Firewall Quote Comparison: Read Inspected Throughput Before Headline Speed

Security · Buyer guide

A firewall quote says “10 Gbps”. Your internet connection is much smaller, so the appliance looks comfortably oversized. Before accepting that conclusion, ask which performance test the number describes and which security functions will be enabled. A forwarding benchmark and an inspected-traffic benchmark are different design inputs.

Read the label beside the number

Separate firewall throughput, IPS, NGFW, threat protection and SSL inspection figures. Record the test conditions and enabled functions instead of comparing the largest number from each vendor. Do not mix a simple packet-forwarding figure from one product with an inspected application figure from another.

Fortinet’s current 70G-series datasheet lists 10 Gbps firewall throughput under its specified UDP-packet test, 1.5 Gbps NGFW throughput, 1.3 Gbps threat-protection throughput and 1.4 Gbps SSL inspection throughput for its stated HTTPS test. These are manufacturer “up to” figures with different conditions, not four interchangeable guarantees. Fortinet FortiGate/FortiWiFi 70G datasheet, specification page 10

Build the workload before choosing the model

Record users, devices, important applications, internet links, branch connectivity and expected growth. Identify the traffic you intend to inspect and the security services the organisation requires. Include peak usage, concurrent sessions and new-session behaviour where they affect the design.

Do not translate one benchmark directly into a supported-user count. Two offices with the same headcount can have different workloads. Ask the proposer to explain the sizing assumptions, the chosen operating mode and how the intended policy affects the comparison.

Compare like-for-like security configurations

Request the exact appliance SKU, software version, enabled services and test references. If a proposal relies on an exclusion, exception or different inspection mode, make that visible to the security owner. A faster result obtained by changing the required protection is not automatically a better design.

For encrypted traffic, define the intended inspection policy with the organisation’s security team, including managed-client readiness and application exceptions. The purpose here is to size the approved policy, not to tell a buyer to turn inspection on indiscriminately or weaken controls to reach a headline rate.

Show the complete commercial scope

List appliance hardware, required licences, security subscriptions, support, implementation, migration and renewal terms. Record the term, inclusions, currency, tax treatment and validity. A quote for hardware alone should not be compared with a three-year supported security bundle as if they were equivalent.

Include responsibility for backups, change approval, policy migration, validation and rollback. Identify whether high availability is required and how the complete proposed arrangement is sized. Do not assume that buying a second appliance automatically doubles useful inspected capacity.

Require a written explanation of headroom

Ask the proposer to identify the expected peak workload and the allowance it has chosen for growth or uncertainty. Keep that reasoning beside the selected model. An unexplained claim that the appliance is “more than enough” gives the next reviewer little basis for assessing a later network change.

Ask for a sizing explanation you can keep

The worksheet below lets you compare the proposed workload, security configuration, evidence and total commercial scope. The original graphic shows selected FortiGate 70G figures only to explain metric labels; bar length is not a prediction of your office’s performance.

For RIAM’s firewall-and-security enquiry, share the approved service requirements and current network context. The useful next step is a documented model and policy review. This article is not a multi-vendor winner list, a live quote or a commitment that the illustrated appliance is appropriate for your site.