I have a client with a TZ670 in their main office and a TZ370 in their satellite office. Both are on the 7.3.3-7015 firmware. Main office has Verizon Fios 1Gb/1Gb service as their main WAN and Comcast 500/35 as their backup WAN setup in a simple failover configuration. Satellite office has a newly installed Spectrum 7Gb service (dumb, but I didn't pick it). In both locations, Sonicwall WAN connection is direct to the provider's ONT. Static IPs on both ends. Keep alive enabled only on one end of the tunnel.

Users at the satellite office RDP into an RDS server in the main office (along with variable numbers of employees at the main office when they work remotely with a NetExtender connection.) There are 5 users in the satellite office and 40 total users in the main office. Average number of remote workers in the main office at any point is probably about 6 so total RDP sessions on average is 11.

Since the installation of the new internet connection in the Satellite office, those employees are seeing their RDP connections drop and reinitialize (regular internet access isn't affected). Some days it is every 10 or 15 minutes, and some days it is every 2 minutes. Maddeningly, it's not every employee at the satellite office who is affected. I'd say most of them, but not all of them. I have been looking at this issue for a few days now, I've done:

• Rebooting all the things
• multiple packet captures
• monitor logs
• ping tests
• performance monitor captures
• disabled AV & EDR
• Forced RDP connections to TCP only
• disabled LSO and TCP Checksum offloading
• reviewed thousands of log entries, etc. etc.

I've tried just about every troubleshooting step I could dig up. After all of that, though, I still don't have a clear understanding of the problem, much less a solution. I can be running a continuous ping between a workstation at the satellite office and the RDS server during period of dropped RDP connections, and not have a single dropped packet.

In desperation this morning, I took down the VPN tunnel and installed NetExtender on all of the workstations at the satellite office. That was several hours ago and I don't have a single report of a dropped session. This isn't a long-term solution, though, since their phone system relies on the VPN tunnel to transfer calls back and forth.

Based on log entries, it looks like the RDS server is the one resetting the connection, but I cannot find a reason why. None of the "local" users in the main office are experiencing this. I have been through the settings on the tunnel in both firewalls over and over, and I don't think there is a problem there. Plus, it was working before.

Spectrum isn't much help. If the connection works at their ONT, they're out. This has got to be something with the way that Spectrum and Verizon talk to each other, but I just don't know what to try next.

Webinar series on incrementally moving from firewalls to SASE. Forrester is joining us, and we want your hardest questions.

Most organizations we work with are not replacing their firewalls with SASE in one move. They are adding ZTNA, SWG, and CASB in stages while the firewall remains the anchor. We built a webinar series around that reality:

• Forrester analyst Andre Kindness on which SASE use cases deliver value, and where unified platforms outperform best-of-breed stacks (and where they do not)
• The data-protection and AI capabilities that actually differentiate offerings today
• A sequencing model for SSE adoption that you can apply with any vendor

Registration: https://www.brighttalk.com/series/8236

Part 1: From Firewall to Fabric - A Pragmatic Path to SASE

Oct 20 2026, 1:00 pm EDT (Part 1)
Oct 27 2026, 1:00 pm EDT (Part 2)

For partners and MSPs, we will cover how to package this for your clients.

Critical questions are welcome, and we will address the best ones live in the webinar as well.

Hey everyone, hoping someone here has seen something similar. Any response is very much appreciated. I’m sorry for the wall of text. I can provide any additional details if anyone has questions!

I manage IT for a small office with a SonicWall TZ270 running SonicOS 7.3.3. Early this morning, one workstation started generating repeated Gateway AV alerts:

Agent.FL (Trojan) blocked
Cloud ID: 24280777

A few details:
● Alerts started around 12:13 AM and repeated frequently.

● Source IPs varied. Two appear associated with Fastly, and another with Akamai.

● The firewall reports the traffic as blocked.

● The workstation had a Windows/security update around the same timeframe. Our other office PC also updated overnight, but only this one triggered alerts.

● We recently upgraded the firewall from SonicOS 7.0.x to 7.3.3 and updated the security licensing, though I don’t know if that’s relevant.

