SonicOS 8.2.3 Frequently Asked Questions

Description

About the release 

• What is SonicOS 8.2.3?
  SonicOS 8.2.3 is the next release of the SonicOS firmware for SonicWall Gen 8 firewalls. It delivers Phase 2 of the SonicWall Secure by Default, Secure by Design initiative, and it adds security visibility, routing and SD-WAN enhancements, deployment options, and management updates.
• What is Phase 2 of Secure by Default, Secure by Design?
  In Phase 1, SonicOS 8.2.2 enabled security services as a standard part of new deployments. Phase 2 extends this principle. It applies further secure defaults to new deployments, provides stronger administrative access protection, and makes the resulting security posture visible on the device through Security Insights. Firewalls upgraded to SonicOS 8.2.3 keep their existing configuration and receive recommendations and alerts instead of changed settings.
• When can I upgrade?
  SonicOS 8.2.3 and NSM 4.5.0 are generally available from 5 November 2026. Release notes and upgrade documentation are published alongside general availability.
• Is there a cost to upgrade?
  Please contact your SonicWall representative or partner for entitlement and licensing details.
• Which firewalls support SonicOS 8.2.3?
  SonicOS 8.2.3 supports SonicWall Gen 8 firewalls: the TZ80 through TZ680, the NSa 2800 through NSa 6800, and the NSv XS, S, M, and L virtual firewalls. The platform table in the SonicOS 8.2.3 release notes lists every supported model. The TZ80 must be licensed before it can be configured or used, and it must always be connected to the internet; it cannot be used in a closed network.
• Can I roll back to my previous release after upgrading?
  No. Downgrading from SonicOS 8.2.3 to any earlier firmware version is not supported, and a downgrade can delete all LDAP users and completely reset all multi-factor authentication settings. Before upgrading to SonicOS 8.2.3, please ensure that you create and securely store a configuration backup from your current SonicOS version. 

Security posture and visibility (On-Box Security Insights)

• What is On-Box Security Insights?
  Security Insights is a security posture assessment that runs on the firewall. It reviews the running configuration, calculates a Security Score, identifies protections that are disabled, absent, or weaker than recommended, and presents findings in order of severity. Each finding has a How to Fix view that explains the remediation and links to the setting that resolves it. On the firewall, Security Insights is available only in Classic Mode.
• Do I need NSM to use Security Insights?
  On firewalls that are not managed by NSM, Security Insights runs on the firewall itself. Firewalls managed through NSM do not display Security Insights on the firewall; instead, view Security Insights in NSM, on the Monitor page in Firewall View. Security Insights in NSM requires an eligible NSM license; see the NSM release notes for the license requirements.
• Can I customize the Security Insights view?
  Yes. You can search the Issues table and filter it by severity and by type.
• Does Security Insights detect management exposure?
  Yes. It reports conditions such as HTTPS management enabled on a WAN interface.
• How often is Security Insights updated?
  Security Insights recalculates the Security Score automatically every 60 minutes. When there is a change in the config, it is recalculated immediately,
• Does Security Insights automatically update my configuration?
  No. Security Insights reports findings and links to the relevant setting. Changes are made only when an administrator applies them.
• Can I use Security Insights to demonstrate compliance to an auditor?
  Security Insights provides evidence of the current configuration state, which can support an audit. It does not by itself constitute a compliance certification. Consult your auditor about the requirements applicable to your organization.

Secure by default (Security services enabled by default)

• Which security services and settings are enabled by default?
  On new Gen 8 firewalls, five security services are enabled at registration, as introduced in SonicOS 8.2.2: Gateway Anti-Virus, Anti-Spyware, Intrusion Prevention, Botnet Filtering, and Geo-IP Filtering. Each service inspects traffic only when it is licensed. SonicOS 8.2.3 adds six secure default settings for new firewalls: Stealth Mode, IP ID randomization, Discard as the action of the default deny rules, SSL Control (Gen 8 hardware firewalls only), two-factor authentication for administrators, and MFA alerting for SSL VPN users. Administrators are guided through these settings at first login.
• Does this change apply to devices I upgrade?
  No. Upgraded devices retain their existing configuration. After the upgrade, however, zones that you create use the Discard action for their default deny rules, and administrators who have not enrolled in two-factor authentication see a dismissible message that recommends enrollment. Review your security services after upgrading and use Security Insights to confirm the resulting state.
• Can I disable a default security service?
  Yes. Administrators can change these settings. We recommend keeping them enabled unless a specific requirement applies and documenting any exception. If the firewall runs in FIPS mode or NDPP mode, the mode restricts some settings.
• Will enabling these services affect my existing traffic?
  Some settings can affect traffic handling. The most visible is the Discard action for the default deny rules: blocked inbound traffic is dropped silently, without a TCP reset or an ICMP unreachable message, while blocked outbound traffic from trusted zones still receives the Deny action. Stealth Mode and IP ID randomization, which applies to IPv4 only, also change how the firewall responds to traffic. Test changes in a non-production environment before applying them to a production device. 

