.0 Gbps
• Total aggregate throughput requirement: —8.2 Gbps
• SSL inspection traffic: 4.2 Gbps

Sizing Recommendation

• Smallest model meeting requirements: NSA 3800
• For 5-year growth projection (I .6x load increase):
  • NSA 4800 (100% capacity)
  • NSA 5800 (75% capacity)
• Either model could support this use case depending on growth profile

Summary

• Right-sizing of firewalls is critical for:
  • Preventing performance bottlenecks and limitations on threat inspection capacity
  • Aligning threat protection throughput with security requirements
  • Maintaining cost efficiency.
• Key factors for sizing go beyond throughput requirements
• Understand the different throughputs and how they apply to sizing
• The impact of sessions and connections varies with different types of environments
• The type of users and application usage must be considered for sizing
• Plan for user/traffic growth and high availability

SonicWall have released some new promotions (for moving to Gen 7 appliances).

1-YEAR REIGNITE PROMOTION:
Legacy SonicWall firewall customers can purchase a 1-year Advanced Protection Security Suite (APSS) subscription and receive a FREE Gen 7 firewall. This offer applies to legacy SonicWall firewalls that are inactive for 90 days or more and requires registration using the legacy SonicWall serial number. Not valid for competitive replacements.

2 & FREE PROMOTION:
Legacy SonicWall firewall customers can purchase a 2-year Advanced Protection Security Suite (APSS) subscription and receive a FREE Gen 7 firewall. This promotion is available for devices with either active or expired services and requires registration using the legacy SonicWall serial number. Not valid for competitive replacements.

3 & FREE PLUS FREE HIGH AVAILABILITY (HA) PROMOTION:
(Gen 7 TZ Only) Want the longest term? Includes two free next-generation firewalls (primary and high availability hardware) with the cost of a three-year APSS subscription. SonicWall Replacement and Competitive Takeout Eligible. Standard Secure Upgrade Matrix applies.

Available through a special pricing request, please contact us for more information.

This promotional offering may not be combined with any other sale, promotion, discount, rebate, coupon, or offering, nor may it be used in conjunction with stock rotations. Standard Deal Registration Eligible.

Datasheet: https://yoursonicwall.com/images/document/21925849...

Cyberattacks often begin with a single click. That’s why content filtering is more critical than ever in today’s digital landscape. But not all filtering technologies are the same and understanding the difference between DNS and URL filtering can help your organization build a smarter, layered security strategy for web access.

What is DNS Filtering?

DNS filtering works at the Domain Name System (DNS) level.
This is the same system that translates a website (like linkedin.com) into the IP address your device uses to connect.
When DNS filtering is enabled, requests for malicious, risky, or non-compliant domains are blocked before a full connection is established.

Benefits of DNS Filtering:

• Fast and lightweight – stops threats before a page even loads
• Great for remote/hybrid work – protection travels with users
• Broad protection – blocks entire domains known for hosting malware, phishing, or botnets.

Example:
If a user clicks a phishing link to malicious-phish.com, DNS filtering stops it from resolving so no connection or download is made (and no risk).

What is URL Filtering?

URL filtering goes deeper. It analyzes the full web address (URL), including the specific page, folder, or file path, after DNS resolution.

This allows organizations to enforce more granular web access policies and send the entire URL for more in-depth evaluation.

Benefits of URL Filtering:

• Granular control – Send specific pages for further risk-based evaluation (e.g., example.com/sports/basketball)
• Advanced Threat Protection – Stops users from accessing compromised subpages or dangerous downloads on otherwise “safe” domains

Example:
A site like example.com may be generally safe, but example.com/freeware.exe could contain malware. URL filtering catches this.

People often struggle to say goodbye to their things. We grow attached and comfortable with the stuff we use on a regular basis. For instance, I have an old couch that I seldom use, but am nonetheless unable to part with. This comfort zone can be dangerous, as it makes you hold on to things you may no longer need.

We similarly get used to our old network devices. But unlike keeping an old couch, not updating your security gear on time can compromise your entire network. There’s no time like right now to evaluate your needs and adapt. Eliminate things that aren’t needed so that your network is simplified and update those devices that are critical to the operation.

A good firewall is a cornerstone of a secure network. It'll stop advanced cyberattacks, as well as keep up with the speed, performance and productivity needs demanded by today’s workplace. Here are the top 10 reasons you should consider updating your legacy firewall to one of the latest 7th generation SonicWall TZ Series firewall (TZ270, TZ370, TZ470, TZ570 and TZ670 Series):

1. Multi-gigabit support in desktop form factor with high port density
Organizations require increased throughput to support bandwidth-intensive applications — and as such, need multi-gigabit ports. Additionally, having a greater number of ports allows organizations to connect more devices directly to the firewall.

