Size a firewall for the traffic it must inspect and the services you will enable. An internet circuit speed and a user count are useful inputs, but neither is a complete sizing method.
Compare the right throughput figures
Manufacturers publish several measurements. Fortinet’s matrix separates basic firewall forwarding, IPS, NGFW, threat protection, IPsec VPN and SSL inspection. Its footnotes describe different test traffic and enabled features; the figures are up-to values that vary with configuration. Do not treat the largest forwarding number as inspected application capacity. Fortinet product matrix and methodology.
| Requirement | What to check |
|---|---|
| Internet and internal segmentation | Peak traffic crossing the firewall, including internal routed traffic |
| Security inspection | Throughput with the required security services and traffic mix |
| Encrypted traffic | Inspection scope and the corresponding SSL/TLS inspection measurement |
| Site-to-site VPN | Required tunnels and throughput using the intended configuration |
| Busy applications | Concurrent sessions and new connections per second |
| Connectivity | Port count, media, speed and required uplink modules |
These are separate constraints. Do not add benchmark figures together or assume they describe simultaneous workloads. Where a needed performance figure is absent, request evidence for the intended software and configuration rather than inferring a value.
Collect measurements before choosing
Gather busy-hour traffic and session data from the existing network, including seasonal peaks and backup traffic. Separate internet, inter-site VPN and internal segmentation loads. Write down which traffic must be decrypted and which applications need inspection exceptions. Plan and approve inspection policy with the organisation responsible for it.
Build a short requirements sheet: measured peak load, anticipated growth, enabled inspection services, VPN requirements, interfaces, logging destination and retention needs. Choose explicit growth allowances for your project; there is no universal percentage that guarantees capacity.
Plan for a failure
If resilience is required, evaluate the load one surviving device must carry. Check the manufacturer’s HA mode, interface and software requirements, then test a failover with representative traffic. Two appliances should not automatically be counted as twice the usable inspected capacity.
Check software and services
Record the feature subscriptions and support requirements separately from the hardware. Confirm exact terms, registration details and renewal dates before purchase; buying an appliance does not establish service eligibility. See Licences and support contracts.
Use the manufacturer data sheet for each exact candidate and arrange a representative test when the workload is critical. Browse firewalls or send your requirements in a quote request.