Overview
This document contains three main sections containment, remediation and monitoring. Containment reduces the risk of an exposed firewall configuration being leveraged to gain access to the network. Remediation is the process of reconfiguring potentially exposed secrets and passwords. Monitoring will identify potential threat activity.
This article outlines the essential steps required to reset the credentials of commonly used features in SonicOS which may be configured to be accessible via the internet. These remediation steps include links to other resources such as KB articles and Admin Guides with step-by-step directions for resetting various passwords, shared secrets, encryption keys, and TOTP bindings across SonicOS.
Begin with the Containment section below. Once containment is complete, you can proceed to the Remediation IF/THEN section to determine the recommended steps based on the features enabled on the target firewall.
It is very important that containment is done before moving on to the remediation steps.
Disabling or restricting access to the SSLVPN Service and Web/SSH Management over the WAN to known addresses helps to ensure that an attacker is unable to regain access to compromised user accounts after forcing a password change and/or resetting TOTP bindings. Additionally, due to the dependencies associated with changing passwords and shared secrets, it is also important to update the password in other relevant locations. Such locations may include, but are not limited to, the remote IPSec Gateways/peer VPN endpoints, LDAP/RADIUS servers, wireless clients, dynamic DNS providers, etc.
SonicOS 6.5.5.1 and 7.3.0 also contain enhancements that allow an administrator to restrict a user account’s access until the password has been changed, ensuring that users change their password from within the perimeter if desired. In the absence of this feature, disabling or restricting access from the WAN is the most effective course of action.
Disabling or restricting inbound access from the WAN to internal services can prevent any threat actor from regaining access to any potentially compromised systems.
Disabling Access

Alternatively, you can limit access to only known/trusted IP addresses if you are unable to disable management over the WAN completely. Refer to the KB article titled How can I enable or disable SonicWall firewall management access? for step-by-step instructions on restricting management access.
Alternatively, you can limit access to SSLVPN services to only known/trusted IP addresses if you are unable to disable SSLVPN completely. Refer to the KB article titled How to Disable Virtual Office Portal Access for step-by-step instructions on restricting SSLVPN access.

Restricting access to IPSec VPN
Alternatively, you can limit IPSec VPN access to only known/trusted IP addresses if you are unable to disable IPSec VPN completely. Refer to the KB article titled How to restrict who can connect through GVC for step-by-step instructions on restricting access.
Disabling or restricting access to internal servers
Below are the brief steps. Refer to the KB titled How can I enable port forwarding and allow access to a server through the SonicWall? (Creating the necessary Firewall Access Rules) for more information.

