Choosing an SME Firewall: Capacity, VPN and Licensing

1. Describe network use before selecting hardware

User count is a starting point, not a complete sizing method. An office running cloud backups has a different traffic profile from a site with IP cameras and a production network. Collect peak-hour bandwidth, concurrent session and resource usage records from the existing appliance, and add planned branches and applications to the requirements.

• Internet connection speeds, number of circuits and backup connection requirements
• Separation of user, server, guest, camera and production networks
• Branch connectivity, remote workers and supplier access
• Business applications and data transfers used at peak times
• Monitoring, log retention and continuity requirements during a fault

2. Read performance figures under comparable conditions

Vendor tables may list separate capacities for firewalling, IPS, threat protection, IPsec VPN and SSL inspection. A raw packet forwarding benchmark does not fully represent daily use with encrypted traffic inspection and application control. Fortinet also explains that actual performance depends on the enabled features and workload, and recommends a proof of concept for critical deployments.

Ask for expected capacity with your intended security features enabled, together with the test conditions supporting the estimate. TLS/SSL inspection also requires planning for certificate distribution, application compatibility and exception management. Set the inspection scope alongside your access policies and data processing requirements.

• Which traffic profile was used to measure threat protection and SSL inspection throughput?
• Do concurrent session and new session capacities cover the current load?
• Will traffic between local networks also pass through this appliance?
• How has capacity headroom for growth and unexpected load been calculated?

3. Test VPN and remote access with a pilot user

A proposal saying only 'VPN included' is insufficient. A tunnel between branches and an employee's connection from home are different scenarios. Obtain written confirmation of supported protocols, client licensing, operating system compatibility and authentication methods for the model and software version being supplied. Do not assume that every model supports every VPN type.

Use a pilot user to test ERP, file sharing and meeting applications at busy times. Decide between routing all traffic through the organisation and split tunnelling according to your security policy and internet capacity.

• Separate capacity targets for branch and user connections
• Integration with MFA and the organisation's identity system
• Time-limited supplier access restricted to the required resources
• Reconnection and alternative internet connection tests
• Access removal and activity records when a user leaves

4. Make subscriptions and running costs explicit

Alongside the hardware quotation, list the included security services, technical support level and logging solution. Licensing for functions such as web filtering, malware inspection and central management can vary by product and package. Ask the supplier to state in writing which services are affected if subscriptions are not renewed.

• Initial deployment, existing rule cleanup and VPN migration scope
• Security subscription and technical support durations
• Where logs will be stored, for how long and at what capacity
• Spare equipment, redundant power and high availability requirements
• Annual renewal, maintenance and change management responsibilities

5. Check hardware and software lifecycles separately

An appliance may still have hardware support while its software branch follows a different support schedule. For FortiGate, check both the hardware model and FortiOS release in the vendor's lifecycle records. Separately verify that the appliance supports the intended upgrade and that the release is compatible with your critical applications.

Include software updates, configuration backups and rollback procedures in the service plan. Use published vendor records and the proposal's support terms rather than estimating an unannounced end-of-support date. Responsibility for managing the appliance after purchase should already be clear during installation.

6. Define measurable migration acceptance criteria

Illustrative assessment: consider a business with 35 users, two branches and cloud backups. While a backup is running, test ERP access between branches and remote workers connecting with MFA. These numbers do not recommend a particular model. They illustrate why the decision worksheet should record current load, enabled security features, observed latency and business owner acceptance together.

Document the migration window, business approval and conditions for returning to the old setup in advance. A suitable firewall is a manageable solution that can sustain your security controls under the expected load. The highest headline figure in a specification sheet is only one part of that assessment.

• Do critical applications work with the security services enabled?
• Can guest and production networks reach only their permitted resources?
• Can VPN users connect with MFA and access only the required systems?
• Have connection or appliance failure scenarios been tested?
• Do alerts reach the responsible person, and can the logs be searched?
• Have the current rules, configuration backup and management access been handed over?