NSA 6600/5600/4600/ 3600/2650

Advanced threat prevention in a high-performance security platform

Protect your network from the core to the perimeter with industry-validated security effectiveness and performance. The SonicWall Network Security Appliance (NSA) Mid-Range Firewall Series consolidates automated advanced threat prevention technologies in a mid-range next-generation firewall (NGFW) platform. Built on a multi-core hardware architecture featuring 10-GbE interfaces, the NSA Series scales to meet the performance demands of mid-sized networks, branch offices and distributed enterprises. Features such as application intelligence and control, real-time visualization and WLAN management provide the controls to identify, monitor and control application and user traffic across the entire network.

Future-Proof Your Infrastructure

The new NSA 2650 future-proofs your infrastructure with high port density and a large number of simultaneous connections across both wired and wireless networks in an advanced, cost-effective firewall. With eight 2.5 GbE interfaces, the NSA 2650 is one of the first firewalls built to embrace the 802.11ac Wave 2 WiFi standard by matching the wired and the wireless throughput. To meet the continuing increase in the number of connected devices and encrypted connections, the NSA 2650 provides a very high number of stateful packet inspection, deep packet inspection and deep packet inspection of SSL connections.

Go Beyond Threat Detection

It’s not enough to just detect threats. Your firewall needs to prevent them. That’s exactly what SonicWall NSA Series firewalls do. Our patented Reassembly-Free Deep Packet Inspection technology scans traffic for known and unknown threats and removes them before they get into your network. The NSA Series examines every byte of every packet on all ports and protocols regardless of file size. SonicWall’s award-winning Capture Advanced Threat Protection Service provides cloud-based, multi-engine sandboxing that blocks unknown and zero-day attacks at the gateway for added security.

Embrace Innovation

  • Patented Reassembly-Free Deep Packet Inspection (RFDPI) technology
  • On-box and cloud-based threat prevention featuring multi-engine sandboxing, anti-malware, intrusion prevention, web filtering and more
  • Feature-rich SonicOS operating system with intuitive UI
  • 10-Gigabit Ethernet ports
  • Real-time TLS /SSL and SSH decryption and inspection
  • Application visualization and control
  • Built-in wireless controller

Expect High-Speed Performance

The SonicWall NSA Series delivers both high-speed stateful and deep packet inspection firewall performance, with multi-core parallel-processing architecture and multiple Gigabit Ethernet ports. The NSA Series uses single-pass, stream-based, deep packet inspection technology to deliver latency-free performance for simultaneous network streams. The built-in wireless controller enables you to establish high-speed wireless network security by adding SonicWall SonicWave 802.11ac Wave 2 wireless access points.

NSA Appliances & Services

Network Security Appliance 2600

The SonicWall NSA 2600 is designed to address the needs of growing small organizations, branch offices and school campuses.

Network Security Appliance NSA 2650

The NSA 2650 delivers high-speed threat prevention over thousands of encrypted and even more unencrypted connections to mid-sized organizations and distributed enterprises.

Network Security Appliance 3600

The SonicWall NSA 3600 is ideal for branch office and small- to medium-sized corporate environments concerned about throughput capacity and performance.

Network Security Appliance 4600

The SonicWall NSA 4600 secures growing medium-sized organizations and branch office locations with enterprise-class features and uncompromising performance.

Network Security Appliance 5600

The SonicWall NSA 5600 is ideal for distributed,  branch office and corporate environments needing significant throughput.

Network Security Appliance 6600

The SonicWall NSA 6600 is ideal for large distributed and corporate central site environments requiring high throughput capacity and performance.

TotalSecure

Combine a next-generation firewall with the basic network security services (CGSS) required to stop known threats.

With SonicWall TotalSecure Advanced Edition, you get the power of a next-generation firewall and the complete suite of the network security services you need. TotalSecure Advanced Edition helps you stop known and unknown threats like ransomware, viruses, spyware, worms, Trojans and other malware, in a single convenient bundle.

Comprehensive Gateway Security Suite

An integrated package of security technologies that features Gateway Security, Content Filtering Service, 24×7 support to stop known threats.

SonicWall Comprehensive Gateway Security Suite (CGSS) provides you with a single integrated bundle of security technologies designed to stop known threats. Secure your network at the gateway against threats such as intrusions, viruses, spyware, worms, Trojans, adware, keyloggers, malicious mobile code, and other dangerous applications. Enjoy total protection in a convenient, affordable subscription-based service.

