What throughput a firewall must be rated for once inspection is switched on.
Firewall datasheets lead with throughput measured on large packets with inspection disabled. It is a real number and it is the wrong one to buy against, because nobody runs a firewall that way.
Switching on IPS typically halves it. Full threat prevention — IPS, anti-malware and application control together — commonly leaves under a third. TLS inspection, which decrypts and re-encrypts every session, commonly takes less than half of whatever remains.
The result is that an appliance bought against a 1 Gbps headline can deliver under 150 Mbps in the configuration the security team intended all along. This calculator inverts that: it starts from the traffic that must pass and tells you the rated figure to look for.
Because datasheet throughput is measured with inspection off. A firewall rated at 1 Gbps may deliver around 300 Mbps with full threat prevention and under 150 Mbps once TLS inspection is added. Sizing to the link alone is the most common way an appliance becomes the bottleneck.
They are planning figures in the range vendors publish for combined inspection profiles, not measurements of any particular platform. Use them to shortlist, then get the real numbers for the specific model under the feature set you will run. Ask the vendor for throughput with TLS inspection enabled specifically — it is often absent from the headline table.
Sizing to the link misses an office whose traffic is mostly internal or cloud-bound. Sizing to users misses a link deliberately oversized for bursts. The calculator takes whichever is larger and adds VPN on top.
It is how many new connections the firewall sets up each second, as distinct from how many it holds open. It is usually what exhausts a small appliance first, and it is almost never on anyone's requirements list.
No. It gives you a defensible starting figure and the questions to ask. Real sizing accounts for traffic mix, peak-versus-average, HA pairing, logging overhead and what the rule base actually does.