Multi-factor authentication 

• Is multi-factor authentication enabled by default?
  Multi-factor authentication (MFA) using Time-based One-Time Passwords (TOTP) is enabled by default only for new installations of SonicOS 8.2.3. In these deployments, MFA is automatically enforced for the default administrator account and for any newly created user account that is added to an administrator group. For upgraded (brownfield) deployments, no changes are made to existing authentication settings during the upgrade process. MFA is not automatically enabled for existing administrator or user accounts and must be configured manually if desired. Existing administrators see a dismissible message that recommends enrollment.
  For SSL VPN users, enabling MFA is highly recommended to strengthen remote access security and protect against credential-based attacks. On new firewalls, MFA alerting for SSL VPN users is enabled by default; it is advisory only and does not block connections.
• How do I enable multi-factor authentication on an upgraded device?
  Go to DEVICE | Users > Local Users & Groups, select the administrator account, set One-time password method to TOTP, and save. The administrator then completes enrollment with an authenticator app. Multi-factor authentication must be turned off for the administrator account that you use to onboard a firewall to NSM manually.
• Who must enroll in TOTP?
  On new installations, enrollment is required for the administrator accounts described above. Otherwise, enrollment applies to the administrator accounts and remote access users that you configure for multi-factor authentication. Existing accounts are not enrolled automatically, and MFA enforcement for users authenticated by an external RADIUS or LDAP server is turned off by default.
• What authenticator apps can I use?
  TOTP works with authenticator apps such as Google Authenticator, Microsoft Authenticator.
• What happens if an administrator loses their authenticator device?
  Use the emergency scratch code that is displayed during enrollment to sign in; store that code securely when you enroll. An administrator can also unbind TOTP from the account so that a new device can be enrolled, and the serial console, which is exempt from multi-factor authentication enforcement, remains a recovery path. For firewalls managed by NSM, the NSM Reset Password and Unbind TOTP actions are also available. We recommend that at least two administrators be enrolled.
• Does multi-factor authentication apply to console access?
  No. Multi-factor authentication enforcement does not apply to the serial console (console CLI). The console therefore remains a recovery path if an administrator cannot complete two-factor authentication, so protect physical access to the firewall.

Configuration backup encryption 

• What is configuration backup encryption?
  When you export the configuration, you can encrypt the backup with a password. An encrypted backup is saved as an .epf file protected with AES-256-GCM, and its password must meet the password policy configured on the firewall. You can still choose No encryption, which saves an unencrypted .exp file after you acknowledge the risk. In FIPS mode, only encrypted exports are allowed.
• What happens if I lose the backup password?
  An encrypted backup cannot be restored without its password. The password is not stored and cannot be recovered, so store it in your organization’s secrets management system.
• Are my existing backups still usable?
  SonicOS 8.2.3 can import configuration files in both the unencrypted .exp format and the encrypted .epf format.

Routing (OSPF graceful restart)

• What is OSPF graceful restart?
  A graceful restart allows a firewall to preserve its forwarding state while its control plane restarts. Neighboring routers continue to forward traffic through the restarting device rather than withdrawing adjacencies. This reduces disruption during planned maintenance and high-availability failover.
• Does graceful restart require configuration on neighboring routers?
  Neighboring routers must support OSPF graceful restart helper mode. Consult your neighboring router documentation to confirm support.
• Does graceful restart protect against hardware failure?
  Not by itself. Graceful restart does not replace hardware redundancy. In a high-availability pair, however, it reduces routing disruption during a failover, including a failover caused by a hardware failure of the active firewall. BGP configuration in the user interface
• What has changed in BGP configuration?
  BGP can now be configured through a structured user interface. Administrators can configure BGP global settings, neighbors, and advertised networks through guided elements, with less reliance on command-line configuration.