Advanced Gateway Security Suite (AGSS)

A complete suite of security services for SonicWall firewalls that features Capture Advanced Threat Protection, Gateway Security, Content Filtering Service and 24×7 support to stop known and unknown threats.

SonicWall Advanced Gateway Security Suite (AGSS) is a complete suite of security services for SonicWall firewalls. An upgrade over SonicWall Comprehensive Gateway Security Suite (CGSS), it features Capture Advanced Threat Protection, a multi-engine sandbox that runs and inspects suspicious files and code in an isolated cloud-based environment.

Gateway Security Services

Combine gateway anti-virus, anti-spyware, intrusion prevention and application intelligence and control for real-time protection against sophisticated attacks.

Discover how SonicWall firewalls with Gateway Security Services combine gateway security anti-virus, anti-spyware, intrusion prevention and application intelligence and control for real-time protection against sophisticated attacks. This service blocked over 2.6 trillion IPS attacks in 2016.

Content Filtering Services

Blocks and manages inappropriate, unproductive, and even illegal and malicious web content for network-based devices.

SonicWall Content Filtering Service (CFS) is a subscription-based add-on service for SonicWall firewall products. This web filtering service blocks inappropriate, unproductive and even illegal and malicious web content for SonicWall customers around the globe.

SonicWall Enforced Anti-Virus and Anti-Spyware

Deploy an innovative multi-layered anti-virus internet security strategy with SonicWall firewalls and Enforced Client Anti-Virus and Anti-Spyware service. You can redirect any user with a non-compliant endpoint to a web page to install the latest Enforced Client Anti-Virus and Anti-Spyware software. Customers around the globe trust it as one of the best anti-spyware software solutions.

Comprehensive Anti-Spam Service (CASS)

Remove junk email at the gateway with one-click activation, and ensure that only legitimate emails reach your email server.

Block email threats and stop spam at the gateway, by adding SonicWall Comprehensive Anti-Spam Service (CASS) to your SonicWall firewall. Rapidly deploy with one-click activation of up to 250 users.

Deep Packet Inspection of SSL Encrypted Traffic (DPI-SSL)

Safeguard your network from encrypted threats with SonicWall Deep Packet Inspection of SSL/TLS and SSH. These add-on security services are available on all SonicWall Next-Generation Firewall (NGFW) and Unified Threat Management (UTM) firewalls. DPI-SSL delivers deep protection against encrypted threats, and scalable SSL decryption and deep packet inspection SSL performance without limitation. It leverages the SonicWall patented Reassembly-Free Deep Packet Inspection engine, a full-stack streaming inspection technology that scans a broad array of encryption protocols including HTTPS, SMTPS, NNTPS, LDAPS, FTPS, Telnets, IMAPS, IRCS, and POPS. For high traffic or highly-regulated deployments, DPI-SSL can exclude trusted sources to optimize network performance, and conform to privacy and/or legal requirements.

Application Control

SonicWall Application Intelligence and Control Service provides the tools administrators need to easily manage privileges and bandwidth for applications, users, groups or devices.

Content Filtering Client

Blocks and manages web content for devices outside the network and can enforce policies established for Content Filtering Service.

The SonicWall Content Filtering Client is a web filtering service that blocks inappropriate, unproductive, illegal and malicious web content for devices outside the network.

Capture Advance Threat Protection

SonicWall Capture Advanced Threat Protection is a cloud-based multi-engine sandbox designed to discover and stop unknown zero-day attacks like ransomware at the gateway with automated remediation.

