Understanding Firewall Sizing: What It Really Means
Picture this: You’ve got a 500 Mbps internet connection, but with security features like intrusion prevention turned on, your actual throughput drops to half. That’s the everyday reality of firewall sizing; it’s about performance under real load, not just the specs on paper. Proper firewall sizing ensures your device handles traffic volume, user count, and security inspections without bottlenecking operations.
In simple terms, undersizing in firewall sizing leads to lag and dropped connections, while oversizing in business firewall sizing burns your budget on unused capacity. For businesses in 2025-2026, with encrypted traffic making up 85-95% of web flows, Google HTTPS Transparency Report must account for SSL/TLS decryption too. We’ve seen clients in the UAE’s finance sector lose productivity because their firewall sizing didn’t handle encrypted data inspection effectively, leading to undetected threats.
Key metrics to grasp in any Firewall Sizing Guide:
- Firewall Throughput: Raw speed for basic packet filtering.
- NGFW Throughput: With advanced features like IPS and app control enabled, this is the real-world number you care about in business firewall sizing.
- Threat Protection Throughput: Full UTM/AV/IPS stack – your true baseline for protected traffic.
- Connections Per Second (CPS): How many new sessions it can start, crucial for high-user environments.
- Concurrent Sessions: Total open connections at once.
Based on our experience distributing Fortinet and Sophos in the region, aim for a model that handles 1.5-2x your current peak usage to allow for growth. For instance, if your business peaks at 2 Gbps, target at least 4 Gbps NGFW throughput in your firewall plan.
Key Factors to Consider When Sizing a Firewall for Your Business
How to size a firewall for business isn’t a one size fits all checklist; it depends on your setup. Start by auditing your network: How many devices connect daily? What’s your average bandwidth usage? Are you using VPN for remote access? Here’s what we’ve found matters most from working with SMBs in the Middle East when doing business firewall sizing.
1. Number of Users and Devices
Count everyone and everything, employees, IoT devices, guest Wi-Fi users. For a 50-user office, you might need 10,000-20,000 concurrent sessions in proper sizing. Add 20-30% buffer for BYOD and visitors. In UAE regulations, like those from TRA, this also ties into compliance for data protection during business.
2. Bandwidth and Future Growth
Measure your current internet speed and multiply by growth projections. If you’re at 1 Gbps now, plan for 2-3 Gbps in two years with cloud migrations. Don’t forget: Enabling features like IPS can cut throughput by 50%. Tools like Fortinet’s sizing calculator help simulate this in your firewall sizing process.
3. Throughput Requirements
Break it down:
- IMIX Throughput: For mixed packet sizes, closer to real traffic.
- Threat Prevention Throughput: With all security on aim for this as your baseline in business firewall sizing.
- VPN Throughput: If half your team is remote, ensure 500 Mbps+ for IPsec/SD-WAN.
Sophos recommends factoring in user types: Standard office workers vs. heavy streamers when planning how to size a firewall for business.
4. Encrypted Traffic Handling
Most traffic is encrypted now, so SSL inspection is non-negotiable. It can halve performance, so size up in firewall. Juniper SRX models excel here for mid-market setups in business firewall sizing.
5. Additional Features and Business Size
- Zero Trust: Adds overhead for user verification.
- Sandboxing: For advanced threat detection.
- For SMBs (10-100 users): Focus on cost-effective models in a size firewall.
- Mid-market (100-300): Need scalability for branches.
- Enterprise (300+): Requires advanced enterprise firewall sizing approaches.
| Factor | SMB (10-50 Users) | Mid-Market (50-300 Users) | Enterprise (300+) |
| Recommended Throughput | 1-4 Gbps NGFW | 4-10 Gbps | 10+ Gbps |
| CPS | 20,000-50,000 | 50,000-100,000 | 100,000+ |
| Key Features | Basic IPS, VPN | Full UTM, SD-WAN | Advanced AI Threat Detection |
| Growth Buffer | 1.5x Current | 2x Current | 3x Current |
Use this table as a starting point for business sizing, but tweak based on your audits.
How to Choose the Right Firewall for Your Business Size
Choosing the right firewall for your business size isn’t a one size fits all checklist. It’s essential to understand the specific needs of your business; whether you’re a small startup or a large enterprise. Learn more about how to choose the right firewall by considering your business’s bandwidth, number of users, and security needs. We discuss the key factors to keep in mind when sizing a firewall and offer insights into which firewall types (entry-level, midrange, or high-end) will best suit your needs.