Disabling SNMP

The following checklist provides a structured approach to ensure all relevant passwords, keys, and secrets are updated consistently. Performing these steps helps maintain security and protect the integrity of your SonicWall environment. The critical items are listed first. All other credentials should be updated at your convenience. Please note that the passwords, shared secrets, and encryption keys configured in SonicOS may also need to be updated elsewhere, such as with the ISP, Dynamic DNS provider, email provider, remote IPSec VPN peer, or LDAP/RADIUS server, just to name a few. Failure to do so can cause Internet and/or VPN outages or disruption to certain services such as authentication, log/alert forwarding, etc.
You may have received communication from SonicWall regarding a new preferences file to import into your firewall. The modified preferences file provided by SonicWall was created from the latest preferences file found in cloud storage. If the latest preferences file does not represent your desired settings, please do not use the file. Instead, please follow the documented instructions for manual remediation. For information on remediation using the provided preferences file, please refer to the Remediation through updated preferences file KB article.
|
Service |
Remediation Step Description |
Critical |
Dependency |
Comments |
|
🚩 |
|
Force all local users to set a new strong password. Resources and brief steps are available in the remediation instructions. | ||
|
|
🚩 |
|
Re-enroll TOTP for all users. Users will need to re-bind their authenticator app. Resources and brief steps are available in the remediation instructions. | |
|
Update the password used for binding LDAP and/or shared secrets for RADIUS/TACACS+ Authentication.
Authentication Methods:
|
🚩 |
Update password on LDAP, RADIUS, or TACACS+ server(s) |
Update the bind account password in LDAP, then update the LDAP server entry in SonicOS. Likewise, update the RADIUS/TACACS+ shared secret on the server and SonicOS. Resources and brief steps are available in the remediation instructions. | |
|
Update the shared secret in all IPSec site-to-site and GroupVPN policies. |
🚩 |
The shared secret must also be updated on the Remote IPSec Gateways/Peer VPN endpoints |
Replace old IPSec VPN pre-shared keys with new values. Do this for all IPSec VPN policies. To minimize disruption impact, ensure that the secret has been shared with the administrator of the remote VPN endpoints. For site-to-site VPNs, the shared key needs to be updated on the remote VPN peer. For GroupVPN, the pre-shared key may need to be shared with IPSec clients if “Simple client provisioning” is disabled in the GroupVPN policy. Resources and brief steps are available in the remediation instructions. | |
|
Update the passwords used for any L2TP/PPPoE/PPTP WAN interfaces. |
🚩 |
Update password with ISP(s) |
Refresh credentials used for WAN interface authentication. Should be done in coordination with the ISP account change to minimize disruption. Resources and brief steps are available in the remediation instructions. | |
|
Follow instructions to reset Cloud Secure edge connector Authentication |
🚩 |
Update CSE API Key |
Follow the instructions to reset the API token used by the CSE connector. | |
|
Update passwords used for routing protocols such as RIP, OSPFv2, and BGP. |
🚩 |
Update the passwords on the associated L3 switches, routers, etc. |
Update the passwords associated with any advanced routing configuration. This should be done in coordination with the changes on the peer devices to minimize disruption. Refer to the following resources for more information: | |
|
AWSAPI |
Update the AWS keys used for Logging and VPN integration. |
|
Update on AWS Console |
Generate new IAM access keys and update them in the SonicWall settings. Refer to this KB article and the SonicOS 7.0 Admin Guide (AWS Configuration) for more information. |
|
|
SNMP monitoring host(s) |
Reset SNMPv3 user credentials to maintain monitoring security. The passwords will also need to be updated on the SNMP monitoring hosts to restore SNMP access. Resources and brief steps are available in the remediation instructions. | ||
|
Update the passwords used for any cellular WWAN connections. |
|
Update password with ISP(s) |
Refresh WWAN account credentials used for backup WAN connections. Should be done in coordination with the ISP account change to minimize disruption. Resources and brief steps are available in the remediation instructions. | |
|
DDNS |
Reset Dynamic DNS provider account password on the provider’s website. Update the DDNS entry in SonicOS. |
|
Update account password with DDNS provider(s) |
Update the password of each DDNS account at the provider’s website. On the firewall, update the password for each DDNS entry. This should be done in coordination with the dynamic DNS account change to minimize disruption to DDNS name resolution. Refer to the KB titled How To Configure Dynamic DNS for a particular Interface for more information. |
|
Clearpass |
Reset passwords to Network Access Control (NAC) Clearpass servers. |
|
Update password on NAC server(s) |
This should be done in coordination with the change to the NAC servers to minimize disruption to the NAC servers. Refer to the KB titled How to add a Clearpass server on a SonicWall firewall for more information. |
|
Email Logs |
Reset the password to email accounts used for Log Automation. |
|
Update password with email provider |
Update email credentials used for log/alert forwarding and OTP emails. This should be done in coordination with the email account update to minimize disruption to email delivery. Refer to this KB article and the SonicOS 7.1 Admin Guide (FTP Log Automation) for more information. |
|
FTP/Web Passwords |
Reset the password to any FTP/HTTPS* servers used for Log automation, Packet Monitor, Settings and TSR scheduled reports, Dynamic External Address Objects/Groups, and Dynamic Botnet List Server. *The Dynamic Botnet List Server supports FTP and HTTPS credentials. |
