SonicOS 8 0 Version 8.2.2-8015 Released

Compatibility and Installation Notes

• Most popular browsers are supported, but Google Chrome is preferred for the real-time graphics display on the Dashboard.
• A MySonicWall account is required.

Important

• The TZ80:
  • Must be licensed before it can be configured or used.
  • Must always be connected to the Internet. It cannot be used in a closed network environment.
• Beginning with SonicOS 8.0.0, these SonicPoint devices are no longer supported:
  • SonicPoint-N
  • SonicPoint-NDR
  • SonicPoint-Ni/Ne
  • SonicPoint-ACe/ACi/N2
• Support for the WEP and TKIP security protocols has been deprecated.
• Support for the Radio Role > Mesh Gateway has been deprecated in the TZ wireless models.
• Settings from Gen 7 firewalls running SonicOS 7.3.x can be imported into Gen 8 firewalls operating on SonicOS 8.2.2 version.
• All features introduced in SonicOS 7.3.3 are available in SonicOS 8.2.2.

The platform-specific version for this unified release is the same:

TZ Series	Firmware Version	NSa Series	Firmware Version	NSv Series	Firmware Version
TZ80	8.2.2-8015	NSa 2800	8.2.2-8015	NSv XS	8.2.2-8015
TZ280	8.2.2-8015	NSa 3800	8.2.2-8015	NSv S	8.2.2-8015
TZ280P	8.2.2-8015	NSa 4800	8.2.2-8015	NSv M	8.2.2-8015
TZ280W	8.2.2-8015	NSa 5800	8.2.2-8015	NSv L	8.2.2-8015
TZ380	8.2.2-8015	NSa 6800	8.2.2-8015
TZ380W	8.2.2-8015
TZ480	8.2.2-8015
TZ580	8.2.2-8015
TZ680	8.2.2-8015

Deprecation Notice

Support for customizing guest login pages using external web servers with the CGI mechanism has been deprecated. This functionality will no longer be enhanced, and customers are advised to migrate to the supported API-based guest login customization mechanism.

For migration guidance and additional details, refer to the following Knowledge Base article: Deprecation of CGI-Based Guest Login Page Customization.

What's New

• Security Services Enabled by Default — Gateway Anti-Virus, Anti-Spyware, Intrusion Prevention, Botnet Filtering, and Geo-IP Filtering are automatically enabled on SonicOS 8 appliances at the point of registration, without requiring post-deployment configuration.
• Let’s Encrypt Integration — SonicOS 8.2.2 now supports the ACME v2 protocol for automated issuance, renewal, and installation of SSL/TLS certificates directly from the firewall.
  • Supports HTTP-01 domain validation.
  • Certificates are renewed automatically ahead of expiry.
  • Configurable from both the SonicOS management UI and CLI.
• Two-Factor Authentication for GVC — TOTP-based two-factor authentication is now available for Global VPN Client (GVC) connections.
• Indicator of Compromise (IoC) – Hash Detection — Administrators can import MD5, SHA-1, and SHA-256 hash lists from threat intelligence feeds (up to 500,000 entries). Files matching an imported hash are blocked in transit and logged for audit purposes.
• Non-Reversible Password Storage — Stored credentials now use one-way cryptographic hashing (bcrypt) rather than a reversible format. Existing credentials are automatically migrated during the first login after the upgrade, and configuration exports no longer contain recoverable credentials. This feature is not enabled by default.
• SD-WAN Site Support Increase — The maximum number of supported SD-WAN sites per SonicOS 8 appliance has increased, extending single-hub SD-WAN coverage for larger branch deployments.
• SonicOS UI/UX Improvements — This release includes a consolidated set of usability improvements across rule and policy pages, App Control, VPN monitoring, and logging, aligned with updated NSM 4.3 terminology:
  • Redesigned change-notification banner, repositioned so it no longer blocks key workflow actions.
  • Standardized placement of Add, Edit, Delete, Move, and Clone controls across Access Rules, NAT Rules, Route Rules, DNS Rules, Content Filter Rules, and App Rules.
  • Create Another option added for NAT, Route, DNS, Content Filter, and App Rules.
  • App Control list now sorts by Category Name, then App Name, then Signature ID, with the selected category persisting across changes.
  • VPN tunnel status now updates in real time.
  • ACL/NAT live counters no longer force a full grid reload or lose the last-hit timestamp.
  • Log entries now link directly to the related App Control, IPS, or Anti-Spyware signature settings.
  • LLDP now supports both transmit (Tx) and receive (Rx).
  • The Network > System > Interfaces page supports ascending and descending sort, with sub-interfaces sorted within their parent.
• SonicOS 8 NSv Small / Medium / Large — Three new SonicOS 8 NSv virtual firewall sizes are introduced: Small (2 vCPU / 2 GB), Medium (4 vCPU / 8 GB), and Large (8 vCPU / 16 GB), supporting VMware, KVM, Hyper-V, Proxmox, AWS, and Azure. The maximum supported number of groups per NSv instance has increased to 500.
• NSM Enhancements — SonicOS 8.2.2 is a co-release with NSM 4.3, which includes the following firewall-side capabilities:
  • Source and destination MAC addresses are now captured for user-based system events, including sessions established via SSL VPN or GVC remote access clients.
  • Firewall audit log data can now be delivered to NSM as flow events via a new IPFIX template.
• User Management Enhancements — Guest Wi-Fi now supports a branded captive portal experience with Acceptable Use Policy (AUP) enforcement. RADIUS attribute support has been extended for advanced identity provider and access management integrations.
• Platform Capacity Increases — The following per-platform limits have been increased in this release:
  • TZ80: maximum concurrent SSL VPN users increased to 10.
  • NSv L Model: maximum supported groups increased to 500.

