A standard operational scenario during enterprise network upgrades: an organization signs a contract for a true 1:1 uncontended 1Gbps enterprise leased line. The optical Network Terminating Unit (NTU) is installed, light levels pass carrier certification, and speed tests direct to a diagnostic laptop show a full 940Mbps symmetrical throughput.
Yet the moment the physical handoff is patched into the company's perimeter firewall and live office traffic is routed, download and upload speeds across client workstations drop to 200–350Mbps. Video conferences buffer, cloud drive synchronisation stalls, and the internal helpdesk is inundated with complaints.
The circuit is not congested; the fiber carrier is not violating their SLA. The perimeter firewall is simply choking under the mathematical weight of deep SSL/TLS packet decryption.
1. The 1Gbps Marketing Illusion vs Cryptographic Reality
When evaluating firewall datasheet specifications, network buyers often look at the headline bold metric: “Firewall Throughput: 5Gbps”.
What many non-technical procurement teams fail to realise is that “Firewall Throughput” refers exclusively to stateless Layer 3/4 packet forwarding. It measures how fast an appliance can inspect raw IP packet headers (source IP, destination IP, port number) and forward them without looking inside the payload.
In modern corporate networks, stateless inspection provides zero meaningful threat protection:
- Over 85% to 90% of enterprise web traffic is encrypted using TLS 1.2 or TLS 1.3.
- Malware, ransomware command-and-control channels, and data exfiltration payloads travel hidden inside HTTPS streams.
- Antivirus scanning, Intrusion Prevention Systems (IPS), and application control engines cannot protect what they cannot read.
To inspect traffic, a Next-Gen Firewall (NGFW) must act as a trusted intermediary (man-in-the-middle). It must intercept the secure handshake, decrypt the packet, pass the plaintext data through signature scanning engines, re-encrypt the payload with an internal certificate, and transmit it to the end user.
Decrypting TLS 1.3 traffic requires intensive asymmetric cryptography (Diffie-Hellman / ECDHE key exchanges) and symmetric block ciphers (AES-GCM, ChaCha20-Poly1305). On general-purpose CPU architectures, this process consumes immense compute cycles, causing CPU utilization to spike to 100% and creating a bottleneck behind 1Gbps bearers.
2. The Three Throughput Tiers of an Enterprise Firewall
To properly size an edge appliance, you must distinguish between the three performance tiers stated on hardware datasheets:
| Throughput Metric | What It Measures | Impact on a 1Gbps Bearer |
|---|---|---|
| 1. Stateless L3/L4 Throughput | Raw packet routing based on IP and port. Zero payload inspection. | 100% Line Rate (Full 1Gbps) |
| 2. NGFW / IPS Throughput | Application identification and IPS inspection on non-encrypted traffic. | 60–80% Line Rate (600–800Mbps) |
| 3. Threat Protection (Deep SSL) | Full TLS decryption, antivirus scanning, IPS, and application control. | 20–35% Line Rate (200–350Mbps) |
If your branch office has an entry-level appliance with a headline “1.5Gbps Firewall Throughput”, its actual deep SSL Threat Protection throughput is likely around 250Mbps. Plugging that device into a 1Gbps fiber circuit instantly leaves 75% of your expensive leased line capacity stranded at the demarcation point.
3. Hardware Architecture: General-Purpose CPUs vs Dedicated Security ASICs
The primary architectural differentiator between enterprise firewalls is how cryptographic decryption is handled:
The Software-Driven Approach (General x86 / ARM CPUs)
Many mid-market and cloud-managed appliances rely on standard multicore processors (Intel, AMD, or ARM) to execute all networking tasks. The main CPU must process the operating system, compute BGP routes, handle NAT translations, and execute complex TLS cryptographic mathematical algorithms.
When 50 office users initiate simultaneous Microsoft Teams 1080p video streams, cloud CRM syncs, and large file downloads, the CPU throttles. Packets queue in hardware buffers, latency spikes from 3ms to 120ms, and packet drops trigger TCP window retransmissions.
The Hardware-Accelerated Approach (ASIC Coprocessors)
High-performance Next-Gen Firewalls (such as Fortinet FortiGate) incorporate custom proprietary silicon:
- Network Processors (NP): Dedicated silicon engineered specifically for wire-speed packet routing, QoS scheduling, and IPSec VPN encryption/decryption at line rate.
- Content Processors (CP): Dedicated cryptographic coprocessors designed solely to offload asymmetric TLS handshakes and deep content pattern-matching from the main CPU.
By offloading TLS decryption to dedicated content silicon, the main operating system CPU remains unaffected, enabling enterprises to achieve full 1Gbps line-rate Threat Protection without dropped frames. Read our in-depth comparison in FortiGate vs Cisco Meraki for a detailed examination of ASIC acceleration versus cloud-managed licensing.
4. Choosing Your Perimeter Strategy: NGFW vs Pure Edge Routing
Not every enterprise network topology requires full deep SSL decryption at every physical desk. When designing your perimeter architecture, ManagedByUs typically provisions one of two architectural frameworks:
Designed for corporate offices with dense hybrid workforces requiring centralized compliance, content filtering, and deep packet inspection. Delivered as a managed hardware appliance or via our cloud-delivered Firewall as a Service (FWaaS) platform with 24/7 SOC telemetry.
Engineered for high-volume engineering facilities, data centers, and multi-tenant estates requiring wire-speed 1Gbps to 10Gbps stateless routing, BGP peering, and active-passive failover with zero recurring license overhead. Explore our analysis in MikroTik in the Enterprise.
5. Size Your Circuit and Perimeter Hardware Accurately
Deploying business fiber without sizing your perimeter firewall creates an immediate bottleneck. To determine the exact committed bandwidth tier and hardware profile required for your organization's headcount and application mix, use our sizing tool: