Does a SonicWall keep passing traffic when the license expires?

Yes, on every model except the TZ80. SonicWall documents that all Gen 8 models other than the TZ80 can operate as hardware only, like previous generations. The security services stop; the firewall keeps forwarding. The TZ80 passes traffic for 90 days after expiry and then stops.

Is there a 30-day grace period on SonicWall security services?

Only on the TZ80, and there it is a 30-day configurable window followed by 60 more days of traffic without configuration changes. For other TZ and NSa models SonicWall documents no grace period: the security services stop at expiry.

If a SonicWall license lapsed, does the renewal start today or on the old date?

On the old date. SonicWall retroactively activates new agreements to the expiration of the most recent agreement, and charges a reinstatement fee. The fee is waived on 2- and 3-year agreements, and a SonicProtect subscription waives both the fee and the back-dating.

What is the difference between EPSS and APSS?

Essential covers Capture ATP, Gateway Anti-Virus, IPS, Application Control, Content Filtering, Anti-Spam, and 24x7 support, on Gen 7 TZ only. Advanced adds DNS filtering, NSM management, 7 days of analytics, and a Cysurance warranty, and is the suite available on Gen 8.

Can I co-term several SonicWall licenses to one date?

Yes, for free, in MySonicWall under Product Management > Service Cotermination. It prorates the remaining value of each active service to a common date. Expired services have to be renewed first.

Can I still renew a TZ400 or TZ350?

They reach End of Support on August 1 and October 1, 2026 respectively. In SonicWall's lifecycle, End of Support ends firmware, support, and RMA, while security service subscriptions may continue until End of Life. Check the lifecycle table for the current phase before quoting.

SonicWall license renewals: what MSPs need to know

Essential, Advanced, and Managed Protection suites, what SonicWall actually documents about expiry (and the TZ80 exception), retroactive activation and the reinstatement fee, free co-termination in MySonicWall, the six-phase product lifecycle, and where the expiration date lives.

Last checked against SonicWall documentation on September 2, 2026. Vendor policies change; the sources at the bottom are the record.

SonicWall firewalls, with one exception, run without a subscription. SonicWall's Gen 8 FAQ says the TZ80 is the only model that currently requires an active subscription to operate, and every other model can run as hardware only. On the rest of the fleet, expiry means the security services stop and the firmware entitlement ends, while the firewall keeps forwarding packets.

Two SonicWall specifics change how you renew. Late renewals are retroactively activated to the previous expiration date and carry a reinstatement fee that SonicWall waives on 2- and 3-year agreements. And co-termination is free and self-service in MySonicWall, which makes aligning a client's fleet to one date cheaper here than with any other vendor on this site.

SonicWall license tiers

Tier	What it includes
Hardware only	The appliance with no security services. Gen 8 TZ and NSa models list Hardware Only as a supported option; the TZ80 does not.
Essential Protection Service Suite (EPSS)	Capture ATP with RTDMI, Gateway Anti-Virus, IPS, Application Control, Content Filtering, Comprehensive Anti-Spam, network visibility, and 24x7 support. Since May 1, 2025 it also includes Network Security Manager with 7-day alerting and basic reporting. Gen 7 TZ models only.
Advanced Protection Service Suite (APSS)	Everything in EPSS plus DNS filtering, NSM management, 7 days of advanced reporting and analytics, and a Cysurance cyber warranty up to $100,000. Gen 7 and Gen 8.
Managed Protection Service Suite (MPSS)	APSS plus 30-day reporting, 24x7 monitoring, configuration management, scheduled firmware updates, monthly health checks, and Cysurance up to $200,000. Sold only to partners in the SonicWall Service Provider Program, in 1-, 2-, or 3-year terms or monthly.
Legacy: AGSS / CGSS / TPSS	AGSS and CGSS are the Gen 5, 6, and 6.5 suites; AGSS includes Capture ATP, CGSS does not. Threat Protection Service Suite was retired worldwide on May 1, 2025 with EPSS as the upgrade path. A SonicProtect subscription delivers the top tier for any generation.

