Calculator Inputs
Example Data Table
| Scenario | Peak Throughput Mbps | Users | Concurrent Sessions | New Sessions/sec | SSL % | Growth % | Utilization % |
|---|---|---|---|---|---|---|---|
| Branch Office | 350 | 180 | 75000 | 1800 | 45 | 20 | 70 |
| Regional Hub | 1200 | 900 | 400000 | 8500 | 65 | 30 | 65 |
| Data Center Edge | 9000 | 3500 | 2200000 | 48000 | 80 | 40 | 60 |
Formula Used
1. User-driven throughput = Peak concurrent users x Average bandwidth per user.
2. Base sizing throughput = Max of peak traffic throughput and user-driven throughput.
3. Effective throughput per node = Base sizing throughput x SSL multiplier x IPS multiplier x Application control multiplier x Web filtering multiplier x Growth multiplier x Availability multiplier / Target utilization.
4. Recommended concurrent sessions = Peak concurrent sessions x Growth multiplier x 1.15 reserve.
5. Recommended new sessions per second = Peak new sessions/sec x Growth multiplier x 1.10 reserve.
These multipliers create a planning estimate, not a vendor guarantee. Always compare the result with validated performance data from the firewall model you intend to deploy.
How to Use This Calculator
- Enter the highest traffic level your firewall must handle.
- Add peak concurrent users and average bandwidth per user.
- Enter session volume, including concurrent sessions and new sessions per second.
- Set the SSL inspection percentage if encrypted traffic is decrypted inline.
- Enable the security services that will run on the firewall.
- Choose your deployment mode and set utilization and growth buffers.
- Press calculate to view the recommended throughput, sessions, and firewall class.
FAQs
1. What does this firewall sizing tool estimate?
It estimates throughput, session capacity, new session rate, and an overall firewall class by blending traffic demand, security overhead, growth, and utilization limits.
2. Why does SSL inspection change the result so much?
SSL inspection consumes extra compute because the firewall must decrypt, inspect, and re-encrypt traffic. Higher inspection rates usually require significantly more headroom.
3. Should I size for average traffic or peak traffic?
Use peak traffic. Firewalls fail during bursts, not during calm periods. A production design should always survive peak usage and failover events.
4. Does high availability reduce per-node requirements?
Usually no. In many deployments, each node must support full production load during failover. That is why the calculator keeps per-node sizing conservative.
5. Why include a target utilization setting?
Running near maximum capacity leaves little room for bursts, updates, logging spikes, or future features. Lower utilization targets create safer operational headroom.
6. Are the appliance classes vendor specific?
No. The classes are planning labels only. You should map the calculated requirement to vendor datasheets, especially threat prevention and SSL inspection ratings.
7. Can I use this for cloud firewalls too?
Yes, as an early estimate. For cloud deployments, also account for instance scaling limits, zonal redundancy, licensing, and provider throughput constraints.