How do you choose the right firewall model for your environment? The first and obvious factor to consider is performance. We need to account for the features that will be used in our firewall (IPsec tunnels, security features, SSL decryption). Based on the expected throughput and using vendor datasheets, we can estimate which model is right for our environment. Remember that these are only estimates and can be inaccurate. If you want to be 100% sure that you have the right model, the only way to find out is to test it with real traffic, which is often not possible because it requires a normal deployment like in a production environment. Some vendors, such as Palo Alto Networks, have tools to estimate firewall load under specific amounts of traffic. For example, if I’m expecting:
- 500 Mbps
- 300 Mbps of IPsec
- 500 Mbps of decrypted traffic
Based on the tool, I generated an estimated load for three firewall models.
In this case, the PA-3260 was chosen. Based on the estimation, it should have around 70% load with 1.3 Gbps of traffic. In practice, the firewall can handle even more, reaching 80-85% load when throughput is around 2 Gbps.
This confirms that the datasheets are correct in this case, as it can handle 2.2 Gbps when all security features are enabled.
The second factor to consider is interfaces. This is straightforward; we need to choose a model with the specific interface configuration we require.
Is that everything that should be taken into consideration? Unfortunately not. There is a third element called maximum values. Often, vendors hard-code specific values for some firewall features. I have a good example of that. The PA-3260 is quite old NGFW, and the customer is going to replace it because it is nearing its performance limits. According to the datasheets, the right model is the PA-3410, which is around three times more powerful than the PA-3260. The customer has a lot of remote users; day by day, we observe around 2k remote users and its growing. The PA-3410 allows only 1.8k concurrent GlobalProtect connections, while the older and less powerful PA-3260 allows 2048 GP users. The next firewall that supports more GP users is the PA-5410, which is too powerful for that environment. However, because of the GlobalProtect hard-coded limit, the PA-3260 should be replaced by the PA-5410. Details for each model are available here: https://www.paloaltonetworks.com/products/product-selection
Similar things with Fortigate gear. For example, if you plan to deploy large SD-WAN infrastructure, you have to take into account HUBs scalability, for example amount of IPsec tunnels
Max values for each model and FortiOS version cen be found here: https://docs.fortinet.com/max-value-table
To summarize, to choose the right firewall, we have to consider performance. Without testing, it is only an estimate, so my advice is to choose around 30% bigger model than you think you need. If your environment has a larger scale, consider maximum values and hard-coded limits.