Firewall Sizing Examples for Different Business Sizes
Let’s get practical with how to size a firewall for business. Based on projects we’ve done, here’s how a size firewall plays out.
Small Business (10-50 Users)
Think a Dubai startup with basic office needs. Current: 500 Mbps internet, 20 remote users. Size for 1-2 Gbps NGFW in business a size firewall. For small businesses, using a dedicated Small Business Firewall can help protect against cyber threats. Looking for cost-effective solutions, Entry-Level Firewall such as the FortiGate 60F or Sophos XGS 107 are ideal.
- Recommended: Sophos XGS 107 (firewall ~7 Gbps, threat protection ~370-720 Mbps) or FortiGate 60F (~700-900 Mbps threat protection).
- Why? Handles 10,000-50,000 sessions, low power use, and scales to 100 users without swap in proper firewall .
In one case, we upgraded a retail client from an undersized router to this, cutting latency by 40% through better business a size firewall.
Medium Business (50-300 Users)
A growing Abu Dhabi firm with branches. 1 Gbps line, 100 users, heavy VPN. For businesses with medium-sized networks, Midrange Firewall such as FortiGate 100F or Sophos XGS 2100 can offer solid protection.
- Recommended: FortiGate 100F (~2-3 Gbps threat protection) or Sophos XGS 2100 (~multi-Gbps threat protection).
- Why? Supports 50,000+ CPS, SSL decryption for encrypted threats in solid firewall.
We saw a logistics company double their remote access speed after right business a size firewall.
Growing Enterprise (300+ Users, Branches)
Larger setups with SD-WAN needs
For larger businesses with more complex requirements, High-End Firewalls like the Juniper SRX4100 or FortiGate 400G are excellent choices.
- Recommended: Juniper SRX4100 (~10+ Gbps IMIX/threat) or FortiGate 400G series (up to 100 Gbps in enterprise sizing).
- Why? High scalability for multi-site, with 1 million+ sessions in advanced enterprise firewall.
| Model | Business Size | NGFW/Threat Protection Throughput | CPS | Price Range (AED) |
| FortiGate 60F | Small | ~700-900 Mbps threat | 35,000 | 5,000-8,000 |
| Sophos XGS 107 | Small-Medium | ~370-720 Mbps threat | 45,000 | 6,000-10,000 |
| FortiGate 100F | Medium | ~2-3 Gbps threat | 60,000 | 10,000-15,000 |
| Sophos XGS 2100 | Medium | Multi-Gbps threat | 80,000 | 20,000-30,000 |
| Juniper SRX4100 | Enterprise | 10+ Gbps | 100,000 | 50,000+ |
These are ballpark figures from 2025-2026 data; always check current specs for accurate a size firewall.
Deployment Types: Hardware, Virtual, and Cloud – Which Fits Your Business?
One of the biggest decisionsa size firewall today is the deployment type. In 2026, SMBs in UAE often mix hybrid setups due to cloud migration and remote work. Here’s a quick comparison:
- Hardware Appliance: Physical box (e.g., FortiGate 60F/100F, Sophos XGS series). Best for on-premise control, high performance without cloud latency, and compliance (TRA rules).
- Drawback: Upfront cost and maintenance.
- Virtual Firewall (VM): Runs on your hypervisor (VMware, Hyper-V) or public cloud (FortiGate-VM, Sophos Virtual, Juniper vSRX). Great for scalable branches, lower hardware cost, easy migration. Ideal if you have existing virtualization.
- Cloud Firewall (FWaaS): Fully managed in cloud (FortiGate Cloud, Sophos Cloud, Palo Alto Prisma). Zero hardware, auto-scaling, central policy. Perfect for distributed teams or heavy cloud use (AWS/Azure), but depends on internet reliability.
| Deployment Type | Best For (SMB/UAE) | Pros | Cons | Typical Cost Impact |
|---|---|---|---|---|
| Hardware | On-premise offices, compliance-heavy | Max performance, full control | Upfront hardware, power/maintenance | Medium-High initial, low ongoing |
| Virtual (VM) | Hybrid/cloud hybrid, branches | Scalable, no new hardware | Needs hypervisor expertise | Low initial, license-based |
| Cloud (FWaaS) | Remote/hybrid work, quick deploy | Zero hardware, auto-update | Internet dependency, subscription | Subscription only, predictable |
At Netwise Technology LLC, we often recommend starting with hardware for core offices and virtual/cloud for expansion, this affects firewall sizing because virtual/cloud models need resource allocation (vCPU/RAM) matching throughput needs.
