SonicOS 8.2.3 Security: Secure from Day One

Phase 2 of Secure by Default, Secure by Design brings six more secure defaults, application-aware policy for SaaS and AI, Security Insights on the firewall, and stronger protection for the firewall itself.

This is part 1 of 2. Part 2 covers the networking features in SonicOS 8.2.3: resilient routing, Hybrid SD-WAN, OAuth 2.0 alert email and the custom captive portal.

What are the security features in SonicOS 8.2.3?

SonicOS 8.2.3 enables six more security settings by default on new deployments, introduces SaaS and AI application objects for application-aware policy, adds a Security Score and issue list through Security Insights, extends Intrusion Prevention to traffic addressed to the firewall, and encrypts configuration backups.

Security should not be something you have to switch on. It should be in place from the moment a firewall goes into service. We set ourselves a simple test: a new firewall should be well protected before anyone works through a configuration checklist, and it should show its administrator clearly what to improve next.

 

What are the new secure defaults in SonicOS 8.2.3?

Phase 2 of Secure by Default: protection that starts switched on

In SonicOS 8.2.2, Phase 1 made core security services part of deployment. Gateway Anti-Virus, Anti-Spyware, Intrusion Prevention, Botnet Filtering and Geo-IP Filtering are enabled automatically when a new firewall is registered.

SonicOS 8.2.3 goes further. On new deployments, six more settings now start in their secure state:

• Stealth Mode: the firewall does not respond to blocked inbound requests, so it is harder to discover.
• IP ID randomization: randomized IP identification values make the firewall harder to fingerprint.
• Discard by default: default inbound deny rules drop unwanted traffic silently, without a TCP reset or an ICMP unreachable message that could help someone map your network.
• SSL Control: the firewall inspects SSL and TLS handshakes from the start (Gen 8 hardware firewalls).
• Administrator two-factor authentication: administrators are guided to enroll in time-based one-time password (TOTP) authentication at first login, which reduces the risk from stolen credentials.
• MFA alerting for SSL VPN users: advisory alerts help bring remote access users onto multi-factor authentication, without blocking any connection.

What happens to firewalls already in production?

We made a deliberate choice here. Upgrading to SonicOS 8.2.3 keeps the existing configuration of firewalls in production. Instead of changing settings, SonicOS gives administrators recommendations, and Security Insights shows where the configuration can be strengthened.

For partners: every new deployment starts from the same strong baseline, and existing customers have a clear, low-risk path to reach it.

How do SaaS and AI application objects improve policy?

Application-aware policy for SaaS and AI

Seeing applications is useful. Acting on them is where the value lies.

SonicOS 8.2.3 introduces SaaS and AI application objects, which use IP-to-application mapping to identify widely used cloud and AI applications, such as Microsoft 365, Amazon Web Services and Google Cloud Platform. The objects stay current through Cloud Sync with the SonicWall cloud database, and you apply them through SaaS & AI Application Groups in access rules, route policies and SD-WAN rules.

Because matching uses the destination IP address, the firewall can act on the first packet of a connection, including the choice of SD-WAN path. Traffic to business-critical SaaS services takes the right route from the start.

What is Security Insights in SonicOS?

Know where you stand with a Security Score

Turning protections on is only half the job. Administrators also need to know what is in force, what is missing and what to do next.

Security Insights brings that view onto the firewall. It calculates a Security Score and lists issues in order of severity: protections that are disabled, absent or weaker than recommended, and management exposure such as HTTPS management on a WAN interface. Each issue has a How to Fix view that explains the remediation and takes you to the right settings page. The score updates every 60 minutes, or on demand with Refresh. Security Insights is available on firewalls running in Classic Mode.

For organizations and partners that manage many firewalls, Security Insights in NSM extends the view across the fleet. For firewalls with an eligible NSM license, it assigns each firewall a risk score, tracks posture drift over time and prioritizes remediation.

For partners: Security Insights turns posture reviews into a repeatable customer conversation: here is the score, here is what to fix, and here is the result.

 

Protecting the Blueprint of Your Network: Encrypted Configuration Backups

Configuration backups deserve the same care, because they describe your network, your rules and your users. SonicOS 8.2.3 adds AES-256-GCM encryption for configuration exports, protected by a password that must meet your password policy. Exporting without encryption requires an explicit acknowledgment of the risk, and FIPS mode allows encrypted exports only. Keep the password safe, because it cannot be recovered.

Before you upgrade to SonicOS 8.2.3

SonicOS 8.2.3 runs on SonicWall Gen 8 firewalls: the TZ80 through TZ680, the NSa 2800 through NSa 6800, and NSv virtual firewalls.

• Read the release notes, including the known issues and upgrade guidance.
• Remember that Phase 2 defaults apply to new deployments. Upgraded firewalls keep their existing settings.
• If you manage your firewalls with NSM, use NSM 4.5.0, which is available alongside SonicOS 8.2.3.

Frequently asked questions

How does SonicOS 8.2.3 identify SaaS and AI applications?

SaaS and AI application objects use IP-to-application mapping and stay current through Cloud Sync with the SonicWall cloud database.

 

Does upgrading change my existing firewall settings?

No. Upgraded firewalls keep their existing configuration. SonicOS provides recommendations, and Security Insights shows where the configuration can be strengthened.

 

How often does the Security Score update?

The Security Score updates every 60 minutes, or on demand with Refresh. Security Insights is available on firewalls running in Classic Mode.

Are configuration backups encrypted in SonicOS 8.2.3?

Yes. SonicOS 8.2.3 adds AES-256-GCM encryption for configuration exports. Exporting without encryption requires an explicit acknowledgment of the risk, and FIPS mode allows encrypted exports only.

Which firewalls support SonicOS 8.2.3?

SonicOS 8.2.3 runs on SonicWall Gen 8 firewalls: the TZ80 through TZ680, the NSa 2800 through NSa 6800, and NSv virtual firewalls.

Moving security forward

Cybersecurity does not stand still. With SonicOS 8.2.3, security is on from the start, policy follows the applications that matter, and administrators can see exactly what to improve next. Read part 2 of this series to see how the same release helps your network adapt to the way you work.

SonicOS 8.2.3 and NSM 4.5.0 are now available. Review the SonicOS 8.2.3 release notes for the full list of enhancements, supported platforms and upgrade considerations, download the firmware from MySonicWall, and talk to your SonicWall partner or account team about what this release can do for your network.

SonicOS 8.2.3: Stronger security by default. Smarter application-aware policy.

Next steps

• Download: Get SonicOS 8.2.3 from MySonicWall.
• Plan: Read the SonicOS 8.2.3 release notes, including the known issues and upgrade guidance, before you upgrade.
• Check your posture: Open Security Insights on your firewall to see your Security Score and what to fix first.
• Apply policy: Create your first SaaS & AI Application Group and apply it to an access rule.
• Manage at scale: Ask your SonicWall partner or account team about NSM 4.5.0 and fleet-wide risk scores.
• Partners: Use the Security Score in your next customer posture review.
• Keep reading: Read Part 2 to see how SonicOS 8.2.3 improves routing and SD-WAN.