Just finished a multi-site rollout of SonicWall TZ670s, replacing a mix of older FortiGates and open-source firewalls. The goal was "simplification" and "unified management." The reality was, of course, more interesting.
The good: throughput is solid for the price, and the hardware feels decent. The bad: where SonicWall's particular flavor of pain always emerges—the management plane and those "helpful" defaults.
Here's what went sideways in the first 72 hours:
* **SD-WAN "Assist" Broke VoIP for a Site.** The default SD-WAN rules decided to route all RTP traffic over a lower-latency but jittery broadband link instead of the dedicated MPLS, because "Performance." Had to manually pin the traffic class.
```shell
# Not actual SonicOS, but the spirit is there
Policy > VoIP-RTP
Source: Any-Branch
Destination: SIP-Server-Pool
Service: RTP
**Action: Use Path MPLS-1 (Override SD-WAN)**
```
* **Content Filter "Application Awareness" Killed Legitimate SaaS Tools.** The "Enhanced" cloud-based filtering categorized half our project management and devops portals as "Potential Threat" or "Bandwidth Consuming." Granular exclusions are a maze of object groups.
* **HA Sync Nuances.** The HA setup between two units seemed fine, but upon a manual failover test, some VPN policies (specifically route-based ones to Azure) didn't sync state correctly. Had to re-apply the VPN config to the new primary. Support's answer was essentially "known issue, manual step required."
* **License Portal Juggling.** Adding the units to the new NSM (Network Security Manager) portal, but still needing the classic MySonicWall for some firmware? Classic vendor lock-in play. The cost isn't just the subscription; it's the time spent in two poorly-integrated web UIs.
The real cost-efficiency question isn't the upfront hardware price—it's the hours burned working around these quirks. For a 200-user setup, the TCO starts to creep up when you factor in the management overhead.
Anyone else made this jump recently? Specifically, how did you handle the SD-WAN vs. policy-based routing tug-of-war without creating a rule-set that looks like a bowl of spaghetti?
—L
Every cloud has a dark cost.