NSA Series Product Comparison

Specification NSA 2600 NSA 2650 NSA 3600 NSA 4600 NSA 5600 NSA 6600
Firewall inspection throughput 1.9 Gbps 3.0 Gbps 3.4 Gbps 6.0 Gbps 9.0 Gbps 12.0 Gbps
Full DPI throughput 300 Mbps 600 Mbps 500 Mbps 800 Mbps 1.6 Gbps 3.0 Gbps
Application inspection throughput 700 Mbps 1.4 Gbps 1.1 Gbps 2.0 Gbps 3.0 Gbps 4.5 Gbps
IPS throughput 700 Mbps 1.4 Gbps 1.1 Gbps 2.0 Gbps 3.0 Gbps 4.5 Gbps
Anti-malware inspection throughput 400 Mbps 600 Mbps 600 Mbps 1.1 Gbps 1.7 Gbps 3.0 Gbps
IMIX throughput 600 Mbps 700 Mbps 900 Mbps 1.6 Gbps 2.4 Gbps 3.5 Gbps
TLS/SSL Inspection and Decryption (DPI SSL) 200 Mbps 300 Mbps 300 Mbps 500 Mbps 800 Mbps 1.3 Gbps
VPN throughput 1.1 Gbps 1.5 Gbps 1.5 Gbps 3.0 Gbps 4.5 Gbps 5.0 Gbps
Connections per second 15,000/sec 15,000/sec 20,000/sec 40,000/sec 60,000/sec 90,000/sec
Maximum connections (SPI) 500,000 1,000,000 750,000 1,000,000 1,500,000 1,500,000
Maximum connections (DPI) 250,000 500,000 375,000 500,000 1,000,000 1,000,000
Default/Maximum connections (DPI SSL) 1,000/1,000 12,000/13,500 2,000/2,750 3,000/4,500 4,000/8,500 6,000/10,500

