NetworkTigers: Reliable, Quality-Tested Network Equipment

Supporting network managers with high quality switches, routers, PDUs, and firewalls since 1996

SonicWall TZ Gen6 Firewalls - Refurbished, Used, New

Best Selling

The SonicWall TZ Gen 6 firewalls run SonicOS 6.5 and remain one of the most widely deployed small business security platforms in the installed base. Five models cover the range, and on the secondary market they are the economical way to add or replace a site without changing the firmware generation you already run.

Which Gen 6 TZ do you need?

Model	Firewall	Threat prevention	DPI-SSL	Max connections	Ports	Site-to-site VPN
TZ300	750 Mbps	235 Mbps	60 Mbps	100,000	5x 1GbE	10
TZ350	1 Gbps	335 Mbps	65 Mbps	100,000	5x 1GbE	15
TZ400	1.3 Gbps	600 Mbps	180 Mbps	150,000	7x 1GbE	20
TZ500	1.4 Gbps	700 Mbps	225 Mbps	150,000	8x 1GbE	25
TZ600	1.9 Gbps	800 Mbps	300 Mbps	150,000	10x 1GbE	50

The TZ300 and TZ350 are the same five-port chassis. The 350 adds about a third more throughput. Both cap at 100,000 connections and ten or fifteen site-to-site tunnels, which places them squarely at single small sites.

The TZ400 is the value point of the Gen 6 line. It nearly doubles threat prevention throughput over the TZ350, from 335 to 600 Mbps, triples DPI-SSL, adds two ports and lifts the connection table by half. The step from 350 to 400 buys more than the step from 400 all the way to 600.

The TZ500 and TZ600 are bought for ports and tunnels, not speed. From the TZ400 up, threat prevention moves only from 600 to 800 Mbps across two model steps. What changes is port count, 7 to 8 to 10, and site-to-site VPN tunnels, 20 to 25 to 50. If you are hubbing a number of remote sites back to one office, the TZ600 at 50 tunnels is the reason to buy it. If you just want throughput, the TZ400 gets you most of the way.

Across the whole Gen 6 TZ line the connection table stops at 150,000 and SSO users at 500. Those two ceilings do not move no matter which model you pick, and they are the usual reason a busy site outgrows Gen 6 hardware rather than running short of raw throughput.

All models support high availability pairing, so a second unit provides failover for a critical location. The P variants, such as the TZ300P and TZ600P, add PoE ports for powering an access point or camera directly from the firewall.

Transfer ready or non-transferable?

Every SonicWall we list states its registration status, because on the secondary market that matters as much as physical condition.

TRANSFER READY means the unit can be registered into your own MySonicWall account. From there you can add support, security service subscriptions and warranty, the same as a unit bought new.

NON-TRANSFERABLE means the unit cannot be moved into your MySonicWall account. It still works, and it is still managed locally through its own interface with the full configuration under your control. What you cannot do is add services, subscriptions or warranty to it. We price these as hardware accordingly, and they suit a lab, a cold spare, or a site that needs firewalling and VPN without subscription services.

Need the current generation instead? See SonicWall TZ Gen 7 Firewalls.

At NetworkTigers, we supply refurbished, used, and new SonicWall TZ Gen 6 firewalls, each fully tested, serialized, and production-ready, with fast shipping and a 365-day warranty.