ECMP in BGP 

• What is ECMP in BGP?
  Equal-cost multi-path support allows the firewall to install multiple equal-cost BGP paths and forward traffic across them concurrently. Environments with several equal-cost links, such as multiple transit providers or multi-homed connectivity, can use all those links rather than one best path. ECMP applies to IPv4 and IPv6 unicast routes, and paths are equal when their WEIGHT, LOCAL_PREF, AS_PATH length, ORIGIN, MED, and route type are the same. To use it, turn on Allow learning ECMP routes from advanced routing protocols; the change takes effect after a restart.
• What is the maximum number of equal-cost paths supported?
  The eBGP Max Paths and iBGP Max Paths settings each accept a value from 1 to 4.
• How is traffic distributed across the paths?
  The firewall distributes outbound traffic across the equal-cost paths per flow, so all packets of a flow follow the same path.
• Does ECMP improve resilience as well as bandwidth?
  Yes. Traffic already distributed across several paths continues to flow if one path fails, reducing the impact of a single link failure. 

SD-WAN Mixed transport groups 

• Can SD-WAN use both MPLS and VPN transport in the same group?
  Yes. A mixed transport group, called a Hybrid SD-WAN group in the SD-WAN guide, allows MPLS and encrypted VPN tunnel interfaces to participate in a single SD-WAN group under one policy. Interfaces in WAN or untrusted zones cannot be members, and numbered and unnumbered tunnel interfaces cannot be mixed in the same group.
• Do I need to redesign my existing SD-WAN deployment?
  No. Existing configurations continue to operate. Mixed transport groups are optional and can be adopted during migration. The type of an SD-WAN group cannot be changed after it is saved, so create a new Hybrid group rather than converting an existing one.
• Can I keep MPLS as the preferred exit?
  Yes. Policy can select an MPLS exit for traffic where MPLS is the appropriate path, while using VPN transport for other traffic.
• How does a mixed group decide which path to use?
  Path selection follows the Path Selection Profile of the SD-WAN rule, which defines the SLA strategy and SLA class, the probe that measures path performance, load balancing, and a backup interface. For Hybrid groups, the probe target must be reachable through every member interface, return routing must be symmetric, and NAT must not be applied, so that failover is seamless. 

Deployment and network security (Layer 2 Bridge Mode security)

• What is Layer 2 Bridge Mode security?
  Layer 2 Bridge Mode allows a firewall to be inserted transparently into an existing network segment. The security policy is enforced on traffic passing through the firewall without any changes to IP addressing, default gateways, or routing.
• Which environments benefit most from transparent insertion?
  Segments that cannot be readdressed, such as operational technology, industrial, and legacy application environments, benefit most.
• Does transparent insertion add a point of failure?
  Any inline device introduces a dependency on its availability. Review your high-availability and failure-mode design before deployment.
• Do I need to change my IP addresses or default gateway?
  No. Hosts keep their existing configuration. 

MAC anti-spoofing 

• What is MAC anti-spoofing?
  MAC-IP anti-spoofing checks the source MAC address and IPv4 address of traffic against a cache of known MAC-IP bindings and, when enforcement is enabled, blocks traffic that does not match. It applies to members of Native Bridge VLAN sub-interfaces, where it supports IPv4 only, and to Layer 2 Bridge interfaces, on TZ and NSa firewalls. This helps prevent a host from impersonating another device in shared Layer 2 environments. Dropped packets and detected ARP poisoning attempts are recorded in the System Logs.
• How does the firewall identify the legitimate MAC address for each host?
  From static entries in the MAC-IP anti-spoof cache. For Native Bridge and Layer 2 Bridge interfaces, the entries must be added manually, in the management interface or through the command-line interface; the options that populate the cache automatically are not available for these interfaces. 
• Will MAC anti-spoofing block legitimate devices that change their MAC address?
  It can. Devices with legitimately changing MAC addresses, such as some virtual machines or devices with randomized MAC addresses, may need to be recorded in the configuration. Enabling enforcement while the cache is empty blocks the devices on that interface, so create static entries for every device before you turn enforcement on. 

Access and guest services (Custom captive portal)

• Can I customize the captive portal?
  Yes. Administrators can customize the login page presented to administrators, non-administrator users, SSL VPN users, wireless users, Guest users and SAML users so that it reflects their organization
• Can I use my own logo and branding?
  Yes. You can upload a logo and a background image and customize the content text, the login button, the SSL VPN link, and the single sign-on (SSO) button. The logo must be a PNG-24 image at 72 DPI, no larger than 200 KB (100 KB or less is preferred), with an aspect ratio of 1:1, 2:1, 4:1, or 5:1. The background image must be a PNG file of up to 2 MB.
• Does customization affect the authentication flow?
  The customization changes the appearance of the login page. SonicOS validates the customization inputs and falls back to the default login page if the custom configuration is invalid. Note known issue GEN8-19712, which affects guest authentication with a custom captive portal in this release. 