Legend: S — Standard,  O — Optional,  N — Not Available

_productName NSA 6600 NSA 5600 NSA 4600 NSA 3600 NSA 2650
TotalSecure Firewall Overview
Deep Packet Inspection Firewall TotalSecure Firewall Overview S S S S S
Stateful Packet Inspection Firewall TotalSecure Firewall Overview S S S S S
Unlimited File Size Protection TotalSecure Firewall Overview S S S S S
Protocols Scanned TotalSecure Firewall Overview S S S S S
Threat Prevention Services Available
Application Intelligence and Control Threat Prevention Services Available S S S S S
Intrusion Prevention Service Threat Prevention Services Available S S S S S
Gateway Anti-Virus and Anti-Spyware Threat Prevention Services Available S S S S S
Content & URL Filtering (CFS) Threat Prevention Services Available S S S S S
SSL Inspection (DPI SSL) Threat Prevention Services Available S S S S S
Content Filtering Client (CFC)1 Threat Prevention Services Available O O O O O
Analyzer Reporting1 Threat Prevention Services Available O O O O O
Capture Advance Threat Protection1 Threat Prevention Services Available O O O O O
Enforced Client Anti-Virus and Anti-Spyware (McAfee®)1 Threat Prevention Services Available O O O O O
24×7 Support Threat Prevention Services Available S S S S S
Firewall General
Interfaces Firewall General 4 x 10-GbE SFP+,
8 x 1-GbE SFP,
8 x 1-GbE,
1 GbE Management,
1 Console
2 x 10-GbE SFP+,
4 x 1-GbE SFP,
12 x 1-GbE,
1 GbE Management,
1 Console
2 x 10-GbE SFP+,
4 x 1-GbE SFP,
12 x 1-GbE,
1 GbE Management,
1 Console
2 x 10-GbE SFP+,
4 x 1-GbE SFP,
12 x 1-GbE,
1 GbE Management,
1 Console
4 x 2.5-GbE SFP,
4 x 2.5-GbE,
12 x 1-GbE,
1 GbE Management,
1 Console
Management Firewall General CLI, SSH, GUI, GMS CLI, SSH, GUI, GMS CLI, SSH, GUI, GMS CLI, SSH, GUI, GMS CLI, SSH, GUI, GMS
Nodes Supported Firewall General Unrestricted Unrestricted Unrestricted Unrestricted Unrestricted
Site-to-Site VPN Tunnels Firewall General 6,000 4,000 3,000 1,000 1,000
IPSec VPN Clients (Maximum) Firewall General 2,000 (6,000) 2,000 (4,000) 500 (3,000) 50 (1,000) 50 (1,000)
SSL VPN NetExtender Clients (Maximum) Firewall General 2 (1,500) 2 (1,000) 2 (500) 2 (350) 2 (350)
VLAN Interfaces Firewall General 500 400 256 256 256
Wireless Controller Firewall General S S S S S
WWAN Failover (4G/LTE) Firewall General S S S S S
Network Switch Management Firewall General S S S S S
Firewall/VPN Performance
Firewall Inspection Throughput2 Firewall/VPN Performance 12 Gbps 9 Gbps 6 Gbps 3.4 Gbps 3 Gbps
Full DPI Throughput (GAV/GAS/IPS)3 Firewall/VPN Performance 3 Gbps 1.6 Gbps 800 Mbps 500 Mbps 600 Mbps
Application Inspection Throughput3 Firewall/VPN Performance 4.5 Gbps 3 Gbps 2 Gbps 1.1 Gbps 1.4 Gbps
IPS Throughput3 Firewall/VPN Performance 4.5 Gbps 3 Gbps 2 Gbps 1.1 Gbps 1.4 Gbps
Anti-Malware Inspection Throughput3 Firewall/VPN Performance 3 Gbps 1.7 Gbps 1.1 Gbps 600 Mbps 600 Mbps
IMIX Throughput Firewall/VPN Performance 3.5 Gbps 2.4 Gbps 1.6 Gbps 900 Mbps 700 Mbps
SSL DPI Throughput3 Firewall/VPN Performance 1.3 Gbps 800 Mbps 500 Mbps 300 Mbps 300 Mbps
VPN Throughput4 Firewall/VPN Performance 5 Gbps 4.5 Gbps 3 Gbps 1.5 Gbps 1.5 Gbps
Latency Firewall/VPN Performance 16 μs 24 μs 17 μs 38 μs 38 μs
Maximum SPI Connections Firewall/VPN Performance 1.5M 1.5M 1M 750K 1M
Maximum DPI Connections Firewall/VPN Performance 1M 1M 500K 375K 500K
Default/Maximum Connections (DPI SSL)5 Firewall/VPN Performance 6,000/10,500 4,000/8,500 3,000/4,500 2,000/2,750 12,000/13,500
New Connections/Sec Firewall/VPN Performance 90,000 60,000 40,000 20,000 15,000
Features
Logging and Reporting Features Analyzer, Local Log, Syslog Analyzer, Local Log, Syslog Analyzer, Local Log, Syslog Analyzer, Local Log, Syslog Analyzer, Local Log, Syslog
Network Traffic Visualization Features S S S S S
Netflow/IPFIX Reporting Features S S S S S
SNMP Features S S S S S
Authentication Features LDAP (multiple domains), XAUTH/RADIUS, SSO, Novell, Terminal Services, Citrix LDAP (multiple domains), XAUTH/RADIUS, SSO, Novell, Terminal Services, Citrix LDAP (multiple domains), XAUTH/RADIUS, SSO, Novell, Terminal Services, Citrix LDAP (multiple domains), XAUTH/RADIUS, SSO, Novell, Terminal Services, Citrix LDAP (multiple domains), XAUTH/RADIUS, SSO, Novell, Terminal Services, Citrix
Dynamic Routing Features BGP, OSPF, RIP BGP, OSPF, RIP BGP, OSPF, RIP BGP, OSPF, RIP BGP, OSPF, RIP
Single Sign-on (SSO) Features S S S S S
Voice over IP (VoIP) Security Features S S S S S
PortShield Security Features S S S S S
Port Aggregation Features S S S S S
Link Redundancy Features S S S S S
Policy-based Routing Features S S S S S
Route-based VPN Features S S S S S
Dynamic Bandwidth Management Features S S S S S
Stateful High Availability Features S S S O O
Multi-WAN Features S S S S S
Load Balancing Features S S S S S
Object-based Management Features S S S S S
Policy-based NAT Features S S S S S
IKEv2 VPN Features S S S S S
TLS/SSL/SSH Decryption and Inspection Features S S S S S
SSL Control Features S S S S S
Auto-provision VPN Features S S S S S
Active/Active Cluster Features S S S S S
Terminal Services Authentication/Citrix Support Features S S S S S
Biometric Authentication Features S S S S S
DNS Proxy Features S S S S S
Harware Failover Features Active/Passive with State Sync, Active/Active DPI with State Sync, Active/Active Clustering Active/Passive with State Sync, Active/Active DPI with State Sync, Active/Active Clustering Active/Passive with State Sync, Active/Active Clustering Active/Passive with State Sync, Active/Active Clustering Active/Passive with State Sync
  1. Services must be purchased separately.
  2. Testing Methodologies: Maximum performance based on RFC 2544 (for firewall). Actual performance may vary depending on network conditions and activated services.
  3. Full DPI/Gateway AV/Anti-Spyware/IPS throughput measured using industry standard Spirent WebAvalanche HTTP performance test and Ixia test tools. Testing done with multiple flows through multiple port pairs.
  4. VPN throughput measured using UDP traffic at 1280 byte packet size adhering to RFC 2544.
  5. For every 125,000 DPI connections reduced, the number of available DPI SSL connections increases by 750.

