The firewall is the front door of your company's network. Choose one that is too small and everything slows down the day you turn on its security features; choose one without the right licences and it becomes an expensive router. Here is how to size a next-generation firewall (NGFW) properly.
What a next-generation firewall does
Beyond allowing or blocking traffic, an NGFW inspects it: intrusion prevention (IPS), antivirus and anti-malware, web filtering, application control, and secure remote access by VPN. Many models also manage Wi-Fi access points and switches from the same console, and balance two internet links with automatic failover.
The number that matters: throughput with security on
Datasheets show several throughput figures. The biggest one — plain "firewall throughput" — is measured with no inspection at all. What you will actually get with IPS, antivirus and application control enabled is the threat protection (or "NGFW") throughput, which is often a fraction of the headline number. Size by that figure, and compare it with your internet link: a firewall that inspects 600 Mbps is a bottleneck on a 1 Gbps link.
Five questions to size it
- How fast is your internet link today, and in two years? Choose a model whose threat-protection throughput covers it with room to spare.
- How many users and devices? Count laptops, phones, cameras, printers and IoT devices, not just people.
- How many remote users connect by VPN? Remote access and site-to-site tunnels have their own limits.
- Do you need to inspect encrypted traffic (SSL/TLS inspection)? It is the most demanding feature; it can cut throughput sharply.
- Can the business survive if the firewall fails? If not, plan two units in high availability (HA).
As a rough guide
For small offices with up to a few dozen users and links of a few hundred megabits, entry models such as the FortiGate 40F or 60F are usually the starting point we recommend. Larger offices, faster links or heavy VPN use call for mid-range models. Below that, consumer routers don't offer the inspection, logging and support a business needs.
Don't forget the licences
The security features run on subscriptions: threat signatures, web filtering, antivirus updates and vendor support. Without them, the firewall keeps passing traffic but stops protecting you against new threats. Budget for the licence every year — or choose a managed service where it is included in the monthly fee.
High availability: two is one, one is none
An HA pair keeps a second firewall in sync, ready to take over in seconds if the first one fails or needs an update. For companies whose operations stop when the internet stops, it is usually worth it.
Buy, or have it managed?
A firewall is not "set and forget". Rules grow, firmware needs patching, logs need reading and licences expire. Many companies prefer a managed firewall: the provider sizes it, installs it, keeps it updated and watches it, for a monthly fee that includes equipment, licences and support. If you would rather own the equipment, we can supply it and help you size it.
And remember that a firewall at your office can't stop large DDoS attacks — those have to be absorbed upstream. Read our guide on how to protect your business from DDoS attacks.
Talk to an engineer
Tell us what you need and we will design it with you, from our Tier III and Rated-3 data center in San José.