How to Choose a Firewall for Your Business
Choosing a firewall comes down to five decisions. Get the first two right and the rest are easy.
1. Size it on the right number
Every firewall has several throughput figures. The largest, firewall throughput, is measured with all inspection switched off. The one that matters is threat protection throughput, measured with intrusion prevention, application control and anti-malware running.
As a rule, the threat protection figure should be at least one and a half times your internet line speed, so that there is room for busy hours and for a faster line later.
2. Count users and sites
More users mean more simultaneous connections, and each firewall has a limit. Count staff, guests, phones, cameras and anything else that uses the network. Then count sites: every branch that needs a tunnel to head office adds VPN load.
3. Check the ports
Count the connections you need: internet lines, the main switch, a separate network for guests or servers, and a link to a second firewall if you want a standby. Larger sites need fibre (SFP) ports, and a fast internal network needs 10G ports.
4. Decide the licence
The hardware is bought once and the protection is a subscription. Compare the cost over three or five years, not the first invoice, and check what each bundle includes. A cheaper firewall with an expensive licence is not cheaper.
5. Pick a brand you can get help with
All five brands on this site make capable firewalls. What separates them in practice is who will configure and support the one you buy. Choose the brand your supplier or your own team knows well.
Mistakes that cost the most
- Sizing on firewall throughput and finding the internet slows down when protection is switched on
- Buying the hardware and letting the licence lapse after the first year
- Leaving the default rules and never reviewing them
- Buying one unit where the business cannot afford a day without internet
Common questions
Does a small office need a business firewall?
If the office holds customer data, takes payments or lets staff work remotely, yes. The router from an internet provider does not inspect traffic, filter websites or give you a record of what happened.
Should I buy two firewalls?
If losing internet for a day would stop the business, a second unit in a standby pair is worth its cost. Otherwise a single unit with the manufacturer's replacement cover is usually enough.
How long does a firewall last?
Five to seven years is typical. What ends its life is usually the manufacturer ceasing to support it, or the internet line outgrowing it, and not hardware failure.