Work out firewall throughput sizing instantly with clear inputs, formula shown and shareable results.
Firewall datasheets quote stateful throughput with large packets, which bears little relation to real performance with inspection enabled. Application control typically halves it, IPS reduces it to around 30 percent, and TLS decryption to nearer 10 percent. Packet size matters too, since per-packet processing dominates: small packets cut throughput proportionally.
Firewall derating
effective = datasheet x inspection factor x packet-size factor; factors ~ 1.0 stateful, 0.5 app control, 0.3 IPS, 0.12 TLS decryption
Every session needs asymmetric key operations plus full re-encryption, and the inspection engine must buffer and reassemble streams. It is the single largest performance cost in a modern firewall.
The one measured with the feature set you will actually enable, using an enterprise traffic mix rather than large-packet UDP. Vendors publish both; only the former is useful.