Firewall Throughput Explained: Which Number Matters

A firewall datasheet lists five or six throughput figures, and the biggest is the least useful. Here is what each one measures.

Firewall throughput

The speed at which the unit can pass traffic while only checking addresses and ports, with no inspection of content. It is the largest number on the sheet and the furthest from how the firewall will be used. Some makers quote it for three packet sizes, which is why you see figures such as 10 / 10 / 6 Gbps.

IPS throughput

The speed with intrusion prevention switched on: the firewall looks inside traffic for known attack patterns.

NGFW throughput

The speed with intrusion prevention and application control switched on together.

Threat protection throughput

The speed with intrusion prevention, application control and anti-malware scanning all running. This is the closest figure to real use, and the one to size on. Palo Alto Networks calls it Threat Prevention throughput and SonicWall calls it threat prevention throughput.

VPN throughput

The speed of encrypted traffic through an IPsec tunnel. It matters if branch offices or remote staff send most of their traffic through the firewall.

TLS inspection throughput

Most web traffic is encrypted. To inspect it, the firewall has to decrypt it, check it and encrypt it again, which is heavy work. This figure is often a fraction of the others. If you plan to inspect encrypted traffic, size on this number.

Comparing brands

Each manufacturer tests in its own way, with its own traffic mix, so figures from different brands are not directly comparable. Use them to shortlist, and leave headroom.

Common questions