Why Upgrade: Gen 7 TZ series next-generation firewalls are the first desktop form factor to bring multi-gigabit (2.5/5/10G) interfaces or fiber (SFP+, SFP) interfaces, while the legacy or Gen 6 firewalls support only gigabit interfaces. Gen 7 TZs also support a minimum of 8 ports, while Gen 6 supports only 5.

2. Superior hardware upgrades with expandable storage and redundant power supply
Gen 7 TZs come with an expandable storage that enables various features, including logging, reporting, caching, firmware backup and more. A secondary power supply is available for redundancy in case of failure, ensuring business continuity.

Why Upgrade: Gen 7 TZ series models come with an expandable storage slot on the bottom of the device that provides the ability to expand up to 256GB, while Gen 6 does not. TZ670 comes preloaded with 32GB expandable storage, and TZ570/670 series firewalls support two AC power supplies for redundancy. The optional redundant power supply is available for purchase with TZ570/670 Series, while all other Gen 6 and Gen 7 firewalls support one power supply.

3. Groundbreaking firewall inspection, DPI performance and IPSec VPN performance
Network bandwidth requirements from apps, HD video streaming, social media and more continue to increase. And keeping up requires faster firewall inspection, DPI and IPSec VPN performance, which provide a secure network without performance degradation. Having faster firewall performance provides organizations with a greater capacity to utilize higher internet speeds and support more concurrent and remote users.

Why Upgrade: Gen 7 TZs offer up to 3 times firewall, DPI and IPSec VPN performance over Gen 6 firewalls.

4. Scale higher with increased connection count (per second, SPI, DPI, DPI-SSL)
Having a higher number of concurrent connections provides greater scalability by enabling more simultaneous user sessions to be active and tracked by the firewall.

Why Upgrade: Gen 7 TZs offer up to 15 times as many maximum connections as Gen 6 firewalls.

5. Deploy at scale
With easy onboarding and single-pane of glass management, organizations can reduce complexity, scale quickly, and get business running without additional IT personnel.

Why Upgrade: Gen 7 is simplified by Zero-Touch Deployment, with the ability to simultaneously roll out these devices across multiple locations with minimal IT support.

6. Increased VPN connectivity
For organizations with remote and branch locations, such as retail POS businesses, the ability to create a larger number of site-to-site VPN tunnels is essential. It enables organizations to connect distributed networks together and securely share data.

Why Upgrade: Gen 7 offers up to eight times more site-to-site VPN tunnels than Gen 6 firewalls.

7. High VLAN interfaces
VLANs support the logical grouping of network devices, reduce broadcast traffic and allow more control when implementing security policies. This provides logical separation of devices on the same network. High VLAN interfaces allow better segmentation and performance for organizations.

Why Upgrade: Gen 7 TZ series offers up to five times more VLAN interfaces than Gen 6 TZ series.

8. 802.11ac Wave 2 technology with higher max number of access points
11ac Wave 2 technology enhances Wi-Fi user experience by supporting MU-MIMO technology. An integrated Wi-Fi option enables organizations to extend their wireless network farther without purchasing additional hardware. Alternatively, high number of APs supported by the firewall provide better scalability of the Wi-Fi network.

Why Upgrade: Gen 7 TZs (with the exception of TZ670) offer integrated 802.11ac Wave 2 support, while Gen 6 supports only 802.11ac Wave 1 or 802.11n technologies. Gen 7 TZs support up to four times as many access points as Gen 6 series.

9. Brand-new SonicOS 7.0 support
The feature-rich SonicOS 7.0 operating system features modern UI/UX, topology view, enhanced policy, advanced security and networking and management capabilities, along with TLS 1.3 and default support for BGP routing without the need for additional license.

Why Upgrade:SonicOS 7.0 support is available on Gen 7 Series, but not available on Gen 6 Series. Gen 7 includes BGP support as default with every firewall purchase, as well as Stateful HA support.

10. 5G USB Modem Support
The USB 3.0 port in the Gen 7 TZs could be used to plug in a 5G dongle for 5G connectivity. They’re backward compatible with 4G/LTE/3G technologies with the use of corresponding dongles.

Source: https://blog.sonicwall.com/en-us/2022/10/10-reason...