This release also resolves previously reported issues.

Resolved Issues

Issue ID	Description
GEN8-14363	Host header injection vulnerability in SonicOS (CVSS 4.3 - Medium).
GEN8-15431	SD-WAN load balancing does not occur when the SLA strategy is set to Lowest Cost with the LB type set to Ratio.
GEN8-15723	Unable to pass traffic over a LAG member when its LAG Agg is disabled on NSa 2800.
GEN8-16196	NSa 3800 intermittently reports false fan failure alerts.
GEN8-16283	The tooltip on the Geo-IP Filter Settings page was too narrow to display its full text.
GEN8-16355	An error pops up when opening an SSH terminal session in the GUI using the Firefox browser.
GEN8-16421	Bandwidth management parameters under access rules display an incorrect value.
GEN8-16558	Sometimes the auto-download of IoC files still occurs even when file auto-download is disabled.
GEN8-16603	SSL VPN UDP packets are dropped on NSa 2800.
GEN8-16711	The GUI displayed IPv6 traffic under the IPv4 traffic view.
GEN8-16932	SSL VPN users are unable to connect when SYN Flood Protection Mode is set to Always Proxy WAN Client Connections on firmware 8.1.0, 8.2.0, and 8.2.1.
GEN8-17108	The firewall drops Cloud Secure Edge (CSE) egress traffic as “Destination IP unreachable” on NSa 4800.
GEN8-17115	After a factory default, navigating to the Access Rules page and downloading a TSR shows “Licensing must be activated for this feature”.

Known Issues

Issue ID	Description
GEN8-2677	The user is not logged out from the firewall even after the inactivity time is reached.
GEN8-10895	On NSa 6800, a 40G Twinax connection shows no link when the port is set to auto-negotiation; it works only in 40G force mode with Cisco.
GEN8-11359	NSa 4800 intermittently does not detect SFP modules when 10GBASE-T type SFPs are frequently plugged and unplugged.
GEN8-15639	An NSv firewall drops Cloud Secure Edge (CSE) client traffic after a fresh deployment; traffic works only after a firewall reboot.
GEN8-16066	Hashed passwords break the CLDAP periodic check functionality.
GEN8-16864	Admin/user IP lockout does not work for NSv S/M/L on AWS Pay-As-You-Go with UPE/Policy mode; it works on hardware platforms.
GEN8-17572	On NSa 2800, traffic fails after a reboot or restart when the X0 LAG Aggregator is disabled.
GEN8-17959	The “No space available on device” error appears during firmware upload when ZTv3 debug logging is enabled and set to level 13.
GEN8-17990	When storing user passwords non-reversibly is enabled, a new user's password is stored non-reversibly even when the user's group memberships specify that it should be stored reversibly.
GEN8-18136	TACACS user authentication fails when the user logs in with a domain name for the SSL VPN portal.
GEN8-18145	On the System Monitor Real-Time Charts, Interface Usage data is not displayed consistently.
GEN8-18167	Botnet Filtering is automatically enabled after upgrading from 8.2.1 to 8.2.2, even if it was disabled in 8.2.1.
GEN8-18178	On an NSa 6800 HA pair, saving an SSL VPN-to-LAN access rule on a sub-interface with Allow Management Traffic enabled (Optional Settings > Others) returns an error.
GEN8-18187	The Test Email function for SFR mailing returns an “API not found” error.
GEN8-18311	On an NSv firewall, vMotion cannot be enabled from the diagnostics page.
GEN8-18376	A raw API error appears when performing a global search.

Additional References

GEN8-16053, GEN8-16192, GEN8-16222, GEN8-16270, GEN8-16281, GEN8-16357, GEN8-16382, GEN8-16406, GEN8-16424, GEN8-16446, GEN8-16605, GEN8-16608, GEN8-16615, GEN8-16625, GEN8-16650, GEN8-16707, GEN8-16865, GEN8-16916, GEN8-16970, GEN8-16997, GEN8-17149, GEN8-17256, GEN8-17493, GEN8-17546, GEN8-17734