SonicOS 7 Upgrade Guide

Obtaining the Latest SonicOS Firmware

To obtain a new SonicOS firmware image file for your SonicWall security appliance:

1. In a browser on your management computer, log into your MySonicWall account at https://www.mysonicwall.com.
2. In MySonicWall, navigate to Product Management > My Products in the left navigation pane to display the list of your registered appliances.
3. Mouse over the row that displays your appliance model. Options appear at the right side of the row.
4. Click the [download-icon] icon.
5. Click the Browse All Firmware button to display all available firmware versions.
6. Mouse over the row for the firmware you want. Options appear at the right.
7. Click the [download-icon] icon to download the firmware to your computer, and click the [pdf-icon] icon to display the Release Notes.

Creating a System Backup and Exporting Your Settings

Before beginning the upgrading process, make a system backup on your SonicWall appliance. When you create a backup, the SonicWall security appliance takes a "snapshot" of your current system state and configuration preferences, and makes the snapshot the new backup file. You can save backups locally on the appliance or on the cloud. You can also schedule backups to occur automatically.

• On SonicWall NSa Series appliances, the backup feature saves a copy of the current system state, firmware, and configuration settings on your appliance, protecting all your existing settings in the event that it becomes necessary to return to a previous configuration state.
• On SonicWall TZ Series firewalls, you can create a backup of your current configuration settings to be used with the current firmware version or with a newly uploaded firmware version. The current firmware image itself is not included in the backup.

You can save multiple local backup files and multiple cloud backups for multiple firmware versions. If more than one backup is saved per firmware version, click the [arrow-icon] next to the version to expand the list and view the saved configuration backups. From there, you can boot the current or new firmware image with any of the backed up configurations.

You can also export the appliance configuration settings to a file on your local management station. This file serves as an external backup of the configuration settings, and can be imported into another appliance or into the same appliance if it is necessary to reboot the firmware with factory default settings.

To save a system backup and export configuration settings to a file on your local management station:

1. In SonicOS 7.0, in the DEVICE view, navigate to Settings > Firmware and Settings.
2. In SonicOS 6.5, in the MANAGE view, navigate to Updates | Firmware & Backups.
3. Click Create Backup and select one of the following:
   • Local Backup – On an NSa Series firewall, SonicOS takes a "snapshot" of your current system state, firmware, and configuration preferences, and saves it as the latest local backup file. On a TZ Series firewall, SonicOS saves a small file on the appliance with all your configuration settings. In the Local Backup dialog, optionally select Retain Local Backup to prevent this backup from being overwritten by a future local backup. Optionally enter a comment in the Comment field, and then click OK to proceed with the backup.
   • Cloud Backup – The Cloud Backup dialog is displayed. Optionally select Retain Local Backup to prevent this backup from being overwritten by a future cloud backup. You can retain a maximum of 3 configuration backup files per firmware version. Optionally enter a comment in the Comment field, and then click OK to proceed with the backup.
4. To export your settings to a local file on your management computer, click Import/Export Configuration and select Export Configuration. In the popup dialog, which displays the name of the saved file, click Export to complete the process.

Scheduling Automatic Backups

You can schedule automatic backups of your configuration settings. SonicWall recommends this after you have upgraded your firewall to the latest firmware.

[note-icon] NOTE: Cloud Backup must be enabled before you can schedule backups of your configuration settings. This feature is not supported for Local Backup.

To schedule a backup:

1. Navigate to Device | Settings > Firmware and Settings.
2. Click Create Backup > Schedule Backup.
3. In the Schedule Backup dialog, select the options you want to use:
   • For a one-time backup, select Once as the Schedule Type, then use the calendar to set the date and time.
   • For a recurring backup, select Recurring as the Schedule Type, then set the days and times.
   • For a mixed schedule backup, select Mixed as the Schedule Type, then set the days and times.
4. When finished, click Save.

For detailed instructions, refer to the SonicOS 7 Device Settings administration guide, available on the SonicWall technical documentation portal at https://www.sonicwall.com/support/technical-documentation/?language=English&category=Firewalls

Upgrading Firmware with Current Settings

You can update the SonicOS image on a SonicWall security appliance remotely if the LAN or WAN interface is configured for management access. On SonicWall NSa platforms, you can also connect directly to the MGMT port and point your browser to that IP address (http://192.168.1.254 by default) to log in and perform the upgrade.

