TZ280
The entry point to Gen 8: 2.5 Gbps of firewall inspection and eight gigabit ports in a fanless desktop unit.
Full specs and SKUsSonicWall · TZ Series Gen 8
TZ280 vs TZ380
Of the 58 specifications SonicWall publishes across these two models, 21 differ. The differences are listed first, then what the step up actually buys and which model fits which site, then every row side by side.
The two models
TZ380
3.5 Gbps of firewall inspection and two 5G/2.5G SFP+ uplinks, for a branch outgrowing gigabit.
Full specs and SKUsKey differences
The rows most buyers check first. All 21 differences are in the full table below.
-
Firewall Inspection Throughput
TZ2802.5 Gbps
TZ3803.5 Gbps
-
Threat Prevention Throughput
TZ2801 Gbps
TZ3801.5 Gbps
-
Application Inspection Throughput
TZ2801.5 Gbps
TZ3802 Gbps
-
IPS Throughput
TZ2801.5 Gbps
TZ3802 Gbps
-
Anti-Malware Inspection Throughput
TZ2801 Gbps
TZ3802 Gbps
-
TLS/SSL Inspection and Decryption Throughput
TZ280430 Mbps
TZ380600 Mbps
Which one fits
Stepping up from the TZ280 to the TZ380 moves threat-prevention throughput from 1 Gbps to 1.5 Gbps (1.5×), IPS throughput from 1.5 Gbps to 2 Gbps (+33%) and firewall inspection throughput from 2.5 Gbps to 3.5 Gbps (+40%). Neither choice moves the connection table (1,000,000 against 1,100,000) or the site-to-site tunnel count (both 200), so a site held back by how many flows can be live at once gains nothing from the TZ380. The TZ280 is in fact ahead on power draw: 12.36 W against 13.77 W.
Choose the TZ280 if
- Threat-prevention throughput is already enough at 1 Gbps: the TZ380 adds 1.5× you will not use.
- The TZ280 is ahead on power draw: 12.36 W against 13.77 W.
- Your limit is how many flows can be live at once, which the step up does not move: 1,000,000 against 1,100,000.
Choose the TZ380 if
- Threat-prevention throughput has to go past 1 Gbps: the TZ380 publishes 1.5 Gbps.
- IPS throughput has to go past 1.5 Gbps: the TZ380 publishes 2 Gbps.
- Firewall inspection throughput has to go past 2.5 Gbps: the TZ380 publishes 3.5 Gbps.
- TLS inspection throughput has to go past 430 Mbps: the TZ380 publishes 600 Mbps.
37 of the 58 published rows are identical — Operating System at SonicOS 8, SAML Single Sign-On Users at 1,000, Access Points Supported at 16 and Site-to-Site VPN Tunnels at 200 among them — so the choice does not touch any of those.
Full specification comparison
Every published row for both models, grouped the way SonicWall groups them. A dash means the figure is not published for that model.
| Specification | TZ280 | TZ380 |
|---|---|---|
| Firewall General | ||
| Operating System | SonicOS 8 | SonicOS 8 |
| Interfaces | 8 x 1GbE RJ45, 2 x 1G SFP, 1 console (Micro-USB), 1 USB (Type-C) | 8 x 1GbE RJ45, 2 x 5G/2.5G/1G SFP+, 1 console (Micro-USB), 1 USB (Type-C) |
| Wireless | Not fitted - see the TZ280W for the 802.11ax model | Not fitted - see the TZ380W for the 802.11ax model |
| Power over Ethernet (PoE) | Not fitted - see the TZ280P for the PoE model | Not fitted |
| Internal Storage (expansion) | Optional, up to 512 GB | Optional, up to 512 GB |
| Centralized Management | Network Security Manager (NSM) 3.0 and above, CLI, SSH, Web UI, REST APIs | Network Security Manager (NSM) 3.0 and above, CLI, SSH, Web UI, REST APIs |
| Logical VLAN and Tunnel Interfaces | 64 | 128 |
| SAML Single Sign-On Users | 1,000 | 1,000 |
| Access Points Supported | 16 | 16 |
| Firewall and VPN Performance | ||
| Firewall Inspection Throughput | 2.5 Gbps | 3.5 Gbps |
| Threat Prevention Throughput | 1 Gbps | 1.5 Gbps |
| Application Inspection Throughput | 1.5 Gbps | 2 Gbps |
| IPS Throughput | 1.5 Gbps | 2 Gbps |
| Anti-Malware Inspection Throughput | 1 Gbps | 2 Gbps |
| TLS/SSL Inspection and Decryption Throughput | 430 Mbps | 600 Mbps |
| IPSec VPN Throughput | 1.2 Gbps | 1.6 Gbps |
| Connections per Second | 12,000 | 15,000 |
