Firewalls in India — NGFW Sizing, Real Throughput and How to Choose

An NGFW adds application awareness, user identity and integrated intrusion prevention to traditional stateful filtering. The practical difference is what a policy can say: instead of permitting a port, you permit an application to a group of people, which is the only workable approach now that most applications share the same handful of ports. Every major enterprise firewall sold today is an NGFW.

Historically UTM meant an all-in-one appliance for smaller organisations and NGFW meant the enterprise product. That distinction has largely dissolved — the same vendors ship the same code across both, and the differences are now licensing tier, form factor and expected throughput. Treat it as a sizing and packaging question rather than an architectural one, and ignore anyone presenting it as a fundamental choice.

Start from the traffic you intend to inspect and the features you intend to run, not from the speed of your internet circuit. Assume TLS inspection unless you have consciously decided against it. Check concurrent session capacity as well as bandwidth. Add three to five years of growth plus any VPN or SD-WAN role the device may take on. Then verify interface count and speeds. The sizing section above walks through each of those in order.

Because the headline figure is measured with inspection disabled, on a traffic profile chosen to produce the largest number. The same datasheet also publishes IPS throughput, NGFW throughput, threat protection throughput and throughput with TLS inspection enabled, and those descend steeply. Nothing is being hidden — all five are printed. The problem is that only the first reaches the proposal.

Traffic profiles used for benchmarking. Rather than measuring with uniform large packets, which flatters any device, they use a mix of packet sizes and application types that resembles real network traffic more closely. Figures measured on these profiles are lower and considerably more useful for sizing. If a vendor publishes them, use them; if they do not, ask why.

It is a genuine decision with costs on both sides. Without it, the majority of traffic is inspected only at the envelope, so a large share of what the firewall exists to catch passes unread. With it, throughput falls sharply, some applications break on certificate pinning and must be excluded, and there are privacy and legal considerations to work through. What is not defensible is having no position — or deciding to enable it later on hardware sized as though you never would.

We are a Fortinet partner, so treat our answer with that in mind. Both are capable enterprise platforms and either will serve a competent team well. The honest differentiators are rarely the feature matrix: they are what your team already knows, what the local support and replacement path actually looks like in your cities, how the licensing behaves at renewal, and whether you want the firewall to also carry SD-WAN or switching in a single fabric. We would rather talk about those than argue a comparison chart.

Hardware is frequently the smaller part. Subscriptions for intrusion prevention, antivirus, web filtering and sandboxing renew annually, as does support, and across a typical five-year life the recurring cost commonly exceeds the appliance. Ask for the five-year total including renewals rather than the purchase price, and compare quotes on the same feature set — two quotes with different subscription bundles are not comparable numbers.

An entry-level model from any major vendor, sized for the traffic you will actually inspect rather than for your circuit speed, with the subscription bundle you will genuinely use. The most common small-business mistake is not buying the wrong brand — it is buying a box sized on the headline figure, enabling inspection, and discovering it cannot cope. Our FortiGate entry-level guide covers that segment specifically.

Renting suits organisations that want the capability without the capital outlay, or that expect requirements to change before a refresh cycle completes. Buying is usually cheaper across a full lifecycle if requirements are stable. It is a cash-flow and flexibility decision rather than a technical one — see firewall on rent.

The rule base is the risk, not the hardware. Automated conversion tools carry your existing policy across faithfully, including every rule nobody can justify, permitting things nobody uses, written by people who have left. The valuable part of a migration is the review that removes them — and a migration is the rare moment when that is politically possible. Expect a parallel run and a rollback plan for cutover.

Yes — policy changes, subscription and firmware lifecycle, rule-base review and monitoring, across multi-vendor estates rather than only the ones we sell. That is covered on firewall services, and the monitoring side connects to our operations centre.

Plan it at purchase. An active-passive pair roughly doubles the hardware cost and removes a single point of failure sitting directly in the path of everything. Retrofitting it later means a maintenance window and reconfiguration on a device already carrying production traffic, which is a far worse afternoon than specifying it correctly at the start.

Fortinet primarily — we are a partner and say so — along with Cisco, Palo Alto Networks and Sophos, and we manage mixed estates containing all of them. See technology partners. If your team already runs one platform well, that is usually a stronger argument than any feature comparison.