Guest services 

• What other guest services changes are included?
  This release includes improvements to captive portal redirection behavior and guest services configuration. Customizing guest login pages with CGI scripts on an external web server is deprecated, and guest workflows that rely on it can fail after an upgrade; replace them with the supported REST APIs, as described in the knowledge-base article Deprecation of CGI-Based Guest Login Page Customization.

Application visibility and control  SaaS and AI application objects 

• What are SaaS and AI application objects?
  These are read-only policy objects for software-as-a-service (SaaS) and artificial intelligence (AI) applications, populated from the SonicWall cloud database when Cloud Sync is on. You use them through SaaS & AI Application Groups in access rules, route policies, and SD-WAN rules. Matching is based on the destination IP address, and the objects cannot be edited.
• Can I control whether the firewall downloads data from SaaS and AI applications?
  Yes. The Cloud Sync setting controls whether the firewall downloads the SaaS and AI application database from the SonicWall cloud. If you turn Cloud Sync off, SaaS & AI Application Groups contain no application data, and policies that use them match no traffic. 
• Which applications are included?
  The current list is shown on OBJECT | Match Objects > SaaS & AI Applications. It includes services such as Amazon Web Services, Microsoft 365, and Google Cloud Platform, and it is updated from the SonicWall cloud database while Cloud Sync is on. 

Alerting and notifications (OAuth 2.0 for the mail server)

• Does alerting work with Microsoft 365?
  Yes. SonicOS 8.2.3 supports OAuth 2.0 token-based authentication for the outbound mail server used for alerts and scheduled reports. This allows alerting to continue as Microsoft 365 withdraws basic authentication.
• Do I need to migrate from basic authentication now?
  We recommend migrating before basic authentication is withdrawn for your tenant to ensure alert delivery is not interrupted.
• Are mail passwords stored when I use OAuth 2.0?
  With OAuth 2.0, the firewall authenticates to the mail server with OAuth tokens rather than with the user name and password of the mail account. Basic authentication remains available as an option. The SonicOS 8 Device Log guide describes how to configure OAuth 2.0. 

Management 

• Which NSM version supports SonicOS 8.2.3?
  NSM 4.5.0 is released alongside SonicOS 8.2.3 and supports the devices and features of SonicOS 8.2.3.
• Can I manage 8.2.3 devices with an earlier NSM version?
  Use NSM 4.5.0 to manage firewalls running SonicOS 8.2.3. Earlier NSM versions do not list SonicOS 8.2.3 as supported firmware; the NSM 4.5.0 release notes list the supported firmware.
• What other NSM 4.5.0 changes are included?
  NSM 4.5.0 adds support for hash-based certificate verification for SSL verification and FQDN in manual acquisition, and support for SonicOS 7.3.4 in the NSM migration application. For NSM On-Premises, it resolves management and reporting issues that occurred when the agent or controller IP address matched the WAN IP address of the perimeter firewall. Refer to the NSM 4.5.0 release notes for details.
• Does NSM show Security Insights findings?
  Yes. In NSM, Security Insights is available on the Monitor page in Firewall View for Gen 7 and Gen 8 firewalls with an eligible NSM license. NSM analyzes the Tech Support Report (TSR) from firewall backups with the Configuration Auditor template, assigns each firewall a risk score, tracks posture drift over time, and provides prioritized remediation guidance. Firewalls managed through NSM do not display Security Insights on the firewall itself. 

Upgrading 

• What should I do before upgrading?
  Back up your configuration, review the release notes, including the known issues, and test the upgrade on a non-critical device first. Downgrading from SonicOS 8.2.3 is not supported (see "Can I roll back to my previous release after upgrading?"). If NSM manages the firewall, confirm that NSM runs version 4.5.0.
• What should I check after upgrading?
  Confirm your security services configuration, review Security Insights findings, check the default deny rules of any zones that you create after the upgrade, because they use the Discard action, and plan multi-factor authentication enrollment for administrators if you intend to adopt it.
• Will my VPN, routing, and SD-WAN configurations continue to work?
  Existing configurations are expected to continue operating. Verify routing and SD-WAN behavior after upgrading.
• Where can I get help?
  Contact SonicWall Support or your SonicWall partner.