How to choose a firewall that fits your business size

Choosing a firewall by famous brand name or by the lowest price often leads to two outcomes: buying too much capacity (wasting budget) or too little (bottlenecks when deep packet inspection runs under heavy load). Below are practical criteria to consider before choosing, independent of any single brand.

1. Concurrent users, not total headcount

The number of users actually on the network at the same time (including IoT devices, cameras and network printers) matters more than headcount on paper. Size the firewall by concurrent connections and the maximum number of sessions it must handle.

2. The real bandwidth with inspection enabled (threat inspection throughput)

The maximum throughput vendors publish is usually measured as plain packet forwarding (firewall throughput), without full deep inspection (IPS, antivirus, SSL inspection). Real throughput with all security features on (threat inspection throughput) is usually much lower. That is the figure to compare against your actual needs.

3. Features by level of risk, not every feature available

Businesses handling sensitive customer data, or with foreign partners requiring strict SLAs, should prioritize features such as cloud malware analysis and identity-based access control (NAC). Smaller businesses with fewer specific risks can prioritize the basics (VPN, web filtering, IPS) to optimize cost.

4. Scalability and redundancy (High Availability)

For systems that cannot tolerate interruption (outsourcing with SLAs to foreign clients, multi-site chains), plan a two-firewall HA configuration (Active/Passive or Active/Active) from the start, instead of upgrading after downtime has already occurred.

5. Annual licensing cost, not only the initial hardware price

Most advanced security features (anti-malware, web filtering, threat intelligence) come with annual licenses. The yearly running cost should be part of the long-term budget, not just the purchase price comparison.

The most accurate way to size a firewall is to measure real network load before choosing a model. This is a step COREIT performs in every consulting and architecture design package.