Firewall Capacity Calculator
Derate a firewall's datasheet throughput by inspection profile and size its session table memory against your peak load.
About Firewall Capacity Calculator
Vendors publish throughput with only stateful L4 forwarding enabled. Turning on application identification, IPS signatures, logging and TLS decryption each strips capacity, so multiply the datasheet figure by the derate for the profile you actually intend to run. The session table is sized separately: it is simply concurrent sessions multiplied by the bytes each state entry occupies. Firewalls that look fine on paper fall over the day threat prevention is enabled, and an exhausted session table drops new connections while throughput graphs still look idle.
Formula
Firewall Capacity
effective throughput = rated L4 throughput × inspection derate; session memory = concurrent sessions × bytes per session.
- inspection derate
- Fraction of L4 throughput left once inspection engines are enabled
- bytes per session
- Memory a single state table entry consumes
Worked example
With the default values below, Firewall Capacity Calculator returns Effective Throughput of 8.40. Change any input above and every figure here is recalculated in your browser.
Inputs used
- Rated L4 (stateful) throughputaccepts 0.1–2,000 Gbps
- 20 Gbps
- Inspection profileone of L4 stateful only (100% of rated), App-ID / L7 identification (60%), IPS / threat prevention (42%), Threat prevention + logging (35%), Full TLS decryption (25%)
- IPS / threat prevention (42%)
- Peak offered loadaccepts 0–2,000 Gbps
- 6 Gbps
- Peak concurrent sessionsaccepts 0–200,000,000 sessions
- 2,000,000 sessions
- Memory per sessionaccepts 32–4,096 bytes
- 300 bytes
Results
- Effective Throughput
- 8.40 Gbps
- Throughput Utilisation
- 71.4%
- Headroom
- 2.40 Gbps
- Session Table Memory
- 572.20 MiB
- Capacity Verdict
- Healthy — comfortable headroom
Step by step
- 1Values used
- 2Firewall Capacity
- 3Effective Throughput= 8.40 Gbps
- 4Throughput Utilisation= 71.4
- 5Headroom= 2.40 Gbps
- 6Session Table Memory= 600,000,000.00
- 7Capacity Verdict= Healthy — comfortable headroom
Assumptions and limits
- The result is derived only from the 5 inputs listed above. Anything not among them is not part of the calculation.
- In particular, this calculator does not take inflation, tax or compounding frequency into account.
- Figures are rounded for display to 2 decimal places, so totals built from several rounded parts can differ slightly from the unrounded arithmetic.
How these calculators are built and tested is described on the Methodology page. If a figure looks wrong, please report it.
Frequently Asked Questions
How is Firewall Capacity calculated?
effective throughput = rated L4 throughput × inspection derate; session memory = concurrent sessions × bytes per session. Vendors publish throughput with only stateful L4 forwarding enabled. Turning on application identification, IPS signatures, logging and TLS decryption each strips capacity, so multiply the datasheet figure by the derate for the profile you actually intend to run. The session table is sized separately: it is simply concurrent sessions multiplied by the bytes each state entry occupies.
Why does Firewall Capacity matter?
Firewalls that look fine on paper fall over the day threat prevention is enabled, and an exhausted session table drops new connections while throughput graphs still look idle.
What values do I need to enter?
This calculator takes 5 inputs: Rated L4 (stateful) throughput, Inspection profile, Peak offered load, Peak concurrent sessions, Memory per session. The pre-filled defaults are a realistic starting point — replace them with figures from your own environment for a result you can act on.
Should I size for one firewall or the pair?
Size each unit for the full load. In an active/passive or active/active HA pair, a failover puts 100% of traffic and 100% of the session table on the surviving node, so a design that needs both members to stay under capacity is not highly available.