Firmware Auto Update Feature in SonicWall

Keeping your SonicWall firewall firmware up to date is one of the most critical steps you can take to protect your network. Outdated firmware can expose your organization to known security vulnerabilities that attackers actively exploit.

SonicOS 7 (version 7.1.1 and later) and SonicOS 8 (8.0.0 and later) include an Automatic Firmware Upgrade feature that handles the entire update lifecycle for you:

Note: Starting with SonicOS 7.3.0, automatic firmware updates are enabled by default for new out‑of‑box setups. For existing deployments, users are prompted on first login to choose whether to enable automatic updates when upgrading from version 7.2.1 and higher.

This behavior mirrors the SonicOS 8 experience, where automatic updates were enabled by default starting with version 8.0.0, and SonicWall provided a pop‑up during the first login, allowing users to modify this setting.

Summary

 Note: NSM 3.5 & above supports automatic updates for NSM-managed firewalls running SonicOS 7.3.0 and later images.

How It Works

Your SonicWall firewall communicates with the SonicWall Update Server to check whether a newer firmware version is available. The check is tailored to your specific appliance based on its serial number, current firmware version, and update selections.

Updates flow through four automatic stages:

Tip: Your firewall must have outbound internet access (or a routed path to the SonicWall Update Server) for this feature to work. The appliance also must be registered on MySonicWall - unregistered firewalls cannot download updates. 

Understanding Update Selections (Release Channels)

The Update Selection (release channel) controls which firmware stream your appliance subscribes to. Choosing the right channel ensures you receive the updates that are appropriate for your environment.

Note: Customers are recommended to use the Default update selection to stay current with all improvements. 

Default Settings

The table below shows how the auto-update feature is configured on a new SonicOS 7.3.0  and 8.0 or later deployments. For appliances upgraded from an earlier version, some settings may differ until you configure them.

Configuring Auto-Update in the GUI

All auto-update settings are available in a single location in the SonicOS management interface.

Open the Firmware Auto-Update Settings

• Log in to the SonicOS management interface.
• Navigate to Device | Firmware & Settings.
• Click the Settings tab, then select the Firmware Auto-Update sub-tab.

Configure Update Checking and Download

Configure Automatic Installation (Recommended)

• On the Firmware Auto-Update tab, enable Automatic Firmware Installation.
• Review the Firmware Install Hours schedule. The default is Saturday from 1:00 AM to 2:00 AM based upon the firewalls configured time zone.
• To change the maintenance window, go to Object | Match Objects | Schedules and edit the Firmware Install Hours schedule object.
  

Caution: Reboot Required: Firmware installation requires the firewall to reboot. Plan your maintenance window for low-traffic hours to minimize impact on users and connected devices.

Using the Firmware Update Notification

The SonicOS management interface displays a firmware update notification icon in the top-right corner. The icon state changes to alert you when action is available. Clicking the notification icon opens a status panel with a context-aware action button:

High Availability (HA) Deployments

If your SonicWall is deployed in an HA pair, the auto-update feature is designed to work seamlessly without any additional configuration:

• The active firewall handles all firmware checks, downloads, and installations.
• Auto-update configuration is automatically synchronized from the active unit to the standby unit through the standard HA sync mechanism.
• The standby unit does not independently check for or download updates, preventing duplicate operations.

Note: HA behavior is fully automatic. Simply configure auto-update on the active firewall and both units will stay in sync.

Frequently Asked Questions

• Will the firewall reboot during an automatic installation?
  Yes, installing new firmware requires a full reboot of the appliance. The default maintenance window (Saturday, 1:00 AM – 2:00 AM) is chosen to minimize disruption.
   Note: This time window follows the firewall’s configured system time zone. You can change this schedule at any time under Object | Match Objects | Schedules.
• Can I still install firmware manually?
  Yes. Once a firmware image is downloaded (automatically or manually), it appears on the Device > Firmware & Settings page and can be installed at any time, just as you would install a firmware image obtained from MySonicWall.
• What happens if the firewall loses connectivity during a download?
  The download will be interrupted. The appliance will automatically attempt the download again on the next scheduled check cycle. No manual intervention is needed.
• Does auto-update work if I manage my firewall through Network Security Manager (NSM)?
  The firewall’s built-in auto-update feature and NSM-managed firmware updates operate independently. If you use NSM to push firmware updates, we recommend reviewing the NSM documentation and aligning your update strategy to avoid conflicts.
• Do I need an active support license for auto-update to work?
  Your firewall must be registered on MySonicWall to download firmware from the Update Server. If your support contract has lapsed, you may see a notification in the interface indicating that the feature is limited. Contact SonicWall Support or your reseller to renew your service agreement.
• What is the difference between a new (greenfield) and existing (brownfield) deployment?
  Greenfield deployment: A brand-new firewall running SonicOS 7.3.0, 8.0.0 or later straight from the factory. Auto-update is enabled by default.
  Brownfield deployment: An existing firewall that has been upgraded to SonicOS 7.3.0 or 8.0.0 from an earlier version (e.g., 7.2.1). On first login after the upgrade, a prompt will appear asking if you want to enable auto-updates. We recommend enabling it.
•  When will a new firmware version be available in the auto‑update channel?
  New firmware versions are not immediately published to the default update process after release.  SonicWall follows a staged rollout process where firmware is made available for manual download and installation via MySonicWall.  Once all criteria have been reached, the release reaches General Availability (GA) status and is made available to the auto update process.
• Why is there a delay before firmware appears in the auto‑update channel?
  The delay is intentional and helps ensure stability.  SonicWall monitors early adopters (functioning as a canary group) who manually upgrade to the firmware. This allows identification and resolution of any unforeseen issues before broader automatic distribution, reducing risk for customers using the auto update process.
• What criteria are used before enabling firmware in auto‑update?
  While exact thresholds may vary, firmware is typically promoted to auto‑update channels after:
  A sufficient number of firewalls have successfully upgraded manually
  There are no significant or widespread impacting issues reported
  The release demonstrates stability across different deployment scenarios
• Can I install new firmware before it appears in auto‑update?
  Yes. Customers who want early access can manually download and install firmware from MySonicWall at any time, without waiting for it to appear in the auto update process.
• What should I do if I need a fix that is only in a newer firmware version?
  If the required fix is available in a newer firmware version that has not yet been enabled in auto‑update:
  You can manually upgrade to that version
  Alternatively, consult SonicWall Support for guidance on recommended versions for your environment