Hi everyone. First post here, been lurking for a bit. I'm helping a friend's retail business (about 100 users across 5 stores) with their network upgrade. They handle credit cards in-store, so PCI compliance is a must-have.
We're looking at next-gen firewalls and have it narrowed to SonicWall and Sophos. I've mostly done helpdesk and basic SaaS setups, so this is a step up for me. Need something reliable and manageable. Anyone have real-world experience with either in a similar PCI retail setup? Main concerns are keeping the compliance piece straightforward and handling the traffic between stores reliably. Budget is a factor, but security comes first here.
For PCI, the built-in compliance reporting in both vendors is helpful, but check the ongoing license costs. SonicWall tends to bundle more features into its base NGFW license, while Sophos often uses more modular add-ons. This can make year-two costs unpredictable if you aren't careful.
In your 5-store setup, consider the management overhead. Sophos Central is cloud-managed and works well for distributed locations. SonicWall's NSM is similar but feels more oriented toward on-prem management. For someone moving up from SaaS setups, the cloud console might reduce the learning curve.
Both will handle the traffic reliably. The real test is the PCI audit process itself. Have you asked each vendor for their specific PCI-DSS compliance guide? They usually have a document mapping each requirement to a firewall feature or report. That's what makes the process straightforward.
Less spend, more headroom.
That's a solid point about the year two costs. I was just looking at a Sophos quote, and I think they call the add-ons "Xtend" modules? The base looked good, but adding things like enhanced logging for PCI felt like it could creep up.
Do you know if SonicWall's bundle includes the specific PCI logging reports, or is that an extra too? Asking the vendors for that compliance guide like you said is my next step for sure.
The cloud console for Sophos is appealing since I'm used to that type of interface. How steep is the learning curve for SonicWall's NSM if you're coming from a cloud-first background?
Learning by breaking
That compliance guide document is often a marketing piece, not an operational one. It maps features to requirements, sure, but it conveniently ignores the configuration complexity and ongoing validation needed on your end. You'll still spend weeks building policy sets and proving to a QSA that the box is actually doing what the brochure says it does.
The real unpredictability isn't just year-two licensing costs. It's the year-two configuration drift and the cost of your time during an audit when you have to prove a "bundled" feature was configured correctly twelve months ago. A cloud console doesn't fix that, it just moves the management headache to a different URL.
Have you actually tried getting a straight answer from either vendor on what their "straightforward process" entails when your auditor asks for a specific log query from six months prior? The sales teams are always vague until you're locked in.
Skeptic by default