Factory Reset and Recover a SonicWall with SafeMode

Before you run this

SafeMode is SonicWall's out-of-band recovery boot. You enter it with the physical reset button, and from a small web page on the appliance you can reboot the current firmware, boot a backup image, upload firmware, export settings, or boot with factory default settings — which wipes the running configuration back to out-of-the-box defaults. This guide covers using SafeMode to factory reset and recover a firewall you're locked out of, or one whose config or firmware is corrupt.

• This is not a script. It is a hardware-and-GUI procedure. There are no elevated OS privileges to grant, but it requires physical access to the appliance's reset button and a computer you can put on the same subnet as the SafeMode management IP. SafeMode itself does not ask for the admin password, which is exactly why physical access to a SonicWall is physical control of it.
• The factory-default boot is destructive and, for the configuration, irreversible. It erases the entire config: interfaces, rules, NAT, VPNs, users, everything. The only way back to your old config is a settings file you exported beforehand or a backup firmware image that still has its own saved config. If you can still reach the management UI at all, export the configuration before you touch the reset button.
• You are already at the console for this — the reset button and a directly-connected laptop are your out-of-band path. If the unit is remote in a rack, have someone on site or a serial/console connection (SonicWall console is 115200 8N1) available, because the moment you enter SafeMode the firewall stops passing all production traffic.
• Do this in a maintenance window. The device is offline for the duration and comes back with no rules, so nothing routes until you restore or rebuild.
• Rollback path: re-import your exported settings file, or in SafeMode boot the alternate/backup firmware image with its retained configuration.

Assumptions: a Gen 7 desktop appliance (e.g. TZ370, TZ470, NSa 2700) running SonicOS 7.x, managed on interface X0. The default SafeMode management IP is 192.168.168.168. On Gen 6 / SonicOS 6.5 the concept and IP are the same but the SafeMode page layout and some button labels differ — check the SonicOS 6.5 admin guide if that's what you have.

Step 1 — Back up the configuration first, if you still can

If the UI is reachable, export before you reset. In SonicOS 7 the backup lives under:

DEVICE | Settings > Firmware and Settings

From there use Export Configuration to download the settings file (a .exp) to your workstation. On SonicOS 6.5 the equivalent is under MANAGE | Updates > Firmware & Backups, or System > Settings. If you cannot reach the UI at all, skip this — but understand you are then committing to rebuilding the config by hand or from an older export.

You can also create a local backup image on the appliance from that same page, which SafeMode can boot later. That local backup is not a substitute for an off-box .exp file.

Step 2 — Prepare your laptop

Set your workstation to a static IP on the SafeMode subnet so it can talk to 192.168.168.168:

• IP: 192.168.168.20
• Mask: 255.255.255.0
• Gateway: leave blank (not needed)

Connect an Ethernet cable directly from your laptop to the firewall's X0 port. (192.168.168.20 is just an example host address — any free address in 192.168.168.0/24 other than .168 works.)

Step 3 — Enter SafeMode with the reset button

The reset button is a small recessed pinhole on the appliance — front or rear depending on model.

1. With the firewall powered on, press and hold the reset button with a straightened paperclip.
2. Hold it for roughly 15–20 seconds, until the diagnostic/Test LED begins to flash. The exact LED and colour vary by model, so confirm the indicator for your unit in its Quick Start Guide or the SonicOS 7 admin guide rather than guessing.
3. Release the button. The firewall is now in SafeMode.

Step 4 — Open the SafeMode management page

In a browser, go to:

http://192.168.168.168

You'll get the SafeMode page — a stripped-down management screen, not the full SonicOS UI. It shows system information and a table of firmware images with boot options, plus tools to upload firmware and export settings/diagnostics.

Before you reset, this is your last chance to pull data off the box:

• Export the current settings if you didn't in Step 1 — SafeMode offers a settings download even when normal management is broken.
• Export a diagnostic / tech-support report if you're troubleshooting, so you have it after the wipe.

The exact button labels on this page have changed across SonicOS 7 builds. Use the ones the page presents; if the wording differs from what you expect, cross-check against the "SafeMode" section of the SonicOS 7 admin guide before clicking anything that boots.

Step 5 — Boot with factory default settings

In the firmware image table, choose the option to boot the current firmware with factory default settings (as opposed to a plain "Boot" that keeps the existing config). This is the actual factory reset.

Confirm when prompted. The firewall reboots — this takes several minutes on a first-boot-after-reset — and comes back with a clean default configuration.

If instead your goal is to recover from bad firmware, this is where you'd boot the backup image (keeping its config) or upload a known-good firmware file, rather than factory-defaulting.

Step 6 — Log in and reconfigure

After the reset, the firewall is back to defaults:

• Management is at the default LAN address on X0, 192.168.168.168.
• Default credentials are admin / password.

Keep your laptop on 192.168.168.20, browse to https://192.168.168.168, and log in. SonicOS 7 forces you through initial setup and a mandatory admin password change on first login — do not skip it.

Verify the reset worked

• You can reach https://192.168.168.168 and log in with the default credentials (then are prompted to change the password) — confirms the config is truly default.
• Under DEVICE | Settings and the dashboard, the firmware version matches the image you booted and the config shows factory defaults (no custom zones, rules, or VPN policies).
• The registration/licensing state shows the unit as un-associated until you re-register it to your MySonicWall account.

Restore or roll back

To restore your previous config (the "undo" for the wipe): from DEVICE | Settings > Firmware and Settings, use Import Configuration and upload the .exp file you exported in Step 1. The firewall applies it and reboots into your old setup. Import a settings file only onto matching firmware — restoring a .exp taken from a different SonicOS version can fail or behave unpredictably, so match the firmware first, then import.

If the reset was to recover a bad image, once you're back on good firmware, re-register the unit and pull licences with DEVICE | Settings licensing / synchronise, then rebuild or import config as above.

If you have no export and no usable backup image, there is no shortcut — the configuration is gone and must be rebuilt by hand. That is the whole reason Step 1 exists.

For the exact SafeMode page controls and the reset-button LED behaviour on your specific model, the authoritative reference is SonicWall's SonicOS 7 administration guide and your appliance's Quick Start Guide on the SonicWall documentation site.