SonicOS 8.1.0 FAQ

SonicOS 8.1.0 introduces several dynamic features for stronger security and higher efficiency with your Gen 8 firewalls. This article helps answer frequently asked questions regarding features and enhancements introduced in SonicOS 8.1.0.

Q1. What Features or Enhancements are introduced in SonicOS 8.1.0

Ans.

• SAML
• SonicOS – NTP Server
• Wireless:
  • • WPA2/WPA3- Enterprise Support on TZW’s running in station mode.
    • Renewing the DHCP lease on W0 when TZW is in Station mode.
    • Overriding the  “Default MAC Address” on W0 Interface on TZ –Wireless models.
• Increased support for Domain Name Server (DNS) proxy rules. (from 32 to 1024 rules)

Q2. Are all Gen 8 firewalls ready to support the features available in 8.1.0.?

Ans:

• At Launch, SonicOS 8.1.0 will be available for TZ80, TZ280, TZ380, TZ380W, TZ480, TZ580, TZ680, NSa 2800, NSa 3800, NSa 4800, and NSa5800.
• The TZ280P and TZ280W will receive updates for SAML and additional features in SonicOS 8.2.0

Q3. What version of NSM will support SonicOS 8.1.0?

• Ans NSM 3.2 (available in both SaaS and On-premises) will only support basic device management with SonicOS 8.1.0
• NSM 3.4 will have full feature support for SonicOS 8.1.0

Q4. Do I need any additional licenses to use any of the features on SonicOS 8.1.0?

Ans: No additional license is needed to use SonicOS 8.1.0 features.

Q5: What type of SAML binding does SonicOS support?

Ans: SonicOS supports the HTTP-POST binding method

Q6. Does SonicOS 8.1.0 support MFA with SAML?

Ans: MFA enforced by the IdP works with SAML integration on SonicWALL.

Q7. What functions or use cases can SAML SSO be applied to?

Ans: In SonicOS 8.1.0, we will support the following 3 use cases.

1. SAML Single Sign-On for Firewall Administration or management access.
2. Single Sign-On for Remote Access VPN ( SSLVPN).
3. Single Sign-On for user identity.

Q8. Can I use a single configuration from my IdP (Identity Provider application/Enterprise App) for all the use cases listed above?

Ans: No, each use case is treated as a separate service provider (SP). Therefore, you will need a unique configuration (IdP application/Enterprise App) for each firewall SP on the IdP.

Q9. Can I log into the firewall for management using my local admin accounts if the IdP is unreachable or if I experience issues with SAML SSO?

Ans: Yes. The SonicWall login screen offers two options for accessing the system: "Log In" and "Single Sign On." To authenticate using SAML, click the "Single Sign On" button. If you prefer to log in with a local admin account, enter your username and password, then click the "Log In" button.

Q10. Is it possible to connect via SSLVPN using both local/LDAP user accounts and SAML at the same time?

Ans: No, the authentication method for SSL VPN can either be set to local/LDAP user accounts(Password) or SAML authentication or Certificates.

Q11. What Zone or interface types are supported by the SonicOS NTP server?

Ans:

• LAN/DMZ/WLAN/custom zone are supported, other zones are not supported (for example- VPN zone)
• Both physical and virtual interfaces are supported.

Q13. How can existing firewall customers running SonicOS 8 upgrade/migrate to SonicOS 8.1.0?

Ans: You can upgrade the Gen8 firewall to SonicOS 8.1.0 on box without using a migration tool.

Q16. How can existing firewall customers running SonicOS6.5/ SonicOS 7 and previous versions upgrade to SonicOS 8.1.0?

Ans: Users will be required to use our Secure Upgrade Plus or SonicProtect Program to upgrade their existing hardware models to Gen 8. They will then need to migrate their settings to the new firewall running SonicOS 8.1.0. Learn more about the Secure Upgrade Program

Q17. What version of NetExtender supports SAML SSO/Authentication?

Ans: NetExtender  10.3.0 and above.

Q18. What version of Mobile Connect supports SAML SSO/Authentication?

Ans: 

• Mobile Connect 5.0.13 and above on MAC
• Mobile Connect 5.0.17 and above on IOS
• Mobile Connect 5.0.24 and above on Android

Q20. Which Identity Provider (IdP) vendors are supported by the firewall?

Ans: The firewall supports any Identity Provider (IdP) compliant with the SAML 2.0 standard. The following providers have been tested and verified to work seamlessly.

• Microsoft EntraID
• Ping
• Okta
• GSuite
• OneLogin
• Duo

Q21: Is there any change related to DPI-SSL in SonicOS 8.1.0?

ANS: Yes. A new DPI-SSL CA certificate has been added.