To upload new firmware to your SonicWall appliance and use your current configuration settings upon startup:

1. Download the SonicOS firmware image file from MySonicWall and save it to a location on your local computer.
2. Point your browser to the appliance IP address, and log in as an administrator.
3. In the DEVICE view, on the Settings > Firmware and Settings page, click Upload Firmware.
4. In the Backup of current settings popup dialog, click OK to continue with the firmware upload.
5. In the Upload Firmware dialog, browse to the location where you saved the SonicOS firmware image file, select the file, and click Upload. After the firmware finishes uploading, it is displayed in the table under LOCAL.
6. On the Firmware and Settings page, click the Boot icon in the Uploaded Firmware Version row and select Boot firmware with Current Configuration.
7. In the Warning dialog box, click OK. The appliance restarts and displays the login page.
8. Enter your user name and password. Your new SonicOS image version information is displayed on the Settings > Status page.

Upgrading Firmware with Factory Default Settings

To upload new firmware to your SonicWall appliance and restart it using the default configuration:

1. Download the SonicOS firmware image file from MySonicWall and save it to a location on your local computer.
2. Point your browser to the appliance IP address, and log in as an administrator.
3. In the DEVICE view, on the Settings > Firmware and Settings page, use Create Backup to create a local or cloud backup. Wait for the backup to complete.
4. Click Upload Firmware.
5. In the Backup of current settings popup dialog, click OK to continue with the firmware upload.
6. In the Upload Firmware dialog, browse to the location where you saved the SonicOS firmware image file, select the file, and click Upload. After the firmware finishes uploading, it is displayed in the table under LOCAL.
7. On the Firmware and Settings page, click the Boot icon in the Uploaded Firmware Version row and select Boot firmware with Factory Default Configuration.
8. In the Warning dialog box, click OK. The appliance restarts. When you access the firewall again, it displays the options to launch the Setup Wizard or go to the login page of the SonicOS management interface.

[note-icon] NOTE: The IP address for the X0 (LAN) interface reverts to the default, 192.168.168.168. You can log into SonicOS by connecting to X0 and pointing your browser to https://192.168.168.168. On SonicWall NSa platforms, you can also log in by connecting to the MGMT port and pointing your browser to http://192.168.1.254.

9. Enter the default user name and password (admin/password) to access the SonicOS management interface.

Using SafeMode to Upgrade Firmware

If you are unable to connect to the SonicOS management interface, you can restart the SonicWall security appliance in SafeMode. The SafeMode feature allows you to quickly recover from uncertain configuration states with a simplified management interface that includes some of the functionality available in the DEVICE | Settings > Firmware and Settings page.

When you access the SafeMode interface in your browser, you will be prompted to enter the Maintenance Key for your appliance.

• In SonicOS 7.0.0, you must obtain the Maintenance Key from MySonicWall.
• In SonicOS 7.0.1, you can use the Auth Code as the key if your firewall is unregistered. The Auth Code is available on the label on the appliance bottom, or in the SonicOS web management interface. After the appliance is registered, you will need to use the Maintenance Key, which is available from MySonicWall.

The SafeMode procedure uses a recessed reset button in a small pinhole, called the SafeMode button:

• On NSa platforms, the Safemode button is near the X0 port and above the power button on the front of the appliance.
• On TZ platforms, the button is next to the power connection on the back of the appliance.

To obtain the Maintenance Key for your appliance:

1. Log into your MySonicWall account at https://www.mysonicwall.com.
2. Navigate to Product Management > My Products and locate your firewall in the table.
3. Move your mouse pointer to the end of the row to expose the buttons and then click on the Information button.

In the Product Details screen, move your mouse pointer over the [eye-icon] icon next to Maintenance Key. The key value is displayed in a popup until you move your mouse. Make a note of the key.

To use SafeMode to upgrade firmware on a SonicWall security appliance:

1. Do one of the following to connect your computer directly to the appliance: On a SonicWall NSa, connect your computer to the MGMT port on the appliance and configure your computer with an IP address on the 192.168.1.0/24 subnet, such as 192.168.1.20. On a SonicWall TZ, connect your computer to the X0 port on the appliance and configure your computer with an IP address on the 192.168.168.0/24 subnet, such as 192.168.168.20.
2. Use a narrow, straight object, like a straightened paper clip or a toothpick, to press the SafeMode button. On a TZ, press and hold the SafeMode button for approximately 60 seconds. On an NSa Series appliance, press the button, but you do not need to hold it down. The [wrench-led-icon] LED starts blinking when the appliance has rebooted into SafeMode.
3. Do one of the following to access the SafeMode management interface:
   • On a SonicWall NSa, point your browser to http://192.168.1.254.
   • On a SonicWall TZ, point your browser to https://192.168.168.168.
4. In the Maintenance Key prompt, type in or paste the key you got from MySonicWall and then click Authenticate. If your appliance is running SonicOS 7.0.1 and is not yet registered, use its Auth Code as the key.