| Maximum Connections (SPI) | 1,000,000 | 1,100,000 |
| Maximum Connections (DPI) | 200,000 | 250,000 |
| Maximum Connections (TLS) | 35,000 | 40,000 |
| VPN | ||
| Site-to-Site VPN Tunnels | 200 | 200 |
| IPSec VPN Clients | 5 (200 maximum) | 5 (200 maximum) |
| SSL VPN Licences | 1 (50 maximum) | 2 (100 maximum) |
| Encryption / Authentication | DES, 3DES, AES (128, 192, 256-bit) / MD5, SHA-256, SHA-384, Suite B Cryptography | DES, 3DES, AES (128, 192, 256-bit) / MD5, SHA-256, SHA-384, Suite B Cryptography |
| Key Exchange | Diffie Hellman Groups 1, 2, 5, 14 | Diffie Hellman Groups 1, 2, 5, 14 |
| Route-Based VPN | RIP, OSPF, BGP | RIP, OSPF, BGP |
| VPN Features | Dead Peer Detection, DHCP over VPN, IPSec NAT Traversal, Redundant VPN Gateway, Route-based VPN | Dead Peer Detection, DHCP over VPN, IPSec NAT Traversal, Redundant VPN Gateway, Route-based VPN |
| Global VPN Client Platforms | Microsoft Windows 10 and Windows 11 | Microsoft Windows 10 and Windows 11 |
| NetExtender | Microsoft Windows 10 and Windows 11, Linux | Microsoft Windows 10 and Windows 11, Linux |
| Mobile Connect | Apple iOS, macOS, Google Android | Apple iOS, macOS, Google Android |
| Security Features | ||
| Deep Packet Inspection Services | Gateway Anti-Virus, Anti-Spyware, Intrusion Prevention, TLS Decryption | Gateway Anti-Virus, Anti-Spyware, Intrusion Prevention, TLS Decryption |
| Content Filtering Service | Reputation-based URL filtering, HTTP URL, HTTPS IP, keyword and content scanning | Reputation-based URL filtering, HTTP URL, HTTPS IP, keyword and content scanning |
| Comprehensive Anti-Spam Service | Yes | Yes |
| Application Visualization | Yes | Yes |
| Application Control | Yes | Yes |
| Capture Advanced Threat Protection | Yes | Yes |
| Advanced DNS Filtering | Yes | Yes |
| Networking | ||
| NAT Modes | 1:1, 1:many, many:1, many:many, flexible NAT (overlapping IPs), PAT, transparent mode | 1:1, 1:many, many:1, many:many, flexible NAT (overlapping IPs), PAT, transparent mode |
| Routing Protocols | BGP, OSPF, RIPv1/v2, static routes, policy-based routing | BGP, OSPF, RIPv1/v2, static routes, policy-based routing |
| QoS | Bandwidth priority, max bandwidth, guaranteed bandwidth, DSCP marking, 802.11e (WMM) | Bandwidth priority, max bandwidth, guaranteed bandwidth, DSCP marking, 802.11e (WMM) |
| Authentication | LDAP (multiple domains), XAUTH/RADIUS, TACACS+, SAML SSO, RADIUS accounting, NTLM, internal user database, 2FA, Terminal Services, Citrix, CAC | LDAP (multiple domains), XAUTH/RADIUS, TACACS+, SAML SSO, RADIUS accounting, NTLM, internal user database, 2FA, Terminal Services, Citrix, CAC |
| Local User Database | 1,000 | 1,000 |
| VoIP | Full H.323v5, SIP | Full H.323v5, SIP |
| High Availability | Active/Standby with stateful synchronization | Active/Standby with stateful synchronization |
| Hardware and Power | ||
| Form Factor | Desktop | Desktop |
| Power Supply | 12V / 1.03A (60 W) | 12V / 1.14A |
| Input Power | 100-240 VAC, 50-60 Hz, 0.27A | 100-240 VAC, 50-60 Hz, 0.27A |
| Power Consumption | 12.36 W maximum | 13.77 W maximum |
| Redundant Power Supply | Optional | Optional |
| Total Heat Dissipation | 42.43 BTU/hr | 46.95 BTU/hr |
| Dimensions (H x W x D) | 3.5 x 13 x 19 cm | 3.5 x 13 x 19 cm |
| Weight | 0.82 kg | 0.82 kg |
| Shipping Weight | 1.41 kg | 1.41 kg |
| MTBF at 25°C | 51.7 years | 46.4 years |
| Operating Temperature | 0°C to +40°C | 0°C to +40°C |
| Storage Temperature | -40°C to +70°C | -40°C to +70°C |
| Humidity | 5-95% non-condensing | 5-95% non-condensing |
| Regulatory Model Number | APL70-11D | APL72-120 |
Other comparisons in this range
Each step of the TZ Series Gen 8 ladder, set against the model above it.
Not sure which one fits?
Tell us the throughput, port count and inspection features you need. We will confirm the right model, licence term and lead time, then quote it.
Request a Quote