From SonicWall to OPNsense
SonicWall firewalls are common among mid-sized companies. Actively exploited vulnerabilities in the SSL VPN and the unauthorised access to configurations backed up in the vendor cloud, reported in 2025, have unsettled many operators.
At a glance
- Source
- SonicWall
- Target
- OPNsense Business Edition
- Cutover
- usually 1–2 hours
- Fallback
- until sign-off
Starting point
Why operators switch
SonicOS ties Gateway AV, IPS, Content Filtering and Capture ATP to licence bundles, and management runs via the vendor’s cloud services. Many operators want to regain control of their own configuration.
Typical reasons
- recurring emergency patches for the SSL VPN
- concerns about configuration backups in the vendor cloud
- annual licence bundles for security services
- preference for open code and a European vendor
Features
What becomes of your SonicWall features
| SonicWall | OPNsense | Note |
|---|---|---|
| Zones, address objects | Interfaces, aliases | zone logic is translated into interface rules |
| Access Rules | Interface rules, floating rules | logic is translated |
| NAT Policies | NAT | fully supported |
| Site-to-site VPN | IPsec (IKEv2) | peers are coordinated |
| SSL VPN (NetExtender), Global VPN Client | WireGuard or OpenVPN with 2FA | new client profiles |
| IPS | Suricata IPS | ET Open, optional commercial |
| Content Filtering, App Control | Zenarmor or proxy categories | policies are rebuilt |
| Gateway AV, Capture ATP | – | protection on endpoint and mail gateway |
| High Availability | CARP cluster with state sync | maintenance without interruption |
| Cloud management and backup | local backup, OPNcentral, API | configuration stays with you |
Approach
How we migrate
Process
- Export of the SonicOS configuration, analysis of zones and access rules
- Clean-up of unused rules and objects
- Translation of zones, rules, NAT and VPNs
- Rebuild of web and application filtering
- Cutover in a maintenance window, SonicWall as fallback
- Follow-up support and documentation
What to watch out for
- Zone model: SonicOS thinks in zone pairs, while OPNsense evaluates rules inbound per interface.
- Credentials: if configuration backups were stored externally, we renew all VPN keys, pre-shared keys and passwords.
- Gateway AV: we move file scanning to the endpoint and mail gateway.
The general process in five steps is described under Migrating to OPNsense.
FAQ
Questions about migrating from SonicWall
Do we need to renew credentials?
If configurations were backed up in the vendor cloud, yes. During the migration we reset all keys and passwords anyway.
How long does the switch take?
For a single site, usually a few days of preparation and a maintenance window of one to two hours.
Contact
Send us your configuration export
We will tell you what can be transferred directly, what cannot and what the migration will cost.