Which Gen 7 TZ do you need?

The TZ270 and TZ370 are the same box with different licensing of performance. Identical eight-port layout, no multi-gigabit ports on either. The 370 gives you 50 percent more firewall throughput and a third more connections. If your circuit is under 500 Mbps the 270 is enough; above that the 370 earns its difference.

The TZ470 is where the line changes shape. It adds two 2.5 gigabit ports, and it doubles SSO users from 1,000 to 2,500. The multi-gig ports matter more than they look: a gigabit WAN circuit plus a gigabit LAN uplink will saturate two of your eight ports, and the 2.5GbE pair gives the uplink room without consuming them.

The TZ570 and TZ670 are chosen for their uplinks, not their throughput. The difference between a 470 at 3.5 Gbps and a 670 at 5 Gbps is real but modest. What separates them is the multi-gig pair: 2.5 gigabit on the 470, 5 gigabit on the 570, 10 gigabit on the 670. If you are terminating a 10 gigabit circuit or trunking to a 10 gigabit switch, the TZ670 is the only TZ that does it natively.

A note on DPI-SSL. The fourth column is the throughput with TLS decryption running, and it is roughly a fifth of the headline firewall figure across the whole line. Most traffic is encrypted now, so if you intend to inspect it, that column is your real ceiling. It is the most commonly overlooked number when sizing a firewall.

All Gen 7 TZ models support optional storage expansion to 256GB, high availability pairing, Secure SD-WAN, TLS 1.3 decryption and SonicWall's patented RTDMI engine for real-time deep memory inspection. Wireless variants carrying a W suffix add an integrated 802.11ac radio with identical firewall performance.

Transfer ready or non-transferable?

Every SonicWall we list states its registration status, because on the secondary market that matters as much as physical condition.

TRANSFER READY means the unit can be registered into your own MySonicWall account. From there you can add support, security service subscriptions and warranty, the same as a unit bought new.

NON-TRANSFERABLE means the unit cannot be moved into your MySonicWall account. It still works, and it is still managed locally through its own interface with the full configuration under your control. What you cannot do is add services, subscriptions or warranty to it. We price these as hardware accordingly, and they suit a lab, a cold spare, or a site that needs firewalling and VPN without subscription services.

Looking at the previous generation instead? See SonicWall TZ Gen 6 Firewalls.

At NetworkTigers, we supply refurbished, used, and new SonicWall TZ Gen 7 firewalls, each fully tested, serialized, and production-ready, with fast shipping and a 365-day warranty.