Room3.06Floor 3 Network and firewall
SonicWall and WatchGuard firewall replacement
If your office still relies on an end-of-life SonicWall or an unpatched WatchGuard, we replace it with a FortiGate, review every rule instead of copying it blindly, and keep the old unit ready until the new one has proven itself.
- Off end-of-life firewalls
- Rules reviewed, not copied blindly
- Remote access moved with MFA
- Old unit kept ready until tested
Why these two brands, and why now
SonicWall and WatchGuard firewalls sit at the edge of thousands of small Canadian offices. Many were installed eight or ten years ago and have run quietly ever since. Two things have changed: a large part of that equipment has reached the end of its supported life, and attackers have been concentrating on firewalls and VPNs because they are the one device every office exposes to the internet.
SonicWall
SonicWall has been retiring its Gen 6 firewalls model by model. The SOHO, TZ 300P and NSa 9000 models reached end of support on April 16, 2026. The TZ 400, TZ 600, NSA 3600 and NSa 3650 families followed on August 1, 2026. After end of support, SonicWall provides no firmware updates, technical support or hardware replacement for the device.
Separately, in September 2025 SonicWall disclosed that attackers had reached its MySonicWall cloud backup service. Its investigation with Mandiant later confirmed that configuration backup files were accessed for every customer who had used the service. Those files hold the firewall’s settings, with passwords and keys stored in encrypted form.
WatchGuard
In September 2025 WatchGuard fixed CVE-2025-9242, a critical flaw rated 9.3 out of 10 in the part of Fireware OS that handles IKEv2 VPN connections. It lets an attacker run code on the firewall without logging in when IKEv2 VPNs are configured. By November it was on the US government’s list of actively exploited vulnerabilities, and a second flaw in the same component followed in December.
Firewalls on supported Fireware versions can be patched. Older Fireboxes still on Fireware 11.x cannot, because that version is end of life and received no fix. For those devices, replacement is the only remedy.
None of this means Fortinet, or any other brand, is immune. Every firewall maker has had serious flaws. What protects an office is supported hardware, firmware kept current, and management and VPN services not left carelessly open. That is what a replacement should deliver.
Is your firewall affected?
The model name is printed on the front or underside of the unit, and in its management page. Find yours below.
| Firewall | Status | What to do |
|---|---|---|
| SonicWall SOHO, SOHO W, TZ 300P, NSa 9250, 9450 and 9650 | End of support since April 16, 2026 | Replace |
| SonicWall TZ 400, TZ 400W, TZ 600, TZ 600P, NSA 3600 and NSa 3650 | End of support since August 1, 2026 | Replace |
| Other SonicWall Gen 6 and Gen 6.5 models | Retired or retiring on model-specific dates | Check the serial against SonicWall’s lifecycle table and plan replacement |
| SonicWall Gen 7 models, such as the TZ 270 to TZ 670 | Supported | Keep, update to a current SonicOS release, and rotate credentials if cloud backup was used |
| WatchGuard Fireboxes on Fireware 11.x | End of life, no fix for CVE-2025-9242 | Replace |
| WatchGuard Fireboxes on supported Fireware 12.x or 2025.x | Patched releases available | Update now, and plan replacement when the hardware nears end of life |
We will not tell you to replace a firewall that is supported and patched. If yours is in the last two rows, we will update it, check it and stop there.
Rules reviewed, not copied blindly
An old firewall carries years of history: rules added for a server that was retired, port forwards for a contractor who left, VPN accounts nobody remembers creating. Fortinet’s FortiConverter tool can translate a SonicWall or WatchGuard configuration into FortiGate format, and it saves hours of typing. It also faithfully copies every mistake.
So we use the conversion as a starting draft and review every line before it goes live.
Inventory
We export the old configuration and list every rule, address translation, VPN and user account. Hit counters on the old firewall show which rules have carried traffic recently and which have not been touched in years.
Remove
Rules that allow everything to everything, port forwards to machines that no longer exist, remote desktop open to the internet, and local VPN accounts for people who have left are all taken out, with your agreement.
Rebuild
What remains is rebuilt on the FortiGate with named objects, logging on every rule and security inspection where it belongs, so the next person to read it understands why each rule exists.
Reset every secret
No password, VPN key or certificate is carried across from the old firewall. Investigations into attacks on SonicWall customers found that some organizations had imported old configurations, local accounts included, onto new hardware without changing the passwords. The new firewall starts with secrets nobody has seen before.
Remote access, rebuilt with MFA
The VPN is the part of the firewall attackers target most, so it gets the most care in a replacement.
Current FortiOS releases have moved FortiClient remote access from SSL VPN to IPsec, and we build new remote access on IPsec from the start rather than carrying an old method forward.
