Size a secure web gateway cluster: appliances required with N+1 sparing, users per node and access-log storage.
Divide the peak request rate by the rated per-appliance rate and round up for the active node count, then add spares so a failure or maintenance window does not push the survivors past capacity. Access logs are sized independently: every request writes a line, and at proxy volumes that dominates your SIEM ingest bill. Web proxy log volume is routinely the largest single feed into a SIEM, so discovering the storage cost after deployment turns a security control into a budget problem.
Web Proxy Capacity
active appliances = ceil(peak rps ÷ rated rps); total = active + spares; log storage = requests per day × bytes per request × retention days.
active appliances = ceil(peak rps ÷ rated rps); total = active + spares; log storage = requests per day × bytes per request × retention days. Divide the peak request rate by the rated per-appliance rate and round up for the active node count, then add spares so a failure or maintenance window does not push the survivors past capacity. Access logs are sized independently: every request writes a line, and at proxy volumes that dominates your SIEM ingest bill.
Web proxy log volume is routinely the largest single feed into a SIEM, so discovering the storage cost after deployment turns a security control into a budget problem.
This calculator takes 7 inputs: Users to serve, Requests per user per hour, Peak-to-average factor, Rated requests per second per appliance, Spare appliances for redundancy, Access log bytes per request, Log retention. The pre-filled defaults are a realistic starting point — replace them with figures from your own environment for a result you can act on.
Only as a starting point. Datasheet figures assume minimal policy: no TLS interception, no sandboxing, no data-loss inspection and a small category database. With full TLS interception enabled, expect a third or less of the rated figure, so validate against a proof of concept with your real policy.