|
Update password on FTP/HTTPS server(s) used with the listed features of SonicOS |
Reset FTP/HTTPS credentials for automated tasks and reports. These areas include Log automation, Packet Monitor, Settings and TSR scheduled reports, Dynamic External Address Objects/Groups, and Dynamic Botnet List Server. The Dynamic Botnet List Server supports FTP and HTTPS credentials.
Refer to the following resources for more information:
|
|
Extended Switches |
Reset the password for any Dell/SonicWall-integrated external switches managed by the firewall. |
|
|
Update management passwords for integrated switches. Refer to this KB article for more information. |
|
|
Wireless clients |
Rotate WPA/WPA2/WPA3 passphrases and profile keys. Wireless clients will need to update their connection profile. IoT devices may require a manual profile update. Resources and brief steps are available in the remediation instructions. | ||
|
SonicPoint/SonicWave |
Reset SonicPoint/SonicWave L3 SSLVPN Management password. |
|
Update password on the managing SSLVPN server |
Update the password used for SSLVPN management on SonicPoint/SonicWave. This should be done in coordination with the change on the SSLVPN server the access points connect to for L3 management. Refer to the SonicOS 7.0 Admin Guide (Access Point Provisioning Profiles) for more information. |
|
SonicPoint/SonicWave |
Reset SonicPoint/SonicWave Administrator password. |
|
|
Update the password used to access individual SonicPoint/SonicWave access points. Refer to the SonicOS 7.0 Admin Guide (Access Point Provisioning Profiles) for more information. |
|
SonicPoint/SonicWave |
Reset SonicPoint/SonicWave/Internal Wireless RADIUS server shared secrets for Remote MAC Access Control and WPA/WPA2/WPA3/EAP authentication. |
|
Update the shared secret on the RADIUS server |
Rotate RADIUS secrets used for wireless authentication and Remote MAC Access Control. This should be done in coordination with the change on the RADIUS server to minimize disruption. Refer to the following resources for more information: |
|
RADIUS |
Reset the RADIUS server shared secrets used on wireless-type Zone objects. |
|
Update the shared secret on the RADIUS clients and LDAP password on the LDAP server |
Rotate RADIUS secrets and LDAP Identity password in the “Local RADIUS Server” feature in Wireless-type Zone objects. This should be done in coordination with the change on RADIUS clients and the LDAP server. Refer to the SonicOS 7.0 Admin Guide (About Local RADIUS Servers) for more information. |
|
Guest Services |
Reset the shared secret used by the Guest Services External Guest Authentication feature, if Message Authentication is enabled. |
|
Update the shared secret on the web server |
Rotate secrets for guest authentication services if Message Authentication is enabled. This should be done in coordination with the change on the web server that is integrated for External Guest Authentication. Refer to the following KB articles and Admin Guide links for more information: |
|
SSO |
Reset shared secrets used by SSO features such as SSO Agent, Terminal Services Agent (TSA), SSO RADIUS Accounting clients, 3rd Party SSO API. |
|
Update the shared secret on each SSO/TSA server, RA client, and 3rd party SSO API client |
Update secrets across all SSO components. This should be done in coordination with the change on each SSO Agent, Terminal Services Agent, RADIUS Accounting Client, and/or 3rd party SSO API client. Refer to the following KB articles for more information: |
|
Accounting |
Reset RADIUS/TACACS+ shared secrets used for Accounting server entries. |
|
Update the shared secret on the RADIUS/TACACS+ server(s) |
Update authentication secrets for accounting servers. This should be done in coordination with the change on the RADIUS/TACACS+ server(s). Refer to the following resources for more information: |
|
SMTP/POP Appflow |
Reset the password for the SMTP/POP email account used for AppFlow SFR report emails. |
|
Update password with email provider |
Update credentials for AppFlow SFR email reporting. This should be done in coordination with the change at the email provider. Refer to the SonicOS 7.0 Admin Guide (SFR Mailing) for more information. |
|
NTP |
Reset the password for any custom NTP servers. |
|
Update password on NTP server(s) |
Update authentication credentials for custom NTP servers. This should be done in coordination with the change on the NTP server(s). Refer to this KB article and the SonicOS 7.0 Admin Guide (Editing an NTP Server Entry) for more information. |
|
Signature Proxy |
Reset the password for the proxy server used to download signature updates. |
|
Update password on the proxy server |
Rotate the password for the proxy server used to download SonicWall signature updates. This should be done in coordination with the change on the proxy server to minimize disruptions to signature downloads. Refer to the KB titled Signature Downloads Through a Proxy Server for more information. |
|
SSLVPN |
Reset password in all SSLVPN Bookmarks |
|
|
Reset the password associated with each SSLVPN Bookmark created by any user. Refer to the SonicOS 7 Admin Guide for more information. |
|
|
Update keys in GMS |
Update GMS management tunnel encryption keys. Only applicable when the management mode is set to IPSec Management Tunnel. Resources and brief steps are available in the remediation instructions. | ||
|
Follow the instructions to create a new certificate. |
|
|
Replace the re-signing CA in Firewall, download the new CA, push trust to clients, and then decommission the old CA. |
SonicWall provides an online tool to assist in identifying services listed above that require remediation action. Follow the instructions provided in the tool here. (Note UPE Mode is not supported)
To manually review a Remediation Playbook is also available with provides a checklist of IF/THEN actions covering the table above in detail.
Below are the brief steps. Refer to the KB articles above for screenshots and more information.