SonicWall's services page states EPSS is only available for Gen 7 TZ models, and its Gen 8 FAQ lists Hardware Only, APSS, and MPSS for the new generation with no EPSS. Confirm which suite a given model can still buy before quoting.

Available terms

For Gen 7 TZ, SonicWall documents TotalSecure bundles in 1- and 3-year terms, Secure Upgrade Plus bundles in 2- and 3-year terms, and a la carte services from 1 to 5 years. Reseller catalogs list APSS for the TZ370 in 1-, 2-, 3-, and 5-year SKUs and EPSS in 2-, 3-, and 5-year SKUs.

MPSS is sold in 1-, 2-, and 3-year terms or monthly. SonicProtect subscriptions are 3- and 5-year only and cannot be stacked.

The term matters more with SonicWall than most vendors because the reinstatement fee on a lapsed renewal is waived for 2- and 3-year agreements.

What happens when a SonicWall license expires

On every model except the TZ80 the firewall keeps operating as hardware. SonicWall documents that when a subscription expires the security services stop, and describes that as consistent with the licensing behavior of its existing firewalls. SonicWall does not publish a per-service list for standard TZ and NSa models, so treat Gateway Anti-Virus, IPS, Capture ATP, Content Filtering, Application Control, and DPI-SSL as all stopping together.

Firmware is a license too. SonicWall states that every appliance requires a Software and Firmware Update license to download and upgrade firmware, so an expired suite also means no firmware.

The TZ80 is the exception and has the only documented grace period. For days 1 to 30 after expiry it stays configurable and passes traffic. For days 31 to 90 it passes traffic but cannot be configured. After day 90 it stops passing traffic. A banner in the UI and CLI prompts for renewal throughout.

For every other model, no grace period on security services is documented. A SonicWall knowledge base article titled "Grace period expired" refers to management-system licensing, not firewall services, and is easy to misread.

The Licenses page on the firewall shows a status of Expired with the date, and Network Security Manager's license details flag licenses nearing expiration.

Renewing after a lapse

SonicWall documents that new agreements are retroactively activated to the expiration date of the most recent warranty or support agreement. A lapsed device therefore pays for the gap.

A lapsed renewal also carries a reinstatement fee. Reinstatement plus a new 1-year agreement gives 12 months from the activation date, and the reinstatement includes a one-time firmware update. The fee is waived on 2- and 3-year agreements, and the reinstatement key must be activated before the support key.

A SonicProtect subscription applied to an expired or never-licensed firewall waives both the reinstatement fee and the back-dating, which makes it the cleanest way to bring a long-lapsed device current.

SonicWall does not publish a time cutoff after which back-dating stops.

Co-terming

Co-termination is free for active contracts and can be done for a single device or every device in the account. MySonicWall prorates the remaining dollar value of each service to a common end date, with a minimum of two services. Expired services must be renewed before they can be included.

The path is MySonicWall > Product Management > Service Cotermination, selecting all services in a bundle together. SonicWall says to allow about 30 minutes, then synchronize licenses on the firewall.

Because it is self-service and free, the practical approach is to renew each device on its natural date and co-term the account in MySonicWall afterward, rather than paying for odd-length terms on the quote.

End of sale and end of life

SonicWall's lifecycle has six phases. Last Day Order is informational and support is still sold. Active Retirement Mode lasts two years with support contracts available. The 1-Year Support Last Day Order is the last day a 1-year support or bundle can be bought. Limited Retirement Mode lasts three years with critical fixes only. End of Support means no support, firmware, or RMA, though security service subscriptions may continue. End of Life is when subscriptions are discontinued.

The TZ270 and TZ470 reached Last Day Order on June 30, 2026, with the TZ280 and TZ480 as replacements. The dates below are from SonicWall's lifecycle table and last-time-buy notices. The TZ370, TZ570, and TZ670 did not appear on the table as of the check date.

