SonicOS 7.3 Release Notes

Technical Documentation>  SonicOS 7.3>  Version 7.3.4-7013
Table of Contents

Version 7.3.4-7013

October 2026

This version of SonicOS 7.3.4 is a maintenance release for existing platforms that introduces new capabilities and resolves issues found in previous releases.

Important

  • SonicOS 7.3.4 is not FIPS or Common Criteria certified.
  • SonicWall firewalls running versions of SonicOS 7.1.x or later cannot be managed using Global Management System (GMS).
  • Downgrading from SonicOS 7.3.4 to a lower version is not supported.
  • Use the Firmware Auto Update feature in SonicOS 7.3.4 to ensure that your firewall always has the latest updates for critical vulnerabilities. (For more information, refer to Firmware Auto Update.)
  • GeoIP Remote Server Address Change: When SonicOS 7.3.4 is installed, the GeoIP download hostname is automatically updated from utmgbdata.global.sonicwall.com to utmgpdata.global.sonicwall.com. This change is transparent for most customers and requires no action.

    Customers who previously went to the Diagnostics page and set the GeoIP/Location Remote Server Address resolution mode to Always use this IP for utmgbdata.global.sonicwall.com, with the IP pinned to 204.212.170.21, are affected: because the upgrade changes only the FQDN and not the pinned IP, these firewalls will keep reaching the old server at 204.212.170.21 instead of the new endpoint at 204.212.170.31. Customers using the default resolution mode (Use if utmgbdata.global.sonicwall.com does not resolve) are not affected.

    After upgrading to 7.3.4, affected customers should go to the Diagnostics page, locate the GeoIP/Location Remote Server Address field, and either switch back to the default resolution mode or manually update the IP to 204.212.170.31.

    Botnet Server Address (New Setting): Previously, Botnet Database and GeoIP/Location data were both served from utmgbdata.global.sonicwall.com and controlled by the single GeoIP/Location Remote Server Address setting on the Diagnostics page. Starting with SonicOS 7.3.4, Botnet Database now has its own independent setting, Botnet Remote Server Address. This setting defaults to automatic resolution of utmgbdata.global.sonicwall.com (204.212.170.21), which continues to serve Botnet Database data only.

    Do not set the Botnet Remote Server Address to 204.212.170.31. That IP hosts GeoIP data only and does not serve Botnet Database data.

    Customers who previously set the (now split) Remote Server Address resolution mode to Always use this IP for utmgbdata.global.sonicwall.com — pinned to 204.212.170.21 or another IP — will have the new Botnet Server Address default to automatic resolution of utmgbdata.global.sonicwall.com (204.212.170.21) after upgrade. If the firewall can resolve this hostname via DNS, Botnet Database updates continue. If DNS resolution is unavailable, set the Botnet Remote Server Address manually.

Compatibility and Installation Notes

  • A MySonicWall account is required.
  • Network Security Manager (NSM) SaaS 4.4 is required to manage firewalls using SonicOS 7.3.4.
  • Network Security Manager (NSM) On-Premises 4.4 is required to manage firewalls using SonicOS 7.3.4.
  • Most popular browsers are supported, but Google Chrome is preferred for the real-time graphics display on the Dashboard.
  • Credential Auditor feature is not supported on NSsp 15700.

Supported Platforms

The platform-specific version for this unified release is the same:

Platform Firmware Version
TZ Series 7.3.4-7013
NSa Series 7.3.4-7013
NSsp Series 7.3.4-7013
  • TZ270 / TZ270W
  • TZ370 / TZ370W
  • TZ470 / TZ470W
  • TZ570 / TZ570W / TZ570P
  • TZ670
  • NSa 2700
  • NSa 3700
  • NSa 4700
  • NSa 5700
  • NSa 6700
  • NSsp 10700
  • NSsp 11700
  • NSsp 13700
  • NSsp 15700

SonicOS 7.3.4 for NSv Series will not be released at this time and is planned for a future release date.

What's New

  • Let’s Encrypt Integration

    SonicOS 7.3.4 now supports the ACME v2 protocol for automated issuance, renewal, and installation of SSL/TLS certificates directly from the firewall.

    • Supports HTTP‑01 domain validation.
    • Certificates are renewed automatically ahead of expiry.
    • Configurable from both the SonicOS management UI and CLI.

  • Modernized Management UI Framework

    The SonicOS management UI has been upgraded to the Vue 3 framework, aligning the management interface for SonicOS 7.3.4 and higher versions with SonicOS 8.x and laying the groundwork for improved performance and maintainability of the web management interface.

  • Security Services Enabled by Default

    Gateway Anti‑Virus, Anti‑Spyware, Intrusion Prevention, Botnet Filtering, and Geo‑IP Filtering are now automatically enabled, with default settings, on SonicOS 7 firewalls at the point of registration, without requiring post‑deployment configuration. This applies only when the corresponding service licenses are active, and firmware upgrades do not change the security service settings on firewalls that are already configured.

