Firebox T35 vs Palo Alto PA-220 - real-world throughput numbers.

I manage infrastructure for a chain of retail stores, roughly 80 branches, so I've been through this exact evaluation. We currently run Palo Alto PA-220s at about half our locations and have tested the WatchGuard T35 extensively in our lab and in a pilot deployment.

Here is my grounded comparison based on production telemetry and deployment pain points.

**Real-World Throughput with Security:** With App-ID, SSL decryption (for a few key apps), IPS, AV, and URL Filtering all enabled, our PA-220s sustain a consistent 85-95 Mbps. The WatchGuard T35, under an identical policy load, reliably hit 180-200 Mbps. The T35's advantage here is tangible if your branches have internet circuits above 100 Mbps.
**True Five-Year TCO:** The PA-220 hardware is more expensive upfront, but the bigger hit is the Threat Prevention and URL Filtering subscription, which was roughly 40% more per year than the equivalent Total Security bundle from WatchGuard for us. Over five years, a single PA-220 can cost $2-3k more all-in. For 80 units, that math forced a hard look.
**Initial Configuration & Management:** Palo Alto's PAN-OS is powerful but has a steeper learning curve. Setting up consistent App-ID policies took us longer. WatchGuard's interface is simpler for common branch setups. However, managing 80 of either is done through their respective cloud managers (Panorama vs. WatchGuard Cloud), and both are competent at scale.
**The Breaking Point:** For the PA-220, it's the 100 Mbps threshold with full security. Once branch traffic consistently exceeded that, CPU would spike during backup or update windows. The T35's limitation isn't throughput, but the depth of logging and forensic detail available; Palo Alto provides richer session analysis and threat logs for our SOC team.

My pick for our refresh going forward is the **WatchGuard T35**. It's the clear choice for branches with 150 Mbps+ internet circuits where budget is a primary constraint and you need the full security suite on for all traffic. If the OP's branches have sub-100 Mbps lines, or if they have a dedicated security team that deeply utilizes Palo Alto's more granular logging and investigation tools, the PA-220 is justified. To make a clean call, tell us your typical branch circuit speed and whether your team already has expertise with one of the two platforms.

> "I am seeking real-world, apples-to-apples performance comparisons"

I've run both in my homelab and a small office (around 40 users). My numbers line up closely with user1275's - PA-220 tops out around 90-100 Mbps with full stack, T35 comfortably does 180-200. But one thing I'd add: the PA-220's SSL decryption hit is brutal. If you're decrypting more than a handful of apps, the throughput drops way faster than the T35. I saw it dip to 50-60 Mbps with heavy decryption + IPS.

Also, the T35's fan noise is louder. Not a dealbreaker but worth knowing if your branch offices are quiet spaces.

What sort of circuits are you feeding these? If you're on 100 Mbps fiber, the PA-220 might be tight. If you're on 50 Mbps, it's fine.

You're absolutely right to call the datasheet figures meaningless. They're basically derived in a vacuum with "optimal" traffic patterns that never exist in reality.

But let's not get too carried away with the T35's raw throughput numbers. Yes, it pushes more bits. The real question is whether it's inspecting the same things with the same level of scrutiny. Palo Alto's App-ID is a fundamentally different beast than WatchGuard's application control. I've seen the former catch stuff the latter glosses over, which inherently consumes more cycles. Comparing Mbps without accounting for what's in those megabits is a bit like comparing car speeds without mentioning one has an engine and the other is rolling downhill.

That SSL decryption hit everyone mentions? That's where the rubber meets the road. If your "subset" of traffic grows, the PA-220 will choke faster, as noted. But ask yourself why the performance degrades that way. It's doing more intensive session inspection. Is that a flaw or a feature? Depends if you think the juice is worth the squeeze.

That's a great breakdown of the features you need to test. Since you listed SSL decryption as a must-have, could you share what percentage of traffic you expect to decrypt? I'm trying to understand the real-world performance hit myself, and it sounds like that's the biggest variable in these comparisons.

The decryption percentage question is crucial because the performance curve isn't linear. You can't just take the "full stack" number and linearly extrapolate. My own benchmarks show that once you cross a threshold, often around 30-40% of traffic being decrypted, the latency and throughput degradation becomes severe and non-linear on both platforms, but the slope is steeper on the PA-220 due to its older hardware architecture.

The more critical variable is the *session size* of the decrypted traffic. Decrypting a thousand 1MB file downloads is a different workload than decrypting a million 2KB API requests. The latter will crater performance much faster due to the per-session SSL handshake overhead, which is where these SMB boxes really struggle. Always model your decryption policies against your actual traffic mix, not just a raw percentage of bandwidth.

Your point about circuit size is the operative one. If the branch circuit is 100 Mbps, a PA-220 running at 90-95 Mbps sustained leaves no headroom for growth or bursts, effectively capping your internet investment. The T35's throughput allows you to utilize a 150 or 200 Mbps circuit, which can sometimes be procured for a negligible cost increase over 100 Mbps, improving user experience without a corresponding hardware penalty.

However, I must temper that with a financial observation from the performance data. The PA-220's steep decline under heavy SSL decryption, as you noted, creates a hidden capacity constraint. If your decryption requirements scale over the 5-year lifecycle, you may face a premature hardware refresh or performance throttling, neither of which is accounted for in a simple upfront TCO model. The T35's more gradual decline provides a longer performance runway, which amortizes its capital cost more effectively.