Firewall Throughput With Inspection On: 25 Models Compared

Fortinet's product matrix gives the FortiGate 60F 10 Gbps of firewall throughput. Four rows down, the same page gives it 700 Mbps of threat protection throughput, and its SSL inspection row, IPS over HTTPS, says 630 Mbps. Bought to inspect traffic, the box keeps 7% of its headline figure once it does that job.

We read the performance tables for 25 desktop firewalls from four vendors, each in the vendor's own document: Fortinet's October 2026 product matrix (eight FortiGates, 30G to 90G), Palo Alto's PA-400 Series datasheet, measured on PAN-OS 12.1 (nine models), the product matrix in Sophos's firewall brochure (the five second-generation desktop XGS) and WatchGuard's comparison chart for the Firebox T25, T45 and T85. Then we divided each inspection figure by the same model's headline. Across the 25, throughput with inspection on runs from 7.0% of the headline to 71.4%, median 20.6%. Firewall sizing starts from the second number, and it is the second number we size against when a firewall goes into an office network we build in Kenya.

Why is threat protection throughput so far below firewall throughput?

Because the headline is measured with little or nothing inspected, and each vendor picks its own test for it. Fortinet prints firewall throughput for 1518-byte UDP packets. WatchGuard does the same, "based on RFC 2544 methodology". Sophos measures its headline with HTTP traffic and 512 KB responses. Palo Alto measures its with App-ID and logging switched on, over what it calls appmix transactions, so its headline already carries part of the inspection work.

Fortinet's and Sophos's inspection figures switch on the same four things: firewall, IPS, application control and malware protection, over Fortinet's Enterprise Mix and Sophos's Enterprise Traffic Mix. Palo Alto's threat prevention adds antivirus, antispyware, WildFire, DNS Security and file blocking to App-ID and IPS. WatchGuard prints "UTM (Full Scan)" and does not say on that page which services it covers.

So the share a box keeps says as much about the headline test as about the box. Models with a 1518-byte UDP headline keep 7% to 22% (median 12.5%), Sophos's HTTP headline keeps 20% to 25% (median 20.6%), and Palo Alto's App-ID headline keeps 46% to 71% (median 56.3%). The model matters too, since Fortinet alone runs from 7% on the 60F to 22% on the 50G, but no box without App-ID in its headline comes near a Palo Alto. A PA-460 keeping 71% is not ten times better at inspection than a 60F keeping 7%. Its headline was measured doing more of the work. Packet size alone moves a figure a long way, and WatchGuard prints the T45's VPN throughput both ways: 1.58 Gbps with 1518-byte packets, 460 Mbps on its IMIX mix.

Firewall throughput with inspection on, by model

Headline is each vendor's firewall throughput as defined above. Inspection on is Fortinet's and Sophos's threat protection, Palo Alto's threat prevention and WatchGuard's UTM (Full Scan). HTTPS inspected is Fortinet's SSL inspection row, Sophos's Xstream SSL/TLS and WatchGuard's HTTPS (Full Scan), the last undefined on WatchGuard's chart like its UTM row. The PA-400 datasheet prints no such figure.

On the 16 models that print an HTTPS figure, it is 6.1% to 26.0% of the headline, median 7.2%. If the box you have been quoted is not in this table, send us the model before you pay for it and we will read its datasheet the same way.

FortiGate 60F vs Sophos XGS 88: one headline, two threat figures

The two print nearly the same headline, 10 Gbps and 9.9 Gbps, and nearly the same HTTPS figure, 630 Mbps and 600 Mbps. Their threat protection figures are 700 Mbps and 2.0 Gbps. Both vendors call the traffic behind that number an enterprise mix and neither document says what is in it, so the datasheets cannot tell you whether the XGS 88 inspects your traffic nearly three times faster or was tested on lighter traffic.

The HTTPS rows are the closest pair in this set. Fortinet averages HTTPS sessions across cipher suites with IPS on; Sophos measures IPS over HTTPS sessions with different cipher suites. On that row the two boxes are 5% apart, and between a FortiGate and an XGS, that is the row to compare.

The inspection figure also assumes you bought the inspection. WatchGuard's chart puts IPS and application control in its Basic Security Suite, and Palo Alto quotes its performance with security subscriptions enabled. Sophos's brochure goes furthest and maps the features its test switches on: the Base License that comes with every appliance covers networking and VPN, while IPS sits in the Network Protection subscription and application control in Web Protection. At least two of the four things its threat protection figure is measured with are subscriptions, so price them with the box, and if an auditor is the reason for the inspection, scope it with the rest of the security work rather than on its own.

Sizing a firewall from the datasheet

Start with the internet link in Mbps. An office running two links at once with traffic spread across both adds them together; one whose second link only carries traffic after the first fails, as in the failover we tested, sizes on the faster one.

Then pick the column that matches what the firewall will do. Decrypting HTTPS means the HTTPS inspected column. IPS and application control without decryption means inspection on. Inspecting nothing means you need a router rather than a next-generation firewall, though not a household one.

The number you pick has to clear the link with room to spare, because two of the four print theirs as ideal-condition results. Fortinet's matrix says its figures were "attained in internal lab tests under ideal conditions" and Sophos calls its own a maximum "measured under ideal test conditions". WatchGuard says its rates "will vary depending on environment and configuration".

On a 500 Mbps link with HTTPS inspection, 12 of the 16 models that print an HTTPS figure clear it. The FortiGate 30G (400 Mbps), the 40F (310 Mbps) and the WatchGuard T25 and T45 (216 and 301 Mbps) do not. The 60F and the XGS 88 clear it by 26% and 20%, which is not much room on a ceiling. Two 500 Mbps links active together make 1,000 Mbps, and six clear that: the FortiGate 50G, 70G and 90G and the Sophos XGS 118, 128 and 138. WatchGuard's chart is the only one of the four that sizes a firewall by headcount, 20 users for the T45, and on that 500 Mbps link with HTTPS inspected those 20 people share 301 Mbps, set by the box rather than the line.

An open-plan office of under about fifteen people on one 100 Mbps line, with nothing to decrypt, can stop reading here. Every box in this table carries that link with inspection on, and for that office we would not quote a next-generation firewall at all.

Anything bigger, or a firewall that has felt slow since inspection went on: send us the model, the speed of each internet link and whether HTTPS gets decrypted, through the scoping form on our network page or on WhatsApp at +254 713 403 044. You get back which printed figure your traffic actually meets, whether it clears your links, and the model we would fit if it does not. It is free and commits you to nothing. If we run the network after installation, the monitoring and firmware updates come as one monthly figure.