Planning tool

Firewall sizing

Firewalls are sold on headline speeds that fall sharply once security features are on. This tells you which figures to compare, and how big they should be.

Size

Laptops, phones, printers, cameras, IoT. Staff count at minimum.

Mbps

Of the fastest link. Add links together only if they are used together.

%
Features
Remote access
Resilience
%

Data sheet figures come from lab tests with ideal traffic.

Result

Firewall throughput to look for

675Mbps

Plain firewall figure on the data sheet

Threat protection throughput

675Mbps

IPS, antivirus and app control on

SSL inspection throughput

574Mbps

Concurrent sessions

30,000

About 100 per device

VPN throughput

225Mbps

5 Mbps per remote user, 25 per site tunnel

Ports

4

2 internet, LAN, DMZ/other

Class of appliance

Small-business 1U appliance

  • Check:Look at the data sheet's SSL (encrypted traffic) inspection figure, not the headline firewall speed. It is usually a fraction of it.
  • Check:Use the 'threat protection' or 'NGFW' throughput (IPS, antivirus and application control all on), not the plain firewall figure.
  • Good:Subscriptions (threat protection, web filtering, support) are normally licensed per firewall per year; the licence term is part of the cost.

Method

How the numbers are worked out

Throughput

Your internet speed plus growth is the traffic the firewall must pass. A margin is added because data sheet figures are lab results; real traffic is a mix of many small connections.

Features cost speed

Turning on intrusion prevention, antivirus and application control, and inspecting encrypted traffic, can cut a firewall's real speed to a fraction of its headline number. Compare the matching data sheet figure for each feature you will use.

Sessions and VPN

Concurrent sessions are taken as about 100 per device. VPN capacity is 5 Mbps per remote user and 25 Mbps per site-to-site tunnel.

Assumptions and limits

  • These are sizing rules of thumb. Traffic mix (video calls, backups, cloud apps) changes the result.
  • Compare like with like: threat-protection and SSL-inspection figures, measured the way the data sheet describes.
  • A firewall is only part of security. Updates, rule reviews and monitoring matter as much as the box.

Related

Nothing you type here leaves your device unless you choose to send it to us. These are planning estimates; a survey or the equipment data sheet confirms the final figures.

Want an engineer to check it?

Send us what you worked out and we will come back with a design based on the real site.

Book an assessmentCall KINNEXWhatsApp