Staff sign in to the VPN with their Microsoft 365 account through Microsoft Entra ID, which means the same MFA, the same Conditional Access rules, and access that ends automatically when someone leaves the company. There are no separate VPN passwords to forget, share or leak. Our business VPN page goes into more detail on remote access design.
The swap, and a way back
Changing a firewall is an outage by definition, so we keep it short and reversible. The FortiGate is fully configured and tested before the swap. The switchover itself happens after hours and normally takes under an hour for a single office.
We collect what the internet provider needs beforehand, including static IP addresses and any connection credentials, so nothing is discovered on the night.
The old firewall is not wiped. It stays on the shelf, configured and labelled, until the new one has run through a full working week and every application on the test list has been confirmed by the people who use it. If anything goes wrong, going back is a matter of moving two cables.
After the swap
A new firewall is only as good as the care it gets. We keep FortiOS on a recommended, patched release, schedule updates outside working hours, back up the configuration after every change and renew FortiGuard security subscriptions before they lapse.
If you used MySonicWall cloud backup at any point, we also change the credentials your old firewall knew about, wherever they were reused: VPN pre-shared keys with other offices, LDAP and RADIUS service accounts, and administrator passwords used anywhere else.
For how we choose and size the replacement, see our FortiGate installation and setup page. For supply and licensing, see our Fortinet reseller page, and for the wider network, our networks and firewalls service.
Firewall replacement work we quote
Every replacement is quoted after we have seen the old configuration, so the price reflects the real number of rules, VPNs and sites.
- SonicWall or WatchGuard firewall health and lifecycle checkFixed quote
- Single-office firewall replaced with a FortiGateFixed quote
- Multi-site replacement with site-to-site VPNs rebuiltFixed quote
- Remote access moved to IPsec with Microsoft Entra ID sign-inFixed quote
- Credential rotation after the MySonicWall backup incidentFixed quote
- Patching and hardening of supported SonicWall or WatchGuard unitsFixed quote
Questions people ask
Our SonicWall still works. Why replace it?
Working and safe are different things. Once a SonicWall reaches end of support, it gets no new firmware, so any flaw found afterwards stays open for good. The firewall is the one device every attacker on the internet can reach, which makes it the worst possible place to run unsupported software. If yours is a Gen 7 model that is still supported, we will update it rather than replace it.
We used MySonicWall cloud backup. What should we do?
Assume the configuration file was accessed, because SonicWall confirmed that every customer who used the service was affected. Change the firewall's administrator passwords, VPN pre-shared keys, local user passwords and any LDAP or RADIUS service account passwords it stored, and anywhere those were reused. SonicWall published tools and guidance to help, and we can do it for you.
Is our WatchGuard affected by CVE-2025-9242?
It is if it runs an unpatched Fireware version with an IKEv2 mobile VPN or a branch office VPN using a dynamic gateway peer. Supported versions have fixes from September 2025 onwards, along with later fixes for a second flaw in the same component. Fireboxes on Fireware 11.x received no fix and need replacing.
Why FortiGate rather than a newer SonicWall or WatchGuard?
We are a Fortinet reseller and install and support FortiGate firewalls every week, so we can stand behind them. FortiGate offers strong performance for the price at small-office sizes and a single management approach from one office to many. If you would rather stay with your current brand on supported hardware, we will tell you honestly whether that makes sense.
Can you convert our existing configuration?
Yes. Fortinet's FortiConverter can translate SonicWall and WatchGuard configurations, and we use it as a starting draft. We then review every rule, remove what is no longer needed and change every password and key, rather than copying years of old decisions onto new hardware.
How long will the internet be down during the swap?
For a single office, normally under an hour, scheduled after hours. The FortiGate is configured and tested beforehand, and the old firewall stays ready to plug back in if anything unexpected appears.
Is SonicWall's trade-in program cheaper than switching?
Sometimes. SonicWall's Secure Upgrade Plus program offers trade-in pricing on newer models, and for some offices the numbers are attractive. We compare it honestly with a FortiGate over the full subscription term, not just the first year, and you decide.
What size FortiGate do we need?
It depends on your internet speed, the number of people and devices, how much encrypted traffic you want inspected, and whether you have several sites. Many offices of 10 to 50 people suit a FortiGate 40F, 60F or one of the newer 70 or 90 series models. Our FortiGate page explains the sizing in detail.
Tell us what’s going on
Pick how urgent it is and leave a way to reach you. The help desk replies by phone or email. If work has stopped, call 647-812-3775 instead.
Something broken, or something to plan?
For anything urgent, call. A technician answers the emergency line 24/7. For everything else, open a ticket and tell us what is going on.