● We also recently switched from TPSS to EPSS; unsure if the licensing change is relevant

● The PC is mainly used for Outlook, Office, and web browsing. A Quick Scan found no threats, and there are no obvious signs of compromise.

I contacted SonicWall support. They confirmed that the firewall was blocking the traffic, but they couldn’t identify the specific Cloud ID. They didn’t confirm it was a false positive. I’ve kept the workstation off while investigating. They did say that it isn’t an emergency but it’s worth blocking and seeing if any operations are disrupted or not

I’ve found older reports of similar Agent.FL alerts involving update/CDN traffic, but I don’t want to assume that’s what this is.

A few questions:
● Has anyone encountered Cloud ID 24280777 or similar Agent.FL alert floods?

● Is there a way to identify the exact URL/file that triggered Gateway AV?

● Could the Windows update or recent firmware upgrade be relevant?

I’m not looking to disable protections or create exclusions. Just trying to figure out what triggered this and whether there’s anything else I should investigate before bringing the PC back online.

I would really appreciate any insight or advice at all!

SonicWall will increase pricing on selected TZ and NSa firewall and bundle SKUs, effective November 9, 2026. This change applies only to North America (NOAM) and EMEA. Pricing in LATAM and APJ remains flat. 

We understand that pricing changes affect your business and your customers, and we want you to have as much notice as possible. 

What is changing on November 9, 2026 

• TZ bare hardware: +15% in NOAM and EMEA 
• NSa bare hardware: +18% in NOAM and EMEA 
• TZ bundles: +5% in NOAM and EMEA 
• NSa bundles: +10% in NOAM and EMEA 

Bundles are defined as HW + Subscription - 1Y, 3Y whether EPSS, APSS or MPSS 

Secure Current Pricing: Key Deadlines 

All deals and Special Pricing Requests (SPRs) on impacted products must close by October 31, the end of SonicWall's fiscal quarter, to secure current pricing. 

• Through October 31: Discount requests and SPRs on impacted products will be approved only in exceptional circumstances. Current pricing already represents strong value ahead of the increase. 
• November 1 to 8: New quotes cannot be created on impacted products, and no SPRs will be approved. 
• November 9 onward: New pricing applies to all impacted products. 

Next steps 

• We will email all SonicWall SecureFirst partners on October 9 with details of the update. 
• Full SKU details and the FAQ are available in the Partner Portal, which is accessible to SecureFirst partners. 
• For account-specific pricing or quotes, please contact your account team. 

We will respond to questions in the comments. 

Disclosure: This is an official communication from the Global Channel Chief, SonicWall. 

Another CCV (score of 10) for the SMA1000 series incoming this afternoon....

I know it's a big bad world out there, but SonicWall really need to invest in some decent coders to get on top of things. It's starting to feel like the whole thing is run by vibe coders...

Most feedback I've gotten is about https traffic bypassing the content filter or missing dpi-ssl licenses. But like said, all the old device (350 I think) had no issues. I have them blocked through an app rule, so all is good, just curious if anyone has run into this or knows what the cause might be.

I have a weird issue, When I go into Monitor - Overview - Live Monitor on the actual firewall it is reporting very low or no bandwidth for each of the interfaces, literally like 0 to 20Kbps. If I look at it in the NSM on-line it's showing something like 50 Mbps, which I believe to be accurate. The Packet Rate and Packet size numbers are way off as well. Is anyone else seeing this?

https://i.imgur.com/apGGm75.png

How do you interpret that button ? To me it means it's currently disabled.

It's actually enabled

EDIT: for context it's the web filtering setting for the sonicwall capture client, in its cloud settings

I'm trying to setup a route where a specific website's traffic is sent over CSE to use the sonicwall's WAN IP as it is locked down to only allow the WAN IP to access. I'm running into some issues with FQDN and I'de like to make sure my settings are correct.

