MSS Firewall Sizing Guide

Source: SonicWall product datasheets  ·  Environments >100 users: confirm with Will A. or Michael C. before finalizing

ⓘ For reference only — verify all specs against official SonicWall datasheets before quoting
How sizing works — read before using results
(1)Throughput floor = WAN download + upload combined. For example, a 1 Gbps symmetrical connection = 2 Gbps combined requirement, because the firewall must handle full download and upload simultaneously.
(2)A model qualifies only if its DPI throughput (or DPI-SSL if enabled) meets or exceeds the combined WAN requirement AND its max recommended user count meets or exceeds your input. Both conditions must be met independently - most conservative wins.
(3)Max recommended users = max DPI connections ÷ 2,500. Intentionally conservative - may vary based on connection counts per device in your environment.
(4)All firewalls are sized assuming all security services are running at all times. A firewall sold without active security services is no different from a consumer router. Our security services are the product - the hardware enforces them.
Environment inputs
Users *
WAN download speed *
WAN upload speed *
DPI-SSL inspection
Decrypts TLS/HTTPS. Reduces throughput ceiling.
Interface requirements (at least one port of each selected type)
Enter number of users and both WAN speeds to see recommendations.
EOL hidden
Performance notes: All throughput figures are Performance Optimized Mode per RFC 2544. Actual throughput varies by activated services, topology, and traffic profile. Max recommended users = max DPI connections ÷ 2,500. NSa Gen 8 max users calculated from DPI/2,500 (field blank in Confluence source) - verify against official datasheets before quoting.
Generation:
Gen 7 data captured from screenshot (Confluence page was empty at export). Gen 8 bundle feature differentiation - confirm tier-level differences against current SonicWall pricing before customer-facing use. Add-on = not included in bundle but available for separate purchase.
EOL hidden
SMA 500v and SMA 8200v are virtual appliances. Legacy models (SMA 200/400, SMA 6200/7200) are EOL — hidden by default.
SWS12 series are desktop form factor. SWS14 series are 1U rack mount. All models managed via SonicWall Network Security Manager (NSM). No legacy switch generation on file.
EOL hidden
SonicWave 621/641/681 are indoor WiFi 6. SonicWave 432o is outdoor WiFi 5. Legacy APs (ACe, ACi, N2, 231 series, 432i/e) are EOL. All models managed via SonicWall NSM or firewall wireless controller.