Version 8.2.3-8015

November 2026

Compatibility and Installation Notes

• Most popular browsers are supported, but Google Chrome is preferred for the real-time graphics display on the Dashboard.
• A MySonicWall account is required.

The platform-specific version for this unified release is the same:

TZ Series	Firmware Version	NSa Series	Firmware Version	NSv Series	Firmware Version
TZ80	8.2.3-8015	NSa 2800	8.2.3-8015	NSv XS	8.2.3-8015
TZ280	8.2.3-8015	NSa 3800	8.2.3-8015	NSv S	8.2.3-8015
TZ280P	8.2.3-8015	NSa 4800	8.2.3-8015	NSv M	8.2.3-8015
TZ280W	8.2.3-8015	NSa 5800	8.2.3-8015	NSv L	8.2.3-8015
TZ380	8.2.3-8015	NSa 6800	8.2.3-8015
TZ380W	8.2.3-8015
TZ480	8.2.3-8015
TZ580	8.2.3-8015
TZ680	8.2.3-8015

What's New

• Federal and Security Certification Requirements

  SonicOS 8.2.3 includes enhancements that support federal and security certification requirements, including FIPS 140-3.

• Custom Captive Portal

  SonicOS 8.2.3 adds customization of the captive portal presented to administrators, non-administrators, SSL VPN users, wireless users, and SAML users, which allows the portal to reflect the host organization rather than a generic default.

• OAuth 2.0 Support for Mail Server Settings

  SonicOS 8.2.3 introduces OAuth 2.0 token-based authentication for the outbound mail server that sends alerts and scheduled reports. OAuth 2.0 is supported for Microsoft 365.

  If a firewall authenticates to the mail server with a username and password, alert and report delivery fails once basic authentication is withdrawn for that tenant. A firewall that still uses a password can stop sending alerts without warning.

• Routing Enhancements

  OSPF Graceful Restart

  SonicOS 8.2.3 adds support for OSPF graceful restart, which allows a firewall to preserve its forwarding state across a control-plane restart.

  Without graceful restart, an OSPF control-plane restart, whether caused by a firmware upgrade, a high-availability failover, or a process restart, causes neighboring routers to withdraw the adjacency and recalculate their routes. Routes flap, traffic is dropped during reconvergence, and the disruption propagates well beyond the restarting device.

  With graceful restart, the restarting firewall signals its intent to neighboring routers, which enter helper mode, in which a neighbor keeps the adjacency with the restarting firewall instead of removing it. Helpers maintain the adjacency and continue forwarding traffic through the restarting device for the duration of the restart window, rather than tearing down the adjacency and recalculating routes. Forwarding continues while the control plane rebuilds.

  BGP Configuration in the User Interface

  BGP configuration is available through a structured user interface, which replaces a workflow that previously depended heavily on text-based configuration.

  Administrators can configure BGP global settings, neighbors, and advertised networks through guided interface elements rather than composing the configuration by hand. Structured input with validation reduces configuration errors.

  Equal-Cost Multi-Path (ECMP) in BGP

  SonicOS 8.2.3 introduces equal-cost multi-path (ECMP) support in BGP, which enables the firewall to install multiple equal-cost BGP paths into the routing table and forward traffic across them simultaneously.

  Previously, where multiple equal-cost BGP paths existed to the same destination, a single best path was selected and installed. The remaining links sat idle, serving only as standby capacity in the event of a failure. Customers who paid for multiple transit or peering links could use only one of them at a time.

  To use ECMP in BGP, enable Allow learning ECMP routes from advanced routing protocols. A restart is required.

• Secure by Default, Secure by Design: Phase 2

  Phase 2 adds on-box Security Insights, security settings enabled by default, multi-factor authentication for administrators, and configuration backup encryption.

  On-Box Security Insights

  SonicOS 8.2.3 introduces Security Insights directly on the firewall, which provides a security posture assessment without requiring central management.

  Security Insights evaluates the running configuration and reports findings where protection is disabled, absent, or weaker than recommended. Capabilities in this release include:

  • Findings presented in severity order, with the highest-severity items surfaced first.

  • A filter on the insights table, which allows administrators to narrow findings by attribute.

  • Optional additional columns, so the table can be extended with further detail as required.

  • Click-to-configure navigation, which takes the administrator from a finding directly to the configuration page that resolves it.

  • Detection of management-plane exposure, including HTTPS management enabled on a WAN interface.

  Security Insights is available on the firewall at Monitor > Security Insights in Classic Mode. For firewalls managed by NSM, it is also available in NSM.

  Security Settings Enabled by Default

  On first login, new firewalls enable these settings by default: Stealth Mode, Randomize IP ID, SSL Control (SonicOS 8 hardware platforms only), Default Deny Rules to Discard, Admin 2FA, and MFA Alerting.

