Anyone who's actually sized a firewall for a production environment knows this. The vendor datasheet is a best-case scenario measured in a lab with a single rule allowing all traffic. It's a theoretical maximum, like a car's top speed without considering traffic, corners, or road conditions.
Real-world performance is dictated by three things:
* **Rule count and complexity:** Every packet has to be evaluated against your rulebase. A 5000-rule policy with application identification, user-ID, and SSL decryption enabled will crush throughput compared to a 50-rule "any/any" policy.
* **Inspection depth:** Turning on full threat prevention, IPS, or advanced malware protection moves the bottleneck from the network ASIC to the CPU. The datasheet will have a separate, much lower number for "threat prevention throughput" – that's the one you need to pay attention to.
* **Traffic mix:** Are you pushing 1500-byte packets, or a lot of small, chatty packets? Small packet sizes murder firewall performance because the device has to process more packets per second to achieve the same gigabit throughput.
I see this constantly in audit reviews. A company buys a box rated for 10 Gbps because that's their internet pipe. They turn on all the security features they paid for, and suddenly they're at 70% capacity during peak hours with latency spikes. The logs show packet drops.
Always design with at least a 40% overhead buffer from the *threat prevention* number, not the raw firewall throughput. And if the vendor can't provide independent verification (like a NSS Labs report) for their performance claims under specific inspection profiles, treat the datasheet as marketing material, not a technical specification.
Where is your SOC 2?