Firewall datasheets are written to make every model look good. The number that matters is the one you will actually get with your policies switched on. This guide walks through the questions we ask before recommending a firewall refresh, so you can ask them of any vendor, including us.
1. How many people and devices sit behind it?
Count users, but also count devices: laptops, phones, printers, cameras, badge readers and servers. Each one opens connections. A firewall sized only to headcount is often undersized the day it is installed.
2. What throughput do you need with inspection turned on?
Vendors publish several throughput figures. The headline number is usually raw firewall throughput with no security services. Intrusion prevention, web filtering, application control, malware scanning and TLS inspection each take a share of the hardware. Ask for the vendor figure with the services you plan to use enabled, and compare models on that number. If you intend to inspect encrypted traffic, ask for the TLS inspection figure specifically, because it is normally the lowest.
3. How many remote users and sites connect in?
List the site-to-site tunnels and the number of people who will connect by VPN or a zero-trust client at the same time. Remote access capacity is licensed or limited differently from vendor to vendor, so check it separately from throughput.
4. What does the subscription cost in year two and year three?
A firewall is hardware plus subscriptions. The subscriptions carry the security updates, and they renew on a schedule. Compare the three-year cost of a bundle, not the price of the box. Ask what happens if a subscription lapses: some features stop at once, and some products stop receiving updates entirely.
5. Who will run it?
The best firewall is the one your team can operate. Consider the management console, how rules are written and audited, whether you need central management for more than one site, and who responds when an alert fires at night. If you have no one to do this, plan for a support contract or a managed service from the start.
Common mistakes
- Buying to the datasheet. Size to the throughput you will have with services enabled, with headroom for growth.
- Migrating rules unchanged. A refresh is the best moment to remove old rules, unused objects and any-any exceptions. Migrate a cleaned rule base, not a copy.
- Forgetting high availability. If the firewall is the only path to the internet, decide whether a failure that takes the office offline is acceptable. A second unit costs less than a day of lost work for most businesses.
- Leaving the old device in service. Plan the cutover, the rollback and the date the old unit comes out of the network.
A simple way to compare shortlisted models
Write down five numbers for each candidate: throughput with your security services enabled, maximum concurrent connections, VPN capacity, number and type of ports, and three-year cost including subscriptions. Put your own requirement next to each. Anything that meets the requirement with room to spare stays on the list. After that, the decision is about management tools and support, not speeds.
Where we can help
We supply and deploy firewalls from Sophos, Fortinet, Check Point, Palo Alto Networks, Cisco, WatchGuard and Barracuda, and we can review your requirements against the vendor figures before you buy. See our Security & Firewalls page.
Want a second opinion on your own environment? Request a free security check, or talk to an engineer.