Alright, night shift crew, I've been babysitting a pair of NSA 2700s for about a year and a half now. Management bought them for "enterprise-grade security" and "deep packet inspection." My experience? It's been... an education.
The good? The hardware is solid. It hasn't fallen over once. Basic firewall and VPN (SSL and Global VPN Client) work exactly as advertised. The physical build feels like a tank, which is nice when you're staring at it at 3 AM.
The *reality*? The management experience is where the fun begins.
* The GUI feels like it's from a different era. Clunky, slow to respond, and navigating to a simple setting sometimes feels like a treasure hunt.
* Want to do anything moderately complex via CLI? Good luck. The command structure is its own unique snowflake. It's not Cisco, it's not Juniper. Example: just trying to consistently filter logs from the CLI for an automated alert was a multi-night project.
```shell
# This isn't real, but it captures the vibe
sonicwall> show logs security-events filter-by="threat level gt 3" and "time since 'yesterday'"
# Error: Invalid filter syntax. Refer to guide chapter 7, section 12.
```
* The "advanced" security features (like Capture ATP) come with a performance tax that wasn't fully clear on the datasheet. Turn it all on and watch your throughput numbers cry. We had to carefully pick which traffic profiles got the full inspection treatment.
* Firmware upgrades? Always a pucker moment. The release notes are vague, and I've had features subtly break twice. My process now is a full config backup, a prayer, and scheduling it for a time when I'm already on shift.
For a straightforward firewall/VPN box, it's fine. But if your stack is modern—think API-driven, infrastructure-as-code, automated incident response—this thing feels like an island. Terraform support? Forget it. You're manually clicking or writing custom scripts against their... interesting... API.
Would I buy it again? For a simple edge device, maybe. For anything needing to integrate into a DevOps/SRE workflow, I'd be looking elsewhere. The friction cost in automation and management time is real.
Pager duty survivor.
NightOps
Your point about the CLI log filtering hits home. I spent a week trying to get consistent, parsable security event logs out of our 2700 for our SIEM ingestion. The syntax feels arbitrary, and the documentation assumes you're working interactively on the box, not trying to extract data for automated processing.
The audit trail itself, once you finally get it, is surprisingly verbose for certain things like configuration changes but then oddly opaque for threat detection events. Trying to tie a specific blocked connection to a DPI rule later for a compliance report became a manual cross-reference job with the GUI.
Did you find a workaround for the log export, or did you just give up and use the built-in reporting for management? I ended up using a scheduled syslog forward for everything and then filtering aggressively on the SIEM side, which is far from ideal.
Logs don't lie.