NetworkTigers: Reliable, Quality-Tested Network Equipment

Supporting network managers with high quality switches, routers, PDUs, and firewalls since 1996

SonicWall NSA Gen6 Firewalls - Refurbished, Used, New

Best Selling

The SonicWall NSA Gen 6 firewalls run SonicOS 6.5 on rack-mounted hardware and remain one of the most widely deployed midrange security platforms in the installed base. Two families sit inside Gen 6: the original x600 series and the later x650 refresh, and the difference between them is not what most people assume.

NSA x600 series, the original Gen 6

Model	Firewall	Anti-malware	IPS	Max connections	New conn/sec
NSA 2600	1.9 Gbps	400 Mbps	700 Mbps	225,000	15,000
NSA 3600	3.4 Gbps	600 Mbps	1.1 Gbps	325,000	20,000
NSA 4600	6.0 Gbps	1.1 Gbps	2.0 Gbps	400,000	40,000
NSA 5600	9.0 Gbps	1.7 Gbps	3.0 Gbps	562,500	60,000
NSA 6600	12.0 Gbps	3.0 Gbps	4.5 Gbps	750,000	90,000

NSA x650 series, the SonicOS 6.5 refresh

Model	Firewall	Threat prevention	Max connections	New conn/sec	Ports
NSA 2650	3.0 Gbps	1.25 Gbps	1,000,000	14,000	12x 1GbE, 4x 2.5GbE, 4x 2.5GbE SFP
NSA 3650	3.75 Gbps	1.75 Gbps	2,000,000	14,000	+ 2x 10GbE SFP+, 8x 2.5GbE SFP
NSA 4650	6.0 Gbps	2.5 Gbps	3,000,000	40,000	16x 1GbE, 2x 10GbE SFP+
NSA 5650	6.25 Gbps	3.4 Gbps	4,000,000	40,000	+ 2x 10GbE copper
NSA 6650	12.0 Gbps	5.5 Gbps	5,000,000	90,000	6x 10GbE SFP+, 2x 10GbE

The x650 refresh did not make the hardware faster. An NSA 4600 and an NSA 4650 both do 6.0 Gbps. A 6600 and a 6650 both do 12.0. What the refresh changed is the connection table, and it changed it by an order of magnitude: the 2600 handles 225,000 concurrent connections and the 2650 handles a million. It also brought 2.5 gigabit copper and 10 gigabit SFP+ ports to models that previously had neither.

That makes the choice between them straightforward. If your constraint is session count, device count or uplink speed, the x650 is a large upgrade. If your constraint is raw inspection throughput, moving from an x600 to the same-numbered x650 buys you almost nothing, and you should go up a model number or to Gen 7 instead.

Within the x600 line, the 4600 is the value point. Firewall throughput nearly doubles over the 3600 and new connections per second doubles to 40,000, which is usually what runs out first on a busy site. The 5600 and 6600 are chosen for connection capacity and port density at a campus.

Every Gen 6 NSA model supports high availability pairing, and the larger chassis carry redundant power. A note on comparing the two tables above: the x600 datasheets quote anti-malware inspection throughput while the x650 quotes threat prevention throughput, and these are not measured the same way, so treat that column as indicative across families rather than directly comparable.

Transfer ready or non-transferable?

Every SonicWall we list states its registration status, because on the secondary market that matters as much as physical condition.

TRANSFER READY means the unit can be registered into your own MySonicWall account. From there you can add support, security service subscriptions and warranty, the same as a unit bought new.

NON-TRANSFERABLE means the unit cannot be moved into your MySonicWall account. It still works, and it is still managed locally through its own interface with the full configuration under your control. What you cannot do is add services, subscriptions or warranty to it. We price these as hardware accordingly, and they suit a lab, a cold spare, or a site that needs firewalling and VPN without subscription services.

Need the current generation instead? See SonicWall NSa Gen 7 Firewalls.

At NetworkTigers, we supply refurbished, used, and new SonicWall NSA Gen 6 firewalls, each fully tested, serialized, and production-ready, with fast shipping and a 365-day warranty.