LDAP, TACACS+ and RADIUS servers – including any configured for SSO, Wireless interface and WLAN zone
Below are the brief steps. Refer to the above resources for more information.





Below are the brief steps. Refer to the above resources for more information.
Note: The shared secrets must be updated on both sides/IPSec Gateways of the VPN tunnel.


Below are the brief steps. Refer to the above resources for more information.






NOTE: Not all auth tokens used in the advanced routing configuration are encrypted in the firewall configuration file. Therefore, it is imperative that you rotate the credentials used in advanced routing where possible.
Update the passwords associated with any advanced routing configuration. This should be done in coordination with the changes on the peer devices to minimize disruption. Refer to the following resources for more information:
When DPI SSL is enabled and a threat actor gains access to the local network, it may be possible to use information contained in a DPI-SSL parameter to implement MITM attack on connections handled by DPI-SSL module.
Therefore the following remediation steps are required
Log into the firewall and access the internal setting page.
Disable the “Use 2048 bit length spoof cert key in DPI-SSL" as show below 

Re-export the preferences file and create a new system backup
SonicWall recommends exporting a new preferences file and creating a new system backup after reconfiguring all relevant credentials. Store the preferences file locally for safekeeping. Below are the brief steps. Refer to the KB titled How can I save a backup settings file from a SonicWall firewall? for more information.


Monitoring using NSM requires that the Firewall have an NSM Advanced license. The logs will be available based on the NSM Advanced log retention days of 7, 30, 90, or 365 days
NSM Manager View
In the NSM Manager view, System Logs are aggregated from all firewalls managed in the tenant for a maximum of the last 30 days and limited to the last 8000 records.
Logging
Review logs and recent configuration changes for unusual activity
Navigate to MONITOR | Logs | System Logs
Use the available filters to review the events. Optionally, export the log to CSV for additional filtering within your spreadsheet application of choice.
Filter SonicWall event logs from firewalls in NSM
e.g. Filtering based on Category

Modifying the log settings and levels
Templates can be used to modify the log settings and levels for more than one firewall.
Navigate to Home | Templates
Create a new Template
Navigate to Device | Log | Settings
Change the log settings and levels for each event type
Apply the Template to firewalls
Commit and deploy the changes
Monitoring SSL VPN User Logins
Navigate to Monitor | VPN Activity Report | Dashboard
The dashboard provides a comprehensive view of all SSL VPN activities.
Navigate to Monitor | VPN Activity Report | Users for details on VPN Users.
Navigate to Monitor | VPN Activity Report | VPN Logs for all SSL VPN related logs
Review the log for unusual or unexpected changes. Optionally, export the log to CSV format for additional filtering within a spreadsheet application.
NSM Firewall View
In the NSM Firewall view of a firewall, System Logs are available per the NSM license applied to the firewall and limited to the last 8000 records. For example, if the firewall has a 7-day Advanced license, the system events will be available for the last 7 days.
The NSM Firewall view is identical to the SonicOS WebUI. To view and modify system logs and system event configurations, follow the steps in the section:
“Monitoring using SonicOS Web UI”
To launch NSM Firewall View, navigate to Home | Firewalls | Inventory. Click on the firewall’s friendly name to launch the firewall’s Firewall View.
![]()
![]()
