Which NSa model do you need?

The 2700 and 3700 are close siblings. Firewall throughput differs by only 300 Mbps. What you actually buy when you step up to the 3700 is ports and headroom: 24 gigabit ports instead of 16, six 10G SFP+ cages instead of three, and 50 percent more concurrent connections. If you are running out of switch ports at the firewall or your connection table is filling up, the 3700 solves that. If you simply want more inspection speed, it barely moves.

The real jump is from the 3700 to the 4700. Firewall throughput more than triples, from 5.5 to 18 Gbps, threat prevention goes from 3.5 to 9.5 Gbps, and the connection table grows from 750,000 to 2 million. New connections per second goes from 14,000 to 115,000. Everything from the 4700 up is a different class of appliance. If you are inspecting a gigabit circuit with full DPI-SSL turned on, this is the line you need to be above.

The 5700 and 6700 are data center and large campus hardware. The 6700 is the only model in the family with 40 gigabit QSFP+ and 25 gigabit interfaces, which is what distinguishes it in practice. Buy a 6700 for interface density and a 6 million connection table, not simply because it is the fastest number on the list.

A note on throughput figures generally: firewall throughput is measured with inspection largely off, and it is the number vendors lead with. Threat prevention throughput is what the appliance actually sustains with the security services you bought it for switched on. The second column is the one to size against.

All Gen 7 NSa models run SonicOS 7, with Secure SD-WAN, BGP and OSPF routing, full TLS 1.3 decryption, high availability pairing, and SonicWall's patented RTDMI engine for real-time deep memory inspection.

Transfer ready or non-transferable?

Every SonicWall we list states its registration status, because on the secondary market that matters as much as physical condition.

TRANSFER READY means the unit can be registered into your own MySonicWall account. From there you can add support, security service subscriptions and warranty, the same as a unit bought new.

NON-TRANSFERABLE means the unit cannot be moved into your MySonicWall account. It still works, and it is still managed locally through its own interface with the full configuration under your control. What you cannot do is add services, subscriptions or warranty to it. We price these as hardware accordingly, and they suit a lab, a cold spare, or a site that needs firewalling and VPN without subscription services.

Looking at the previous generation instead? See SonicWall NSA Gen 6 Firewalls.

At NetworkTigers, we supply refurbished, used, and new SonicWall NSa Gen 7 firewalls, each fully tested, serialized, and production-ready. Fast shipping and a 365-day warranty.