Sizing an Application Delivery Controller: Why Bandwidth Is the Wrong First Question

When a team plans a new application delivery controller, the first question is almost always "how many gigabits do we need?" In my experience, bandwidth is rarely where an ADC actually runs out of room.

I once looked at an organization whose customer portal slowed down every morning. It ran on a virtual ADC licensed for 1 Gbps, while real traffic never went above roughly 300 Mbps. Yet the virtual machine's CPU hit 100% at the login peak. The cause was a certificate with an RSA 4096 key and broken session resumption: every mobile user who switched networks triggered a fresh full TLS handshake.

Four numbers to measure first

• Peak layer-7 requests per second: the busiest five minutes of the month, not the daily average.
• New connections per second: mobile apps and APIs open many short-lived connections.
• Full TLS handshakes per second: write down the key type. ECDSA P-256 is far cheaper than large RSA keys.
• Throughput with your real feature set: a web application firewall or an access gateway changes the numbers significantly.

Virtual or hardware?

A virtual edition fits virtualized data centers well, scales in license steps and can be moved easily. Give it enough vCPUs and memory, and remember that a single-NIC setup tops out around 1 Gbps. Dedicated hardware makes more sense when you terminate a lot of TLS, need crypto offload, or want several isolated tenants on one box. In an active-standby pair, each unit must be able to carry the full load alone, so plan for 50 to 60 percent utilization at peak.

Run a short pilot

Replay your morning peak against an evaluation instance with the real certificate and the real modules, then try again with an ECDSA certificate and working session tickets. In that portal's case, those two changes alone cut peak CPU by more than half.

The full guide with a decision table and checklist is here: ADC sizing guide

— Kazem Mortazavi, independent network-security consultant