Calculator Inputs
Formula Used
The estimator models sustainable throughput by multiplying a baseline rate by penalty factors, then applies a utilization target to preserve headroom.
- PacketFactor reduces throughput when average packets are small.
- FeatureFactor combines enabled services like IPS and malware scanning.
- TLSFactor/VPNFactor apply proportionally to encrypted traffic share.
- SessionFactor penalizes throughput under high session and churn load.
- HAMultiplier scales in Active/Active clusters with sync overhead.
How to Use This Calculator
- Enter the baseline throughput from your target firewall model.
- Set average packet size and expected encrypted traffic shares.
- Enable only the services you will run in production policies.
- Fill session rates using monitoring data or forecasts.
- Choose HA mode and units if you plan Active/Active scaling.
- Submit to see throughput and a factor breakdown.
- Export results as CSV or PDF for documentation.
Example Data Table
These scenarios show how inspection and encryption reduce effective throughput.
| Scenario | Base (Gbps) | Pkt (B) | TLS % | VPN % | Sustainable (Gbps) |
|---|---|---|---|---|---|
| Branch edge, minimal inspection | 2.0 | 1,200 | 0 | 0 | 0.843 |
| Campus gateway, UTM stack | 10.0 | 900 | 40 | 10 | 1.116 |
| Data center, heavy encryption | 40.0 | 800 | 80 | 30 | 3.625 |
Baseline and Measured Traffic Mix
A vendor baseline throughput figure is usually measured with large packets and limited inspection. In lab terms, a 10 Gbps device may deliver 3–6 Gbps with full inspection. Always verify with your vendor’s threat‑prevention or TLS benchmark numbers. This estimator starts from that baseline, then adjusts for packet size, enabled services, encryption share, and session pressure. For many enterprise perimeters, average traffic can include 20–60% TLS and 5–30% tunnelled VPN, so using observed ratios from monitoring tools produces more realistic sizing outcomes.
Packet Size and Packets‑Per‑Second Demand
Throughput is constrained by packets per second, not only gigabits. At 1 Gbps, 1500‑byte packets are roughly 83,000 pps, while 300‑byte packets are roughly 416,000 pps. Small packets appear with DNS, VoIP, gaming, and chatty applications. Enter a measured average packet size (often 700–1200 bytes at gateways) to reflect your environment and avoid underestimating PPS load. Below 256 bytes, PPS growth can dominate CPU limits, making low‑bandwidth links feel overloaded during peaks.
TLS and VPN Processing Costs
Decrypting and inspecting encrypted traffic adds CPU, memory, and session tracking overhead. In this model, full TLS inspection applies a stronger penalty than partial inspection, because only the inspected share is decrypted. VPN processing is modeled separately to capture encryption and encapsulation costs. If TLS inspection exceeds 60% or VPN exceeds 60%, consider dedicated crypto acceleration, selective decryption policies, or splitting roles across tiers.
Inspection Services and Policy Overhead
Advanced security services typically reduce effective throughput. The estimator combines multipliers for common stacks: IPS/IDS (0.65), anti‑malware scanning (0.75), URL filtering (0.85), application control (0.80), DLP/content inspection (0.85), and extensive logging (0.90). Enabling multiple services compounds the impact, so compare scenarios like “IPS only” versus “full UTM” to quantify trade‑offs for your risk profile.
Headroom, High Availability, and Upgrade Planning
Production designs rarely run at 100% sustained utilization. A practical target is 60–80% to absorb bursts, threat updates, and routing changes. Active/Passive improves resilience but does not double throughput; a small overhead is still present for synchronization. Active/Active clusters can scale traffic, but efficiency is reduced by state sharing, so plan for about 90% scaling per added unit and revisit sizing annually.
FAQs
What does the sustainable throughput value represent?
It estimates the steady rate after applying your headroom target. It is intended for continuous operation with policies enabled, while still leaving capacity for spikes, routing changes, and periodic security updates.
Which baseline throughput should I enter?
Use the vendor’s stated firewall or basic L3/L4 throughput for the appliance tier. If you already have measured lab results for your deployment profile, enter that number as the baseline for tighter estimates.
How can I choose an average packet size?
Pull interface statistics from flow tools, packet captures, or switch telemetry. Gateways often average 700–1200 bytes, but voice, DNS, and gaming can reduce averages sharply. Enter the best observed mean for peak hours.
Why do TLS inspection and VPN reduce throughput so much?
Decryption adds cryptographic work, certificate handling, and deeper inspection per session. VPN processing also adds encryption and encapsulation overhead. Reduce scope with policy exceptions, modern cipher support, or hardware acceleration when encrypted shares are high.
Why do session counts and new sessions per second matter?
High session tables and frequent session creation increase state lookups, NAT allocations, and logging volume. When either concurrent sessions or new sessions/sec approaches platform limits, the model applies a penalty to reflect rising CPU pressure.
Does clustering always increase throughput?
Only Active/Active mode is modeled to scale traffic. Active/Passive improves availability but typically keeps throughput near a single unit. Even in Active/Active, synchronization overhead reduces efficiency, so expect less than linear scaling.