Sizing a Firewall: What Really Separates UTM from NGFW

The complaint we hear most

"We bought a new firewall and the internet got slower." Usually the box is fine. It was chosen from the biggest number on the datasheet, then someone switched on IPS, web filtering and SSL inspection, and real throughput dropped to a fraction of that number. This guide is about avoiding that, and about what the UTM and NGFW labels actually mean when you buy in 2026.

UTM and NGFW: two labels, mostly one product

UTM (Unified Threat Management) started as the all-in-one box for small sites: stateful firewall, VPN, gateway antivirus, web filtering, IPS and anti-spam under one licence bundle.

NGFW (Next-Generation Firewall) started from the other end. Its selling point was identifying applications regardless of port (Facebook, YouTube, Microsoft 365, RDP running on an odd port), tying rules to users and groups from Active Directory or Entra ID, and inspecting TLS-encrypted traffic.

Today almost every vendor ships both feature sets on the same operating system. What really separates a "UTM" from an "enterprise NGFW" is this:

So the question is not "UTM or NGFW?" but "which features will we really switch on, and how much traffic must pass with all of them on?"

How to read a datasheet

Vendors publish several throughput figures. They are all real, but measured under different conditions.

• Firewall throughput is measured with large UDP packets (often 1518 bytes) and no inspection. Don't size on it.
• IPS throughput and NGFW throughput (firewall + application control + IPS) are closer to reality.
• Threat-protection throughput adds anti-malware on top. If you buy the full security bundle, size against this.
• TLS/SSL inspection throughput is usually the lowest figure on the sheet. If you plan to decrypt traffic, size against this one.
• IPsec VPN throughput, maximum tunnels and concurrent VPN users matter for branches and remote staff.
• Concurrent sessions and new sessions per second matter for hotels, schools and anywhere with lots of phones on Wi-Fi.

Each vendor defines "threat protection" with its own traffic mix, so comparing two brands on that figure is approximate. Compare models within one vendor's range, and ask the supplier what test conditions were used.

Worked example 1: a 60-person office

A 60-person office in Vientiane has a 300 Mbps fiber line and a 100 Mbps backup from a second ISP, with SD-WAN using both. Combined: 400 Mbps. We would look for threat-protection throughput of at least 600–800 Mbps (1.5–2x) to leave room over a 3–5 year life. If management also wants TLS inspection on all web traffic, check the TLS figure instead; on many entry models that means going up one size.

Worked example 2: a 120-room hotel

A 500 Mbps internet line isn't the hard part. The device count is: two or three guest devices per room plus staff and hotel systems comes to around 400–450 devices in the evening peak. Each phone can hold several hundred sessions open at once, so look at concurrent sessions and new sessions per second first. On the guest VLAN we run firewall, application control and per-user bandwidth limits, but we don't decrypt guests' TLS traffic. Full inspection is kept for the staff and accounting VLANs.

Which class for which site

Remote access: SSL-VPN is being phased out

SSL-VPN portals were among attackers' favourite targets in 2024–2025, across every brand, and vendors are changing course. Fortinet, for example, removed SSL-VPN tunnel mode from FortiOS 7.6.3 and recommends IPsec VPN (which can run over TCP 443) instead. Old SSL-VPN settings are not converted automatically, so migrate before upgrading the firmware, or remote staff won't be able to connect the next morning. Whatever the brand: put MFA on every VPN account, tie it to your directory instead of local accounts, and consider ZTNA for critical applications. Our VPN and ZTNA guide covers this in detail.

What to check before you pay, in Laos

Where the unit and licence come from. Most equipment for Laos comes through distributors in Thailand. Ask whether the unit can be registered for use in Laos, who registers the licence, and whether warranty and RMA are honoured for a unit installed here. Some vendors tie support to the region of sale. Keep the vendor portal account in your company's name, not the reseller's.

Models near end of life. Check end-of-sale and end-of-support dates before buying, especially for unusually cheap units. For example, Sophos XG Series hardware reached end of life and end of support on 31 March 2025; SFOS v20 was the last version to support it, and the XGS Series replaces it. Every vendor publishes a lifecycle table like this.

Where config backups live. Keep configuration backups off the device and treat them as confidential: they contain VPN keys and network details. In October 2025 SonicWall confirmed that an unauthorized party had accessed the configuration backups of every customer who used its cloud backup service. If your configuration was ever stored somewhere like that, change passwords and VPN keys.

Replacement time. If a unit fails, the replacement usually crosses from Thailand, and customs can add days. For sites that can't go offline, an HA pair, or at least a cold spare of the branch model, costs less than a week without internet.

Power. Evening brownouts when demand peaks, and short cuts during storms, are normal in many provinces. A firewall that loses power mid-firmware-upgrade, or repeatedly, can corrupt its configuration. Put it on a UPS together with the core switch and the ISP router.

Heat and dust. In mine site offices and factory control rooms we often find a small desktop firewall on a shelf in a 35 °C room. Check the operating temperature on the datasheet and keep it in a ventilated rack with dust filters.

Two ISPs on one route. Contracts with two providers sometimes still share the same poles or upstream path. Ask both ISPs how their links reach your building before you rely on SD-WAN failover.

Licences: the part that expires

When the security subscription lapses, the box keeps forwarding traffic, so nobody notices. But IPS signatures, the application database, web filtering categories and sandboxing stop updating, and vendor support ends. Budget the renewal from day one, put the expiry date in someone's calendar, and when comparing quotes, compare the 3-year or 5-year total for the same bundle.

What we find when we audit

• A temporary "any to any allow" rule from installation day, still there years later.
• The admin web interface reachable from the internet, on old firmware.
• VPN on local accounts, including former staff, with no MFA.
• Logs kept only on the device and overwritten within days.
• No configuration backup, so replacing a dead unit means rebuilding from memory.
• Port forwards straight from the internet to RDP or CCTV cameras.

Before you sign the purchase order

1. Sized on threat-protection (or TLS-inspection) throughput, not firewall throughput.
2. Licence bundle, start date and end date written into the quote.
3. End-of-sale and end-of-support dates for the model checked.
4. RMA terms and a realistic replacement time to your site confirmed.
5. Configuration plan agreed: rule base, VPN with MFA, log destination, config backups.
6. A named person for firmware updates and a quarterly rule review.

Brands we supply & install include Fortinet, Palo Alto Networks, Check Point, Sophos, WatchGuard and SonicWall. For offices under 50 people, the entry range of any of these is adequate if it is sized correctly. The differences you will notice are in central management, reporting, and which interface your team is comfortable with. Our next-gen firewall page sets out the installation scope.

Send us two numbers

Tell us the internet bandwidth at each site (main and backup) and how many users and devices sit behind each firewall. We'll reply with a model size per site, the throughput figure we sized against, and the licence each unit needs.