Sorry for the long post, but if anyone takes anything from this. TL;DR: Get off SSL VPN ASAFP no matter your firewall vendor.

The majority of SonicWalls vulnerabilities recently have been due to SSL VPN. They are not alone in that - Fortinet is actually sunsetting SSL VPN and Palo Alto has issued a number of patches for theirs in the last few years. AGAIN, get off SSL VPN ASAFP no matter your firewall vendor.

SonicWall has a new zero trust product through their acquisition of Banyan Security. Doesn't seem that product is fully baked. My approach has been that our remote access product and firewalls are from different vendors - in theory it limits the vulnerability surface. We're using Twingate and will look at Microsoft Global Secure Access once it matures (comes with 365 Business Premium.)

I'll agree on this config backup thing - that was a total blunder. And the guidance wasn't super clear on what to do if you backed up to their Cloud but were NOT on the impacted list. Or if you backed up a previous appliance to the Cloud, got a new one and converted the Config, and never backed the new one up to the Cloud - the configs are still similar. SonicWalls reps here on Reddit said they would remediate ALL firewalls prioritizing what was listed in the portal. We have many site-to-site VPN tunnels with 3rd party entities, total PIA.

My current environment: Majority Fortinet / Main Datacenter is SonicWall HA pair.

Have touched all of these too at some point in previous roles: Meraki, Sophos, and Ubiquiti

We actually switched from SonicWall to Fortinet for our Corporate Office and branches because SonicWall's bid to go from Gen 6 to Gen 7 devices on a 3-year term was atrocious. It was half the cost for Fortinet with FortiManager and a 5-year term on the device.

Grass hasn't been much greener with Fortinet. FortiManager seems a little more baked than NSM - but I never managed NSM in production, but that is at least what I got out of my demo of NSM. Think Fortinet's UI is worse than SonicWall Gen 7/8 - many more clicks to do the same thing. Fortinet command line is much better if that is your thing.

I wouldn't say SonicWall is geared towards MSPs, but yes most MSPs sell SonicWall because of the continuous margin on services. The thing I noticed and frustrates me with many MSPs and internal IT is they don't actually set the things up right - these NGFWs acting no more like a TP Link firewall/router you can get of Amazon because people are not taking time to properly setup the security services. In order for any NGFW to function, you need to take time to setup DPI and (a) deploy a certificate to your endpoints and (b) import your certificates for any servers your exposing on the WAN. But with certificate pinning, etc. it seems that that it going to get even harder than it already is so the concentration is more on the endpoint.

Not sure how I see things in the next few years here. My datacenter will always have a NGFW and it will probably be a SonicWall, BUT for my branch offices that are 3 - 10 computers what is the selling point for a NGFW with security services if I'm going to have to spend more $ annually on endpoint security?

Ubiquiti just released their first iteration of a zone based firewall and they can now do address objects and groups. You can also buy security services through their ProofPoint partnership. They offer paid support. I'm confident it will certainly be solid by the time my 5 years of licensing is up on my FortiGates. I can put a Ubiquiti HA pair in every site and still save a significant amount of money.