NetExtender Compatibility & Bundling Update

• New Embedded Version: SonicOS 7.3.3 ships with NetExtender version 10.3.4 embedded in the SSL‑VPN portal. Users accessing the portal will be prompted to install or update to NetExtender 10.3.4 automatically.
• Upgrade Recommendation: To ensure access to the latest security patches and performance optimizations, we strongly recommend that customers upgrade all NetExtender clients to version 10.3.4 at their earliest convenience.

Deprecation Notice

Support for customizing guest login pages using external web servers with the CGI mechanism has been deprecated. This functionality will no longer be enhanced, and customers are advised to migrate to the supported API‑based guest login customization mechanism.

For migration guidance and additional details, refer to the following Knowledge Base article: Deprecation of CGI-Based Guest Login Page Customization.

What's New

• New Content Filtering Categories

  SonicOS now includes four additional CFS categories to address evolving content risks. Self‑Harm enables organizations to block access to content promoting self‑harm. DNS‑over‑HTTPS (DoH) allows administrators to control or restrict DoH traffic to enforce DNS visibility policies. Low‑THC Cannabis Products provides granular control separate from existing cannabis categories. Generative AI enables policy control over access to AI content‑generation platforms. All four categories are available in the CFS policy editor and can be applied per‑zone or per‑user.

• New Country Support in Geo‑IP: Kosovo and South Sudan

  Kosovo and South Sudan have been added to the SonicOS Geo‑IP country database. Administrators can now apply Geo‑IP‑based access policies to target or exclude traffic originating from these countries. For more information and configuration details, refer to the following Knowledge Base article: Geo-IP Database Update: Kosovo and South Sudan.

• Credential Auditor Enabled by Default

  Credential Auditor is now enabled by default in SonicOS 7.3.3. On first boot or factory reset, the appliance automatically audits configured credentials against known compromised password databases. Administrators are alerted if any credentials match known breached passwords, prompting remediation. For more information and configuration details, refer to the following Knowledge Base article: Understanding and Using Credential Auditor on SonicWall Firewalls.

• W0‑WAN and X1 WAN in the Same Subnet

  SonicOS now permits the W0‑WAN and X1 WAN interfaces to be configured within the same IP subnet, resolving a previous limitation that prevented valid ISP configurations where both WAN handoffs share a common subnet. Routing and failover behavior for same‑subnet WAN configurations is handled correctly and is fully supported with SD‑WAN policies.

• DTLS Support in SSL‑VPN

  SonicOS SSL‑VPN now supports DTLS (Datagram TLS), providing a UDP‑based alternative to TLS for encrypted remote access sessions. DTLS reduces latency and improves throughput for real‑time applications including voice, video, and interactive sessions carried over SSL‑VPN. When a connecting client supports DTLS, the SSL‑VPN gateway negotiates DTLS automatically. TLS fallback is maintained for clients that do not support DTLS.

  To enable DTLS support, you must use NetExtender version 10.3.5 or later. DTLS is supported only when connecting to SonicOS 7.3.3 and above. Download NetExtender 10.3.5 from one of the following:
  - MySonicWall (recommended)
  - https://www.sonicwall.com/products/remote-access/vpn-clients.

  For additional details, refer to the NetExtender 10.3.5 Release Notes.

• MAC‑IP Anti‑Spoof Support in Native Bridge (L2 Deployments)

  SonicOS Native Bridge mode now includes MAC‑IP Anti‑Spoofing support for Layer 2 deployments. When enabled, the appliance enforces MAC‑to‑IP address bindings on bridged interfaces, detecting and blocking traffic where the source MAC and IP pairing does not match the learned or statically configured binding table.

• NetExtender 10.3.4 Embedded in SonicOS 7.3.3

  SonicOS 7.3.3 ships with NetExtender 10.3.4 embedded in the SSL‑VPN portal. Users accessing the portal will be prompted to install or update to NetExtender 10.3.4 automatically. This release of NetExtender includes stability and compatibility improvements.

• Improved Save/Edit Configuration Banner

  The banner notification that appears when saving or editing a firewall configuration has been redesigned to be more intuitive and less visually crowded. The updated banner provides clearer action prompts and reduces cognitive load during configuration changes.

• Updated UI Text for Unified Management

  Several UI text strings and labels related to Unified Management in SonicOS have been updated to align with current product naming and to improve clarity. Administrators using NSM‑based centralized management will notice updated terminology in relevant configuration pages. No functional changes are associated with this update.

This maintenance release also provides security updates and resolves previously reported issues.