Model	End of sale	End of life / support	Note
TZ270 / TZ470	2026-06-30	—	Last Day Order. Replacements TZ280 / TZ480. Later phases not yet published.
TZ350	2022-04-15	2026-10-01	End of Support. Limited Retirement ended 2025-09-30.
TZ400	2022-04-15	2026-08-01	End of Support. Limited Retirement ended 2025-07-31.
SOHO 250	2021-07-31	2026-10-01	End of Support. 1-year support last order was 2023-08-01.
NSa 2700 / NSa 3700	2025-10-31	2030-11-01	Last Day Order / End of Support. 1-year support last order 2029-11-01.
TZ370 / TZ570 / TZ670	—	—	Not on the lifecycle table as of the check date.

Where to find the expiration date

MySonicWall: My Workspace > Products, open the serial, then the Licenses tab. Every SonicWall appliance must be registered to a MySonicWall account, so this is the authoritative view.
Firewall: SonicOS 7 at Device > Settings > Licenses; SonicOS 6.5 at Manage > Licenses. The firewall synchronizes with MySonicWall daily.
Network Security Manager: build a Subscriptions report under Reports > Rules > Add > Management, or read the License Details view, which flags licenses nearing expiration.

How the renewal moves

Outside North America, SonicWall directs renewals to its sales and renewals mailbox; in North America the MySonicWall Renewal Manager can quote directly. Renewal Manager quotes default to Reseller Managed and switch to Program Managed after 75 days, so a reseller who wants the renewal has to act inside that window.

Through distribution, SKUs follow the 02-SSC-xxxx pattern, for example 02-SSC-6625 for EPSS on a TZ370 for one year and 02-SSC-6529 for APSS. MPSS uses 03-SSC. The activation key arrives by email and is applied to the registered serial in MySonicWall, then synchronized on the firewall.

Resellers ask for the serial number to identify the renewal, and the key is tied to the registered serial, so the serial belongs on the pricing request.

How MSP Renewals tracks SonicWall

MSP Renewals stores each SonicWall with its serial number, the suite you sell it on (Advanced Protection, Essential Protection, or support only), the term you normally quote, and the expiration date you enter or sync. It alerts at 90, 30, and 5 days, drafts the renewal quote at 90 days, and can send the pricing request to your distributor automatically with the serial, suite, term, and your reference number.

The pricing request carries the end-of-support date for the TZ350, TZ400, and SOHO 250 so a term is not bought past the hardware's life, and notes when a license has lapsed so the distributor quotes the reinstatement and back-dating up front. When the client approves, the device's expiration rolls forward by the term you sold and the countdown restarts.

Start Free Trial $29/mo founder pricing

SonicWall renewal questions

Does a SonicWall keep passing traffic when the license expires?: Yes, on every model except the TZ80. SonicWall documents that all Gen 8 models other than the TZ80 can operate as hardware only, like previous generations. The security services stop; the firewall keeps forwarding. The TZ80 passes traffic for 90 days after expiry and then stops.
Is there a 30-day grace period on SonicWall security services?: Only on the TZ80, and there it is a 30-day configurable window followed by 60 more days of traffic without configuration changes. For other TZ and NSa models SonicWall documents no grace period: the security services stop at expiry.
If a SonicWall license lapsed, does the renewal start today or on the old date?: On the old date. SonicWall retroactively activates new agreements to the expiration of the most recent agreement, and charges a reinstatement fee. The fee is waived on 2- and 3-year agreements, and a SonicProtect subscription waives both the fee and the back-dating.
What is the difference between EPSS and APSS?: Essential covers Capture ATP, Gateway Anti-Virus, IPS, Application Control, Content Filtering, Anti-Spam, and 24x7 support, on Gen 7 TZ only. Advanced adds DNS filtering, NSM management, 7 days of analytics, and a Cysurance warranty, and is the suite available on Gen 8.
Can I co-term several SonicWall licenses to one date?: Yes, for free, in MySonicWall under Product Management > Service Cotermination. It prorates the remaining value of each active service to a common date. Expired services have to be renewed first.
Can I still renew a TZ400 or TZ350?: They reach End of Support on August 1 and October 1, 2026 respectively. In SonicWall's lifecycle, End of Support ends firmware, support, and RMA, while security service subscriptions may continue until End of Life. Check the lifecycle table for the current phase before quoting.