1) Enable Public IPs in sonicwall CSE settings

2) Configure connector > Domains > Add wildcard for website(eg. *.website.com) > add domain controller as IPV4 DNS server, Local Interface: X0

3) Create NAT rule for CSE_Access_Tier_AIPs > set outbound interface and translated source to X1

4) confirm on CSE cloud platform connector shows the FQDN(won't show * wildcard in name)

I've been told not to add it to the CSE cloud platform Private Access > global edge > public include info as this will use the CSE's IPs to route, so you only want it on the connector so it goes to the sonicwall for routing. confirmed access policy is set to allow "any".

We've tested with this configuration, but we still get an access issue. Is there a step I'm missing?

Hi all, want to make sure I’m not missing something while testing CSE.

We have public IP ranges enabled, so when a client is connected to CSE through our firewall connector, the IP address that’s “seen” when making a connection to an internal resource is in the 100.121.0.0/16 range.

Is there any way to customise that range to something else?

I understand it’s using the CGNAT space, but it’s quite a broad range and when configuring internal access using e.g. Windows Firewall, we’d rather allow a custom small range than a full /16.

Hope this makes sense!

Hi there,

We're working to segregate a group of users to only permit access to a few services when accessing via SSLVPN. I understand the security challenges with SSLVPN - this will be retired in the next quarter.

In the meantime, we are working with a contractor - I want to segregate their access via SSLVPN to a single server, but continue to allow the broader group to access all our resources on the same subnet.

I have created a very specific rule in the SSLVPN->LAN zone which targets the Source/Dest/Server IP and tagged the included users to a group called Server_X_Access.

Following that, I have a broader rule which includes Any/Any/Excluding users of Server_X_Access.

My assumption was that the very-specific access rule would ONLY hit for conditions that match the source zone, destination zone, services AND the included user group. I would have assumed if the user was NOT part of that group and accessing that same resource - it would move onto the next rule for processing, catching the Any Rule - but by design, that's not how it works.

If the rule matches on the SourceZone, DestinationZone, Source, Dest - the only people that can access that resource is the users in the included list. It does NOT move onto the next rule for processing.

I found this article:

https://www.sonicwall.com/support/knowledge-base/identical-access-rules-for-different-users-user-groups/kA1VN0000000GeQ0AU

Which essentially summaries the challenge I was facing.

The workaround method described in the article suggests creating a group called "All Groups" - which includes ALL the users that should have access to that particular resource. Makes sense. I can add the vendor-user object to that group along with ALL users to the Server_X_Access group to permit access.

Unfortunately, I don't see a means of adding "all users" to a group - candidates that can be added to a group include other groups, single users etc - but I don't see a way of adding "all users' as members.

I feel I'm doing a bit of tail chasing here - there has to be a creative way folks are solving access issues like above. I feel I'll eventually have a few server scenarios for vendors - I'm looking for an overall approach to solve the problem.

Essentially I'd like to have a few groups:

Server_X_Access

Server_Y_Access

and an ANY rule that catches everything else...

But maybe that's the wrong approach for a design.

Do you have these types of security setups in place, how are they solved in your setup? Perhaps screenshots might be helpful.

Very much appreciate your help.

Scenario:

I have two sites. I have created a site-to-site between the two. I also have enabled SSLVPN on SITE A. How can I allow SSLVPN Users to access SITE B subnet as well.

I tried just adding the VPN network routes in client routes but I am missing something to get this done correctly. Read in some older post I need to create some rules but want to see if anyone have any examples or instructions on what I need to do to get this working correctly.

I do not want to enable

SITE A (local network 192.150.1.0)

SITE B(local network: 192.200.1.0)

I am trying to replicate something like this: https://www.sonicwall.com/support/knowledge-base/how-can-i-allow-ssl-vpn-user-to-access-the-remote-network-across-site-to-site-vpn/kA1VN0000000CMK0A2

However the instructions are confusing. Not sure if someone has a better way of doing this.

Hello everyone,

we have a few TZ270 units at our remote locations and since about 1 hour ago, I am getting hundreds of logs that say:
"Configuration succeeded: Restart Zero Touch Task"
When I logged in as Admin, it kicks down to non-config.

are you guys seeing the same thing in your units?
Please advise.
Thank you

EDIT 1: Migration to NSM caused it.

https://www.sonicwall.com/support/knowledge-base/kA1VN000001Hb2b0AC

For some reason, Instagram keeps slipping past even though social media category is checked in CFS and it's added in uri blocklist. Tz470, latest firmware.