NSA Series Purchase Options

Product

NSA 5600 TotalSecure Advanced Edition (1-year)

£16,302.54 (ex. VAT)Add to Basket

Services

Advanced Gateway Security Suite – Capture ATP, Threat Prevention, Content Filtering and 24×7 Support for NSA 5600 (1-year)

£6,863.56 (ex. VAT)Add to Basket

Capture Advanced Threat Protection for NSA 5600 (1-year)

£2,012.71 (ex. VAT)Add to Basket

Threat Prevention – Intrusion Prevention, Gateway Anti-Virus, Gateway Anti-Spyware, Cloud Anti-Virus for NSA 5600 (1-year)

£2,159.50 (ex. VAT)Read more

Gold 24×7 Support for NSA 5600 (1-year)

£2,052.89 (ex. VAT)Read more

Content Filtering Service for NSA 5600 (1-year)

£2,355.37 (ex. VAT)Read more

Enforced Client Anti-Virus & Anti-Spyware Based on user count Comprehensive Anti-Spam Service for NSA 5600 (1-year)

£3,925.62 (ex. VAT)Read more

View all services with license periods from 1-5 years

Management and Reporting

SonicWall GMS 10 Node Software License

£2,170.93 (ex. VAT)Read more

SonicWall GMS E-Class 24×7 Software Support for 10 node (1-year)

£337.87 (ex. VAT)Add to Basket

Modules and Accessories

10GBASE-SR SFP+ Short Reach Module

£962.70 (ex. VAT)Add to Basket

10GBASE-LR SFP+ Long Reach Module

£1,705.89 (ex. VAT)Add to Basket

10GBASE SFP+ 1M Twinax Cable

£368.15 (ex. VAT)Add to Basket

10GBASE SFP+ 3M Twinax Cable

£516.79 (ex. VAT)Add to Basket

1000BASE-SX SFP Short Haul Module

£442.47 (ex. VAT)Add to Basket

1000BASE-LX SFP Long Haul Module

£442.47 (ex. VAT)Add to Basket

1000BASE-T SFP Copper Module

£368.15 (ex. VAT)Add to Basket

Product

NSA 6600 TotalSecure Advanced Edition (1-year)

£29,646.61 (ex. VAT)Add to Basket

Services

Advanced Gateway Security Suite – Capture ATP, Threat Prevention, Content Filtering and 24×7 Support for NSA 6600 (1-year)

£12,481.36 (ex. VAT)Add to Basket

Capture Advanced Threat Protection for NSA 6600 (1-year)

£3,660.17 (ex. VAT)Add to Basket

Threat Prevention–Intrusion Prevention, Gateway Anti-Virus, Gateway Anti-Spyware, Cloud Anti-Virus for NSA 6600 (1-year)

£3,926.45 (ex. VAT)Read more

Gold 24×7 Support for NSA 6600 (1-year)

£4,104.96 (ex. VAT)Read more

Content Filtering Service for NSA 6600 (1-year)

£4,283.47 (ex. VAT)Read more

Enforced Client Anti-Virus & Anti-Spyware Based on user count Comprehensive Anti-Spam Service for NSA 6600 (1-year)

£7,138.84 (ex. VAT)Read more

View all services with license periods from 1-5 years

Management and Reporting

SonicWall GMS 10 Node Software License

£2,170.93 (ex. VAT)Read more

SonicWall GMS E-Class 24×7 Software Support for 10 node (1-year)

£337.87 (ex. VAT)Add to Basket

Modules and Accessories

10GBASE-SR SFP+ Short Reach Module

£962.70 (ex. VAT)Add to Basket

10GBASE-LR SFP+ Long Reach Module

£1,705.89 (ex. VAT)Add to Basket

10GBASE SFP+ 1M Twinax Cable

£368.15 (ex. VAT)Add to Basket

10GBASE SFP+ 3M Twinax Cable

£516.79 (ex. VAT)Add to Basket

1000BASE-SX SFP Short Haul Module

£442.47 (ex. VAT)Add to Basket

1000BASE-LX SFP Long Haul Module

£442.47 (ex. VAT)Add to Basket

1000BASE-T SFP Copper Module

£368.15 (ex. VAT)Add to Basket