sourcing.cisomarketplace.com / firewall-sizing
Part of CISO Marketplace
Firewall Sizing · Free Calculator

Size your firewall for real-world throughput

Vendor spec sheets quote raw firewall throughput. With SSL inspection on, real throughput drops 60-80%. This calculator does the math vendors don't put in their datasheets.

!
Why most firewalls get undersized: a 10 Gbps NGFW spec sheet quotes throughput with all inspection off. Turn on SSL decryption, IPS, and sandboxing — the features you bought the firewall for — and effective throughput often falls below 2 Gbps. Undersized firewalls become latency bottlenecks the moment you enable security features.

Your Environment

Concurrent users routing through this firewall — employees, contractors, guests.
Provisioned internet bandwidth at peak. Use the higher of inbound or outbound.
Roughly 95% of web traffic is HTTPS in 2026. Adjust if your mix is unusual.

Security Features

SSL/TLS Inspection
Decrypt and inspect HTTPS traffic. Required to see modern threats.
−65% throughput
IPS / Threat Prevention
Intrusion prevention with signature-based threat detection.
−30% throughput
Sandboxing
Detonate suspicious files in a cloud sandbox for unknown-threat detection.
−15% throughput
3-year growth headroom
Add +30% capacity to absorb growth before the next refresh cycle.
Required firewall throughput
0Gbps
This is the spec-sheet number to look for. Vendors typically quote this as "firewall throughput" or "NGFW throughput."
Mid-Market Tier
Mid-Market NGFW
Suited for distributed enterprises with multiple branches or campuses. Look at platforms in the 5-20 Gbps spec range.
Examples in this range Palo Alto PA-3400 series · Fortinet FortiGate 600F · Check Point Quantum 6900 · Cisco Firepower 3100 series
How we got there
Base WAN throughput 1.0 Gbps
+ Burst factor (1.3x) 1.3 Gbps
÷ SSL inspection capacity (35%) 3.7 Gbps
÷ IPS capacity (70%) 5.3 Gbps
÷ Sandboxing capacity (85%) 6.2 Gbps
× 1.3 (3-year growth) 8.1 Gbps
Required spec-sheet throughput 8.1 Gbps

The reality check

If you bought a firewall rated at your WAN bandwidth, here's what would actually happen with your settings:

Effective throughput
12%
Of the spec-sheet number you'd see with all your inspection features on.
Real bandwidth available
120 Mbps
With features enabled, only this much of your WAN can actually flow through.
Oversize multiplier
8.1×
The factor you need to oversize the firewall by, vs your raw WAN.

📄 Download your sizing report

Get a PDF with your calculated throughput requirement, recommended firewall tier, and a vendor-neutral spec checklist to bring to a quote conversation.

✓ Sent! Check your inbox. PDF downloading now...
Recommended next step

Get managed firewall quotes at your tier

Our 5-minute sourcing diagnostic matches you with 3 vetted vendors sized for your throughput requirement. Includes managed-firewall and FWaaS options. No vendor pays for placement.

Open the sourcing diagnostic →