  Multi-Factor Authentication for Administrators and Remote Access Users

  Administrators are guided to enroll in Time-based One-Time Password (TOTP) authentication on first login. Enrollment is highly recommended for remote access users.

  Deployment scope: Firewalls upgraded from an earlier SonicOS release keep their existing authentication configuration. Administrators of upgraded firewalls who want to use multi-factor authentication must enable it.

  Configuration Backup Encryption

  Configuration backups can be encrypted with a password that meets the password policy.

• Deployment Flexibility and Layer 2 Security

  Layer 2 Bridge Mode Security

  SonicOS 8.2.3 extends security enforcement in Layer 2 Bridge Mode, which allows the firewall to be inserted transparently into an existing network segment.

  In Layer 2 Bridge Mode, the firewall operates as a transparent device between two segments. It inspects and enforces policy on traffic passing through it without participating in Layer 3 forwarding. Because the firewall does not act as a gateway, no change to existing IP addressing, default gateways, routing, or DHCP scopes is required.

  MAC Anti-Spoofing on VLAN Sub-Interface Native Bridge

  This release extends MAC-IP anti-spoofing to VLAN sub-interface native bridges and Layer 2 Bridge interfaces. The firewall checks each MAC and IPv4 address pair against a static cache and blocks a host that presents another device’s MAC address.

  MAC address spoofing is a foundational technique in Layer 2 attacks. By assuming the MAC address of a legitimate device, an attacker can bypass MAC-based access controls, intercept traffic intended for that device, or impersonate a trusted endpoint to move laterally within a flat network segment.

  SonicOS 8.2.3 detects and blocks a host that attempts to use a MAC address associated with another device on the bridge, which closes this impersonation path.

  This control addresses impersonation and constrains lateral movement at the point of origin, rather than after the attacker has established a foothold.

• SD-WAN Enhancements: Hybrid SD-WAN Groups

  SonicOS 8.2.3 allows a single SD-WAN group to span both MPLS and encrypted VPN interfaces.

  Previously, where an organization ran both private MPLS circuits and encrypted VPN over the public internet, each transport type required its own SD-WAN configuration. Policies had to be authored and maintained separately for each, and traffic could not be steered freely between them within a single policy decision.

  A Hybrid SD-WAN group permits both transport types to participate in one SD-WAN group, so a single policy governs path selection across all available links, including selection of an MPLS exit where that is the appropriate path.

  The benefits are:

  • A single policy rather than parallel designs. One SD-WAN configuration covers all transports, which removes duplication and the risk of the two configurations diverging over time.

  • Full use of available transport. Traffic can be steered to whichever link best serves the application at that moment, regardless of whether that link is private or encrypted public transport.

• Application Visibility and Control

  SaaS and AI Application Objects

  This release introduces policy objects for software-as-a-service (SaaS) and artificial intelligence (AI) applications, which enable administrators to write policy against these application categories.

  Cloud Sync controls whether the firewall downloads the SaaS & AI application database from the SonicWall cloud. You can also use SaaS App as a matching mode in Access Rules, Route Policies, and SD-WAN Rules.

• IPFIX Enhancements

  SonicOS 8.2.3 supports IPFIX Extension Version 3 (Ve3). Connection records include the URL, rating, reputation, zone names, and the Content Filtering Service (CFS) policy name. Web-Activity data uses a single template (656 and 756). New audit log, bandwidth, protocol, and user monitor data is available for NSM.

• NSv Bootstrapping Image for Nutanix AHV Deployments

  A bootstrapping NSv KVM qcow2 image is available for Nutanix AHV deployments. Before first boot, the partner must delete the pre-enrolled Secure Boot keys (PK, KEK, db) from the VM’s UEFI Boot Manager menu. On first boot, the image automatically enrolls SonicWall’s Secure Boot certificates, re-enabling Secure Boot with SonicWall’s trust chain. From the second boot onward, the VM operates under full UEFI Secure Boot. Partners can then upgrade to the standard NSv KVM GA release using the regular .bin.sig upgrade path. This image is provided on a controlled basis to select partners; contact your SonicWall representative for access.

• Security Fixes and Component Updates

  This release includes fixes for reported vulnerabilities. The management interface framework is also updated to address vulnerabilities reported by security scans, and unused components are removed. The appearance of the management interface does not change.

This release also resolves previously reported issues.

Additional References

The following issues were also fixed in this release.

GEN8-17322, GEN8-17432, GEN8-17764, GEN8-17981, GEN8-18024, GEN8-18224, GEN8-18284, GEN8-18309, GEN8-18624, GEN8-18673, GEN8-18787, GEN8-18962, GEN8-19038, GEN8-19066, GEN8-19072, GEN8-19205