Integration with Modern Security Ecosystems (Zero Trust, SD-WAN, SIEM)
Firewalls sizing doesn’t stop at throughput; it must fit your broader security stack. In 2026, isolated firewalls are rare – successful setups integrate:
- Zero Trust (ZTNA): FortiGate/Sophos support user/device verification before access. Adds ~20-40% overhead – size up NGFW throughput accordingly.
- SD-WAN: For multi-branch UAE firms, integrate SD-WAN (FortiGate SD-WAN, Sophos SD-WAN) – ensure high VPN/IPsec throughput (e.g., 1 Gbps+ per site).
- SIEM/EDR: Forward logs to FortiAnalyzer/Sophos Central or third-party SIEM. This requires sufficient CPS to avoid drops during logging.
Example: A Dubai client with SD-WAN + Zero Trust needed a FortiGate 100F (not 60F) to handle encrypted tunnels + inspection without slowdown. We assess integration early in business firewall sizing to avoid rework.
Common Mistakes in Firewall Sizing and How to Avoid Them
We’ve fixed plenty of these in audits. Top issues in firewall sizing:
- Basing on Raw Throughput Only: Vendors list max speeds without security; test with features on in real business firewall sizing.
- Ignoring Growth: UAE businesses grow fast—plan 2-3 years ahead in how to size a firewall for business.
- Overlooking TCO: Initial cost is 30%; add subscriptions (e.g., FortiGuard at AED 2,000/year).
- No Real Testing: Do a PoC to simulate your traffic for better firewall sizing.
Avoid by using vendor tools: Sophos Sizing Tool or Fortinet’s calculator. And consult experts, rushing leads to regrets in business firewall.
Step by Step: How to Perform Your Own Firewall Sizing Audit
Want to DIY before contacting us? Follow this practical checklist for how to size a firewall for business:
- Capture Traffic Data: Use PRTG, Wireshark, or router logs for 1-2 weeks → note peak bandwidth, average users, encrypted %.
- Calculate Needs: Peak throughput × 1.5-2 (growth) + SSL decryption overhead (40-70%).
- Add Sessions: Users × 200-500 concurrent sessions/user + CPS estimate.
- Factor Features: +20-50% for IPS/Zero Trust/SD-WAN.
- Compare Models: Check vendor datasheets (Fortinet Product Matrix, Sophos Comparison) for threat protection throughput.
- Run PoC/Simulation: Test candidate model in lab or vendor demo.
- Review TCO: Hardware/license/support over 3-5 years.
- Plan Integration: Ensure compatibility with existing tools.
Tools: Fortinet Sizing Calculator, Sophos Firewall Sizing Tool (contact form for access). If stuck, our free assessment skips the guesswork.
How Netwise Technology Helps You Right-Size Your Firewall
As an official distributor for Fortinet, Sophos, and Juniper in the UAE, we don’t just sell boxes; we tailor solutions with expert firewall sizing. We’ve deployed over 200 firewalls in the region, from simple setups to complex SD-WAN integrations.
Our process for how to size a firewall for business:
- Free assessment: Analyze your traffic and threats.
- Custom firewall sizing: Using tools and our experience.
- PoC: Test in your environment.
- Installation and support: Ongoing monitoring.
One Dubai client saved 25% on costs by downsizing from an oversized unit we identified through proper business firewall sizing. Ready for yours? Contact us for a no-obligation chat on firewall size.
Wrapping It Up
Getting firewall sizing right means smoother operations, better security, and money saved long-term. Whether you’re a small shop or scaling up, focus on your real needs users, growth, features, deployment type, and integrations in this Firewall Sizing Guide. With threats evolving in 2025-2026, like AI-driven attacks, a well sized NGFW is your frontline. If this rings true for your setup and you need help with business firewall sizing (or enterprise firewall sizing), reach out to Netwise we’re here to make how to size a firewall for business straightforward.