NGFW Sizing Tool

1) Internet bandwidth

Current bandwidth (Mbps)

Future bandwidth (Mbps)

Peak factor

2) Concurrent users → sessions/CPS

Concurrent users (peak)

User profile

Burstiness

Sessions per user (override, optional)

3) Public hosted apps/servers (publishing)

Add published apps (inbound services) to estimate extra sessions load.

4) Feature set (CPU cost multipliers)

5) VPN requirements

Remote access VPNConcurrent SSL-VPN users

VPN user profile

Site-to-site IPsecIPsec tunnels

IPsec BW as % of peak

6) Interfaces required

1G ports

10G ports

25G ports

40G ports

100G ports

7–8) Hardware options

Redundant PSU requiredInternal storage required

9) SSL inspection (MITM / decrypt & re-encrypt)

Enable SSL inspectionDecrypt mode

% of traffic to decrypt

TLS 1.3 heavy

Recommendation philosophy

This tool recommends what to ask vendors for by sizing so your peak load sits around 20–30% CPU. Lower target CPU = more conservative (bigger box).

Target CPU at peak (%)

Headroom policy

Throughput headroom %

Sessions headroom %

CPS headroom %

VPN headroom %