Reading a Firewall Datasheet: Which Throughput Number Actually Matters

A few weeks ago a colleague was called in to look at a slow internet connection at a company headquarters. A year earlier the team had replaced its desktop firewall with a larger rack-mount appliance, expecting a bigger box to mean more speed. As soon as intrusion prevention and HTTPS inspection were switched on, throughput fell below the old device, and the team quietly disabled inspection for most users.

The hardware was fine. The datasheet had been read the wrong way.

The headline number is the least useful one

The largest figure on any next-generation firewall datasheet is usually raw firewall throughput: large packets, no IPS, no application control, no TLS decryption. Real traffic looks nothing like that test. Three numbers matter more:

• TLS inspection throughput. Most web traffic is encrypted. If you plan to inspect it, this is your real ceiling.
• Threat protection or NGFW throughput. Speed with the security engines turned on.
• IPsec throughput and concurrent sessions. Critical for a hub that terminates branch tunnels and remote users.

Also watch the test methodology. Vendors change it between hardware generations, so a newer desktop model can show a higher threat-protection figure than an older rack model measured under stricter conditions. Compare IPS and TLS numbers side by side instead.

Security subscriptions are part of the sizing

The appliance without subscriptions is a basic stateful firewall. Decide early whether you need sandbox-style analysis of unknown files, DNS filtering and centralized tunnel orchestration, because those features also consume CPU and change which model fits. In my experience, skipping file analysis to save budget is the decision organizations regret most.

Measure for two weeks before you buy

• Peak throughput and the hour it happens
• Share of HTTPS traffic
• Peak concurrent sessions and new sessions per second
• IPsec tunnels and concurrent VPN users on the busiest day
• Expected growth over three years

With those numbers, choosing between two neighboring models takes one meeting. Also plan the physical side: 10 Gbps SFP+ ports, rack space, redundant power and the licensing of a second unit for high availability.

The full guide, with a model-by-role table and six common buying mistakes, is here: full guide

— Kazem Mortazavi, independent network-security consultant