The SafeMode interface displays.

5. Click Upload Image, and then browse to the location where you saved the SonicOS firmware image, select the file, and click Upload.
6. Click the Boot button in the row for Available Image Version and select one of the following:
   • Boot Available Image with Current Configuration Use this option to restart the appliance with your current configuration settings.
   • Boot Available Image with Factory Default Configuration Use this option to restart the appliance with factory default configuration settings. The configuration settings revert to default values, but logs and local backups remain in place.
   • Boot Available Image with Backup Configuration Use this option to restart the appliance with saved backup configuration settings. You can choose which backup to use.
7. In the confirmation dialog, click Boot to proceed.
8. Wait while the firmware is installed, then booted.
9. After successfully booting the firmware, if the login screen is not displayed, point your browser to the firewall IP address. If you booted with factory default settings, the default IP address of the X0 interface is 192.168.168.168. Enter the default user name and password (admin / password) to access the SonicOS management interface. On a SonicWall NSa, you can continue to manage the appliance from the MGMT interface at 192.168.1.254. On all SonicWall platforms, you can manage the appliance from the X0 interface, another LAN interface, or from a WAN interface, if configured.
10. To manage the appliance from an interface other than the one to which your computer is physically connected:
    • a. Disconnect your computer from the appliance.
    • b. Reconfigure your computer to automatically obtain an IP address and DNS server address, or reset it to its normal static values.
    • c. Connect your computer to your network or to the desired interface on the appliance. If the appliance is managed from any interface other than the default LAN (X0) and the computer used to manage the appliance is set to automatically obtain an IP address and DNS server, a static or dynamic DHCP lease scope must be configured in SonicOS for that interface.
    • d. Point your browser to the appropriate WAN or LAN IP address of the appliance.

Configuration Settings Import Support by Version

[note-icon] NOTE: SonicOS 6.5.1.3 is the minimum version generally supported for settings import to a firewall running SonicOS 7.

[note-icon] NOTE: Existing settings for Global Bandwidth Management, Virtual Assist and Content Filter Client Enforcement cannot be imported into SonicOS 7. Global Bandwidth Management is replaced by Advanced Bandwidth Management, and the other features are deprecated in SonicOS 7. For more information about configuring Advanced Bandwidth Management, refer to the knowledgebase article How Can I Configure Advanced Bandwidth Management On Gen 7? at https://www.sonicwall.com/support/knowledge-base/how-can-i-configure-advanced-bandwidth-management-on-gen-7/200818093436630/.

If answer is "Y" above, see the table in the next section for your specific products

If answer is "N" above, this configuration import is not supported

[note-icon] NOTE: Configuration settings import to a firewall running SonicOS 7 from any SonicOS 6.x version prior to SonicOS 6.5.1.3 is supported as a two-step process:

1. Upgrade the firewall from SonicOS 6.x to SonicOS 6.5.1.3 or higher.
2. Export settings from the upgraded firewall and then import them to the firewall running SonicOS 7.

Configuration Settings Import Support by Platform

The matrix in this section shows the SonicWall firewalls running SonicOS 6.5 or 7.0 whose configuration settings can be imported to SonicWall platforms running SonicOS 7.0.

[note-icon] NOTE: Settings import is supported from a SOHO running SonicOS 5.9 to SonicWall platforms running SonicOS 7.0. This is a special case, as the SOHO cannot run SonicOS 6.5.

In the matrix, the source firewalls are in the left column, and the destination firewalls are listed across the top.

The legend for the above table is:

• Y: Supported through SonicOS and/or Migration Tool
• N: Unsupported. While importing the settings file may be successful, firewall limitations may result in the removal of items such as DHCP scopes, VPN settings, etc.
• C: Configuration information from extra interfaces will be removed. NAT policies, Firewall access rules, and other interface-dependent configuration will also be removed. Built-in wireless configuration will be removed.

You can access the SonicWall Migration Tool at https://migratetool.global.sonicwall.com/.