NexusSec.Short version: The biggest number on a firewall datasheet is usually plain firewall throughput, measured with large packets and nothing inspected. Size on the throughput measured with the features you will run, usually threat protection, and on TLS inspection throughput if you will decrypt traffic. Then check new connections per second, concurrent sessions and the interfaces, and read the footnotes for how each figure was tested.
Two firewalls can both be described as "10 Gbps" and behave completely differently on your network. The difference is in the lines below the headline and in the footnotes, which is where vendors explain how each number was measured.
The throughput lines, from largest to smallest
| Line | What it usually measures | Size on it? |
|---|---|---|
| Firewall throughput | Packets passed by address and port, often large UDP packets, nothing inspected | Rarely. It is the best case |
| IPS throughput | Traffic with intrusion prevention enabled | If IPS is all you will run |
| NGFW or application-control throughput | Firewall plus application identification, sometimes plus IPS | Check exactly what is included |
| Threat protection throughput | Firewall, application control, IPS and malware protection together, with logging | Usually the right figure |
| SSL/TLS inspection throughput | Traffic decrypted, inspected and re-encrypted | Yes, if you will decrypt |
| IPsec VPN throughput | Encrypted tunnel traffic, often with large packets | For site-to-site links, against your tunnel traffic |
Definitions differ between vendors, which is why the footnotes matter. One vendor's threat protection includes malware scanning and another's does not; one tests with a realistic traffic mix and another with ideal packets. Compare like with like.
The footnotes: how it was tested
- Packet size. Large packets give flattering numbers. Real traffic is a mix of small and large.
- Traffic mix. Figures measured with a realistic mix of web and application traffic are more useful than figures measured with one kind of packet.
- Features and logging. Which features were on, and whether logging was enabled. Logging costs performance too.
- Methodology. Some vendors test to a published methodology, such as the IETF's RFC 9411 for network security devices, developed with the NetSecOPEN group. A named methodology makes figures easier to compare.
The lines people skip
- New connections per second. How quickly the firewall can set up sessions. Busy offices, schools and sites with many small web requests can hit this limit long before throughput.
- Concurrent sessions. How many connections it can track at once. Generous on most models, but worth checking where many users share one firewall.
- Interfaces. Number, speed and type: copper or fibre, 1, 10 or 25 Gbps. Make sure there are enough for every zone you plan, plus a spare.
- High availability. Whether a second unit can take over, and whether that needs an extra licence.
- Power and form factor. Redundant power supplies, rack units, and noise if it will sit in an office rather than a rack room.
Turning the datasheet into a decision
- List the features you will run, now and within the life of the box.
- Take the throughput figure for that feature set, and the TLS figure if you will decrypt.
- Compare against your internet bandwidth plus the internal traffic the firewall will route between zones, with room to grow.
- Check connections per second and interfaces against how the site is actually used.
- Confirm the licence that unlocks those features, and what it costs at renewal, before comparing prices.
For why the inspected figures are so much lower, see why firewalls slow down when you switch the security on. If the datasheet is part of a renewal quote, before you sign the firewall renewal covers the rest of that check.
