6

We're looking to move away from PFSense and CARP to a pair of SonicWall NSA 24001 configured in Active/Passive for High Availability.

I've never dealt with SonicWall before, so is there anything I should know that their sales guy won't tell me?

I'm aware that they had an issue with a lot of their devices shutting down connectivity because of a licensing fault, and they have an overtly complex management GUI (on the older devices at least), but are there any other big "gotchas" that I need to be aware of before committing a not insubstantial amount of money towards these devices?

1If you're outside the US, the SonicWall global sites suck balls. Use the US site for all your product research, and then use your local site when you're after local information.

Improve this question

4 Answers 4

Reset to default
6

I've been very happy with HA on all the sonicwall models we've used. The closest match to your setup is a pair of NSA 4500s in our primary datacenter. Once setup, HA has been rock solid. The one item I'd note is be sure to setup individual management IPs in the HA setup. It allows you to log in to the standby firewall without affecting the primary (staging firmware updates, for example).

Improve this answer
4
  • In SonicOS Enhanced, the HA pair are an exact copy of one another. Any changes (including firmware upgrades) that are made on the primary are immediately replicated to the second. So essentially if you create a management IP on the standby unit, it'll be undone once you pair the two and the configurations sync. Am I wrong?
    – Safado
    Jun 30, 2011 at 19:24
  • 2
    You are correct. The management IPs are part of the HA configuration (HA->Monitoring). It's here where you can assign separate IP addresses for the Primary and Backup units. There isn't a separate configuration on the backup unit. This simply allows you to log into the standby device if necessary. It's also used for probe monitoring.
    – Jim G.
    Jun 30, 2011 at 21:27
  • 1
    +1 - I agree all-around. The SonicWall devices are amazingly flexible and very stable. We have pairs of NSA 4500s around our network and hand out TZ 100s to our remote/home-office employees for an auto-VPN tunnel. So far, they have never let us down and are quite simple to configure.
    – Cypher
    Jun 30, 2011 at 21:43
  • Oh, so that's what that is! +1 for the heads up.
    – Safado
    Jun 30, 2011 at 22:37
3

In addition to what has already been mentioned, might I add a little something about their IPS and content filtering.

I don't know what you have planned for the SonicWalls, but our gateway router into our building is an NSA 3500. We're a company of about 85 users. We have licenses for the Content Filtering System, Intrusion Prevention, and the Application Flow Monitor, which are all superb. I can check how much of our bandwidth is going to Pandora or youtube, I can see what files are leaving the building. If I pull up the logs and I see that a user is using bittorrent, I can kill the session and block future bittorrent traffic in two clicks. For bandwidth management and security, it's great.

We also have SonicWalls in our remote shipping office and at our colocation where our production servers reside. We have VPN tunnels (site-to-site) between the three sites and it's ridiculously easy to configure. At our colocation is where we have two nsa 3500's in an HA pair. We did a few failover tests when we first set them up and we haven't had to worry about the pair since. We're also looking into licensing the HA pair with Intrusion Prevention, which will detect brute force attacks, sql injection attempts, etc., with what they call their "deep packet inspection" engine.

I've been more than satisfied with our SonicWalls.

Some things to look out for, however, is the licensing. Sometimes it feels like they're taking every penny you have each time you add a feature. I believe the only licensing you have to worry about with HA is if you want it to be a stateful failover. If this is licensed, any connections to your primary sonicwall will be there and ready on the backup in the event of a failover and any existing connections won't be interrupted. I think that's it though.

Improve this answer
1
  • Good to know. We have looked at their DPI and content options, but we have no immediate use for them as we have a Microsoft TMG firewall that sits behind the edge gateway that does all that stuff for us. I concur regarding the licensing, but it's fairly standard at that end of the market. Cisco are just as bad.
    – Mark Henderson
    Jul 1, 2011 at 0:33
3

A major gotcha with SonicWalls is currently IPv6 support. There is exactly one semi-supported release of SonicOS (5.5.6) that has any IPv6 features available at all. All later releases (5.8.x is current) have no IPv6 support whatsoever. Downgrades are not supported without rebuilding all of your confiugration. This is level of IPv6 support rediculous at this late date, and you shouldn't buy anything new from Sonicwall until they have IPv6 support in general supported release with reasonable feature parity.

We're pretty happy with our NSA4500 and NSA2400 pairs otherwise, HA works as advertised, as does the load balancing from multiple ISPs. The CLI functioanlity stinks, but the SonicOS Enhanced web GUI is better than just about any other firewall I've encountered. Configuration files are binary blobs, so you cannot edit them with anything besides the GUI. Just use good version control, and export your configuration blobs to SVN, Git, or whatever after every change.

Improve this answer
4
  • FYI, nearly a full year later, and the ancient 5.5.6 "feature" release is still the only IPv6 support available from Sonicwall. I am signed up for the beta channel, and they still do not even have a beta release of newer firmware that includes IPv6 support. They are promising it for 5.9 however, "in the near future", which they've been saying for years.
    – rmalayter
    Jan 18, 2013 at 17:30
  • As of May 2013 that 5.9 ipv6 supported firmware has yet to be released. I sure hope the reason its taking so long is they want a bug free product.
    – user172302
    May 3, 2013 at 15:54
  • Latest Sonicwall NSA 4500 Firmware 5.9.0.2 release notes. It supports IPv6. software.sonicwall.com/Firmware/Documentation/…
    – user204947
    Jan 9, 2014 at 16:58
  • @bob_i Looks like lots of features are disabled for IPv6 in 5.9.x... any experience with it personally? We're considering it, but of course we now have only one HA pair of firewalls at each location so no way to test reasonably. I don't think they offer a VM-based version for testing in the NSA series (although they have them for other Sonicwall appliances).
    – rmalayter
    Apr 18, 2014 at 13:04
0

I've had VoIP issues with a NSA 4500 - lots of out-of-sequence packets. Their version of QoS (called Bandwidth Management) was implemented for the SIP traffic but even a support call got nowhere. I finally just put our SIP vendor's box outside of the 4500 and the problem vanished. A quick google search will show that it's a pretty common problem. If you're going to run VoIP through it, you may want to look for a different solution.

Improve this answer
1
  • 1
    Just a different POV - I was told the same thing. VoIP won't work. The trouble was I already had a sonicwall NSA 2400 and 3CX phone system. It took a little extra tinkering but it's been working fine for over a year now. 170 phones
    – IMAbev
    Jul 15, 2013 at 14:35

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .