Stop Sizing Firewalls by User Count

A surprisingly common firewall sizing question is:

“How many users will this firewall support?”

There is no useful universal answer.

Thirty users browsing the web and reading email are not equivalent to thirty users running SSL inspection, Teams calls, VPN tunnels, SaaS platforms, backups and cloud applications.

A more useful sizing model should consider:

1. Concurrent traffic

What percentage of users are active at the same time?

1. Security inspection

IPS, antivirus, application control and encrypted traffic inspection consume resources.

1. Encrypted traffic

Modern networks are predominantly encrypted, which changes firewall workload significantly.

1. VPN

Remote-access and site-to-site VPN should be included in sizing.

1. Applications

Voice and video behave differently from web browsing or backups.

1. WAN architecture

Dual WAN, SD-WAN and branch connectivity add additional requirements.

1. Growth

Sizing exactly for today's workload often creates tomorrow's bottleneck.

FortiGate's entry-level appliance range is one practical example: different models provide progressively more security-processing capacity, but selecting between them still requires understanding the actual workload.

The general lesson applies to any NGFW vendor:

Do not size a firewall by headcount. Size it by traffic, inspection, architecture and growth.

I expanded the business-side sizing checklist in a Spanish guide here:

https://sistro.net/fortigate-para-pymes-modelos-recomendados

Tags: network-security firewall cybersecurity networking