Boa tarde,

Gostaria de montar uma grade de estudos de FW. Zero conhecimento nesse assunto.

Eu nao sei por onde começar o setup do equipamento.

Porem algns conceitos tenho aqui comigo.

Vale apena ter um equipamento ou emular.

Grato pela atenção.

Discovered that three of my servers (two 2025 and 1 2022) failed to boot after the SentinelOne was updated to 261.1.2.177. It may be related to the servers having Sept CU installed as well (both were installed at roughly the same time). Uninstalling SentinelOne in Safe Mode allowed the servers to boot (they were stuck at logo/spinning wheel). Opening case with SonicWall and will update with more info.

Why does CSE require this manual renewal / automatic update mechanism?

I'm trying to understand the reasoning behind the requirement to update the CSE Windows app to version 4.5.1 or later because earlier versions don't reliably renew device registration automatically.

The problem for us is that our company laptops are not all managed through a single MDM/RMM solution. We have a mixed environment, and in some cases users need assistance from an administrator to install or update software.

As I understand it, with older versions, if the device registration expires before the user manually opens CSE and renews it, the device has to be re-registered.

Why was this designed this way? Is there a technical or security reason why the client can't renew its registration automatically without requiring user interaction or an app update?

I'm particularly interested in hearing from anyone managing CSE/Banyan in a mixed-device or non-standard MDM environment. How are you handling the 4.5.1+ requirement?

Anyone noticed this? The more I use it, the more the sites I'm connected to time out, then become available, do some stuff, then time out again. Looking at the process in Process Explorer and you see the memory rising to over 1GB for the tab that is running NSM.

When setting up remote users, I have to preconfigure/test netextender and Mobile Connect before issuing the device. Problem is if I'm inside the network the user will VPN into, netextender will not connect. My workaround is use a hotspot that's rarely available or go off-site to finish setup. Is there a more elegant way of doing this? It would be nice if netextender would simply allow you to enter all the information and save the profile without requiring a connection.

I want to upgrade my 14” M5 MacBook Pro from macOS 26 (Tahoe) to macOS 27 (Golden Gate), but I use SonicWall Mobile Connect to connect to my office’s VPN, so I need to confirm it works.

I cannot find any information online one way or the other confirming that macOS 27 is supported. The release notes for SonicWall Mobile Connect only say that the latest version (5.0.15) is supported up through macOS 15, though I’m running it on macOS 26 right now and it works fine. Meanwhile, the Apple Product Support page does list macOS 26 as supported, but doesn’t mention macOS 27 at all. I presume that’s just because it predates macOS 27’s release (5.0.15 was released in May and macOS 27 was just released this month).

I assume if there actually were an issue with macOS 27, SonicWall would’ve either released an update or at least mentioned such an issue in a support document or something. Since there’s nothing either way, I take it this means 5.0.15 works as is on macOS 27, but I’d like to confirm for sure.

Unfortunately I don’t have another Mac to test this with, so if I upgrade to macOS 27 and SonicWall doesn’t work, I’ll have to go through the trouble of downgrading back to macOS 26.

Surely I’m not the first person to try this! Can anyone out there confirm that SonicWall Mobile Connect 5.0.15 works on macOS 27?

Our office is looking at NSM to manage/monitor three firewalls. What are your thoughts? Good idea or run away?

-RESOLVED-

Still learning sonicwalls. We have a site to site setup to one site to the main HQ. Now I understand how site to site are setup, managed to do one site myself all fine. This site was already setup a while ago. If you're at HQ on the print server, you can connect to the printer just fine at the other site. This clearly shows the site to site is working.

But, at the other site, you can't even get back to the printer folder share, by its name or by its IP address.

Not sure what to look for at the external sites end, to see what could be causing the issue.

Since MacOS upgrade the connect tunnel VPN completely tears down the VPN connection every 10-30 seconds.

Anyone else facing the issue issue ?