Firewall Capacity Calculator
Derate a firewall's datasheet throughput by inspection profile and size its session table memory against your peak load.
Inputs
Datasheet numbers are quoted at L4; every inspection engine you enable costs throughput.
Typical stateful entry is 200–400 bytes; add more for L7 and TLS state.
Effective Throughput
8.40Gbps
Throughput Utilisation
71.4%
Headroom
2.40Gbps
Session Table Memory
572.20 MiB
Capacity Verdict
Healthy — comfortable headroom
Step by step
Values used
Rated L4 (stateful) throughput = 20 Gbps; Inspection profile = IPS / threat prevention (42%); Peak offered load = 6 Gbps; Peak concurrent sessions = 2,000,000 sessions; Memory per session = 300 bytes
Firewall Capacity
effective throughput = rated L4 throughput × inspection derate; session memory = concurrent sessions × bytes per session.
Effective Throughput
= 8.40 Gbps
Throughput Utilisation
= 71.4
Headroom
= 2.40 Gbps
Session Table Memory
= 600,000,000.00
Capacity Verdict
= Healthy — comfortable headroom
How it works
Vendors publish throughput with only stateful L4 forwarding enabled. Turning on application identification, IPS signatures, logging and TLS decryption each strips capacity, so multiply the datasheet figure by the derate for the profile you actually intend to run. The session table is sized separately: it is simply concurrent sessions multiplied by the bytes each state entry occupies. Firewalls that look fine on paper fall over the day threat prevention is enabled, and an exhausted session table drops new connections while throughput graphs still look idle.
Formula
Firewall Capacity
effective throughput = rated L4 throughput × inspection derate; session memory = concurrent sessions × bytes per session.
- inspection derate
- Fraction of L4 throughput left once inspection engines are enabled
- bytes per session
- Memory a single state table entry consumes
Frequently Asked Questions
How is Firewall Capacity calculated?
effective throughput = rated L4 throughput × inspection derate; session memory = concurrent sessions × bytes per session. Vendors publish throughput with only stateful L4 forwarding enabled. Turning on application identification, IPS signatures, logging and TLS decryption each strips capacity, so multiply the datasheet figure by the derate for the profile you actually intend to run. The session table is sized separately: it is simply concurrent sessions multiplied by the bytes each state entry occupies.
Why does Firewall Capacity matter?
Firewalls that look fine on paper fall over the day threat prevention is enabled, and an exhausted session table drops new connections while throughput graphs still look idle.
What values do I need to enter?
This calculator takes 5 inputs: Rated L4 (stateful) throughput, Inspection profile, Peak offered load, Peak concurrent sessions, Memory per session. The pre-filled defaults are a realistic starting point — replace them with figures from your own environment for a result you can act on.
Should I size for one firewall or the pair?
Size each unit for the full load. In an active/passive or active/active HA pair, a failover puts 100% of traffic and 100% of the session table on the surviving node, so a design that needs both members to stay under capacity is not highly available.