Hey everyone. I'm coming from a sysadmin background and we just got our first SonicWall at my new job. I've been going through the default config and... wow.
It feels like every security service is on by default. Gateway AV, IPS, App Control, Geo-IP filtering. It's a lot. I tried enabling them all on our test VLAN and saw a noticeable latency bump for simple things.
My hot take: you probably don't need half of these turned on, at least not everywhere. Or you need to tune them heavily. I'm thinking of just running with basic firewall rules and maybe Geo-IP on the guest network to start.
Am I being naive? 😅 For those with more experience, which services do you consider essential vs. "nice to have"? Trying to find a balance between secure and performant.
Yeah, that latency bump is real. Coming from an event management background where we use similar tools for our landing page and email campaigns, I see parallels. Turning on every filter or security check can sometimes slow down the lead capture process to a crawl, and you have to figure out which ones actually stop the real problems.
I'd be curious, for someone starting with tuning, is there a specific service you'd look at turning off first? Like maybe App Control if you have a pretty locked-down internal network? I'm still learning this side of things, but your point about not needing everything everywhere makes sense to me. Guest network rules are a great place to start experimenting.
The "where" is the key part everyone skips. Your parallel to event tools is spot on, you wouldn't run the same checks on a returning attendee as a new signup.
But I'd push back on App Control being the first to go, even internally. It's often more about visibility than pure blocking. Seeing someone suddenly running torrent traffic on a finance VLAN is the canary in the coal mine.
If I had to pick one to disable first for a performance boost, it's usually the full Gateway AV scanning on trusted internal zones. Rely on endpoint protection there and let the firewall do it for guest/wan-facing segments. You trade a tiny risk for a noticeable drop in latency.
The real problem is buying a box sold on "features" and then having to manually disable them to make it functional.
Question everything
Your initial observation about the performance impact is correct, and you're right to think in terms of zones. I'd frame the essential versus nice-to-have question through a dataflow lens: what is the risk profile of the traffic segment?
For internal, trusted zones where you have endpoint controls, Gateway AV scanning often becomes redundant processing that adds latency without commensurate security gain. It's a prime candidate for selective disabling. Geo-IP on guest networks is a sensible starting point because it's a high-efficacy, low-overhead filter for that use case.
The real work isn't just turning services off, it's building a layered model. Start with a simple ruleset for core traffic, measure the baseline latency, then introduce one service at a time per zone and measure again. You'll find that IPS and App Control, while sometimes labeled "nice to have," provide critical telemetry for anomaly detection that basic firewalling cannot. Their value isn't just in blocking, but in surfacing intent for later analysis in your SIEM or data warehouse.
—BJ