  • Configurable CORS and Bearer Token Authentication for the Management API

    Cross‑Origin Resource Sharing (CORS) for the SonicOS management API is now supported and it is disabled by default. When enabled, CORS requires an explicit whitelist of allowed origins (IP addresses or domain names, including wildcard subdomain patterns) instead of allowing all origins. This gives administrators control over which external sites, if any, may make cross‑origin API calls to the firewall.

    Bearer token authentication is also now enabled by default for non‑UI (API) management sessions. Each API command must include a valid bearer token in addition to the initial login, providing per‑request credential verification for scripted or third‑party API integrations. For more information, refer to Securing the SonicOS API: CORS and Bearer Token Session Check.

  • Increased GeoIP Compressed Database Download Limit

    The GeoIP compressed database download limit has been increased to support database files larger than 2 MB, accommodating continued database growth. This change is handled automatically by the firewall; no administrator action or configuration change is required.

This maintenance release also resolves previously reported issues.

Resolved Issues

Issue ID Issue Description
GEN7-55863 Egress traffic on the WG0 interface is dropped because the GRE tunnel mode is not populated correctly, generating a "WireGuard encap destination ip unreachable" error and blocking CSE Connector traffic.
GEN7-57260 A configured user quota is not applied to users authenticated through RADIUS accounting.
GEN7-58313 After upgrading to 7.3.2, the firewall loses the configured email or FTP server settings for scheduled AppFlow reports.
GEN7-58320 The firewall crashes with a segmentation fault in the network object manager thread when deleting FQDN address objects.
GEN7-58354 Changes to the IPsec VPN shared key pushed through NSM report success but are not consistently applied on the firewall, preventing the VPN from reconnecting.
GEN7-58355 Updates to user and administrator passwords pushed through NSM report success but are not reliably applied, so neither the old nor the new password works for local login.
GEN7-58394 VLAN trunk configurations are lost after upgrading to firmware 7.3.2-7010.
GEN7-58398 On 100G interfaces configured in wiremode, the link intermittently goes down on one interface, causing significant network disruption.
GEN7-58465 Imported certificates with an empty Subject Name that rely only on the Subject Alternative Name are not displayed in the SonicOS GUI and cannot be deleted once imported.
GEN7-58478 After upgrading to 7.3.3, ping and HTTPS access to the standby firewall's monitoring IP over VPN fails because the primary firewall no longer resolves an ARP entry for it.
GEN7-58542 Audit logs are not displayed in the correct order when sorted by time, causing entries to appear out of sequence.
GEN7-58633 During guest authentication redirect, the firewall intermittently fails to append the custom HTTPS management port to the login page URL, preventing the page from loading.
GEN7-58650 The SSL VPN certificate drop-down in NSM does not display imported certificates for SonicOS 7 firewalls.
GEN7-58653 The RF score for an access point no longer appears in the GUI after upgrading from 7.3.2-7010 to 7.3.3-7014 when the access point is managed through the firewall.
GEN7-58832 Adding or removing countries from the Geo-IP blocked countries list causes other previously configured countries to disappear from the list.

Known Issues

Issue ID Issue Description
GEN7-54348 Changing the OTP length and then reverting to the original value results in the error: Ensure the minimum length is not greater than the maximum length.
GEN7-54531 The firewall UI is not accessible via HTTPS on port 8080 after changing from port 443. This causes a conflict. Use a different port than 8080.
GEN7-54564 Unable to import LDAP users belonging to child domains. When selecting the primary server, users from child domains are not displayed. Selecting Import from all LDAP servers lists all users from all configured servers.
GEN7-54569 In a High Availability setup, locked-out IP addresses are not synced with the standby node.
GEN7-56715 Clicking the Accept button on the Geo-IP Filter settings page enables the Block all Unknown countries option on the other tab automatically when nothing is configured on that tab.
GEN7-56726 The IPv6 route added to NetExtender is incorrect when the SSL-VPN IPv6 pool is a range address object.
GEN7-57624 The DNS filter profile is not persisted correctly after importing preferences.
GEN7-57651 A NAT policy change does not take effect after the translated service address object port and name are changed. A reboot is required for the change to take effect.
GEN7-58743 The Geo-IP Remote Server Address field continues to display the previous address instead of the updated temporary address after the change.
GEN7-59099 OSPF on a VLAN interface becomes stuck in the ExStart state after its parent interface link goes down and then back up.

Additional References

GEN7-38567, GEN7-56078, GEN7-56832, GEN7-56853, GEN7-57006, GEN7-57018, GEN7-57200, GEN7-57269, GEN7-57413, GEN7-57504, GEN7-57646, GEN7-57647, GEN7-57703, GEN7-57779, GEN7-58113, GEN7-58117, GEN7-58214, GEN7-58268, GEN7-58361, GEN7-58386, GEN7-58514, GEN7-58520, GEN7-58527, GEN7-58530, GEN7-58538, GEN7-58564, GEN7-58572, GEN7-58641, GEN7-58682, GEN7-58695, GEN7-58722, GEN7-58735, GEN7-58750, GEN7-58762, GEN7-58767, GEN7-58781, GEN7-58837, GEN7-58877, GEN7-58878, GEN7-59286