免费 · 网络与 IT 基础设施

防火墙选型计算器.

为下一代防火墙选型：计算威胁防护、TLS 解密和 VPN 吞吐量、并发会话和新建连接速率，便于对照厂商规格书。

CALCULATED IN YOUR BROWSER · NOTHING IS UPLOADED

Users and links

Users

Devices per user

Internet download (Mbps)

Internet upload (Mbps)

Traffic inspected between internal zones (VLANs, DMZ) (Mbps)

Security features enabled

Intrusion prevention (IPS)

Application control and URL filtering

Anti-malware / sandboxing

TLS (SSL) inspection

Share of traffic that is encrypted (%)

Share of encrypted traffic you decrypt (%)

Banking, health and pinned apps are usually excluded.

VPN

Concurrent remote-access VPN users

Average throughput per VPN user (Mbps)

Site-to-site tunnels

Peak throughput per tunnel (Mbps)

Sessions and headroom

Concurrent sessions per device

Browsers and sync clients keep dozens of connections open.

Average session lifetime (s)

Growth over the device’s life (3–5 years) (%)

Maximum load at peak (%)

Threat prevention / threat protection throughput needed1.86 Gbps74,286 sessions

Peak one-direction traffic: 1 Gbps
Both directions combined: 3.71 Gbps
TLS inspection throughput: 1 Gbps
VPN throughput: 1.02 Gbps
Concurrent sessions: 74,286
New sessions per second: 2,477
WAN port speed: 1 GbE
Headroom factor: × 1.86

Compare with the vendor datasheet

Datasheet line	Required	How to read it
Firewall throughput (stateful, L4)	1.86 Gbps	Usually measured with large UDP packets: the most optimistic figure. Never size on this alone.
Threat prevention / threat protection throughput	1.86 Gbps	The figure to size on. Check the traffic mix and that logging was enabled in the vendor test.
TLS / SSL inspection throughput	1 Gbps	Often the lowest datasheet figure; it varies with cipher, key size and session reuse.
IPsec VPN throughput	1.02 Gbps	Check whether the figure uses large packets; real VPN traffic mixes small packets.
Concurrent sessions	74,286	Connection-table size.
New sessions per second	2,477	Connection setup rate; matters for busy web servers and NAT.
Remote-access VPN users	65	Licensed or maximum concurrent clients.
Site-to-site tunnels	3	IPsec tunnel capacity.

Vendor-neutral estimate. Datasheet conditions differ between vendors; RFC 9411 and NetSecOPEN describe a common test methodology you can ask vendors about.
Plan high availability as a pair of identical units: each unit must carry the full load alone.
Inspection throughput falls as features are added; ask the vendor for a figure with your exact feature set enabled.

使用方法: 防火墙选型计算器

输入数据或选择文件，调整设置并生成结果。复制或下载之前，请检查结果。

限制与支持格式

输入内容在您的设备上处理。

英语技术说明

Vendor-neutral estimate; datasheet test conditions differ between vendors. Session counts per device are an assumption you should check against a current firewall. Everything is calculated in your browser; nothing is sent or probed on the network.

Peak traffic (largest direction plus inspected internal traffic) is scaled by growth and divided by the maximum load. TLS throughput applies the encrypted and decrypted shares; sessions are devices × sessions per device; new sessions per second divide sessions by their lifetime.

250 users with 2 devices each on a 1 Gbps link with IPS, application control, anti-malware and TLS inspection need about 1.9 Gbps threat-protection throughput and 74,000 sessions.