Derate a firewall's datasheet throughput by inspection profile and size its session table memory against your peak load.
Vendors publish throughput with only stateful L4 forwarding enabled. Turning on application identification, IPS signatures, logging and TLS decryption each strips capacity, so multiply the datasheet figure by the derate for the profile you actually intend to run. The session table is sized separately: it is simply concurrent sessions multiplied by the bytes each state entry occupies. Firewalls that look fine on paper fall over the day threat prevention is enabled, and an exhausted session table drops new connections while throughput graphs still look idle.
Firewall Capacity
effective throughput = rated L4 throughput × inspection derate; session memory = concurrent sessions × bytes per session.
effective throughput = rated L4 throughput × inspection derate; session memory = concurrent sessions × bytes per session. Vendors publish throughput with only stateful L4 forwarding enabled. Turning on application identification, IPS signatures, logging and TLS decryption each strips capacity, so multiply the datasheet figure by the derate for the profile you actually intend to run. The session table is sized separately: it is simply concurrent sessions multiplied by the bytes each state entry occupies.
Firewalls that look fine on paper fall over the day threat prevention is enabled, and an exhausted session table drops new connections while throughput graphs still look idle.
This calculator takes 5 inputs: Rated L4 (stateful) throughput, Inspection profile, Peak offered load, Peak concurrent sessions, Memory per session. The pre-filled defaults are a realistic starting point — replace them with figures from your own environment for a result you can act on.
Size each unit for the full load. In an active/passive or active/active HA pair, a failover puts 100% of traffic and 100% of the session table on the surviving node, so a design that needs both members to stay under capacity is not highly available.