Firewall connections per second measures how quickly new connections can be established. Concurrent connections measures how many connections the device can track at the same time. Throughput measures the rate of data transfer. A high result for one does not establish capacity for the others.
For MSPs and IT teams comparing gateways, the practical question is which combination their applications require. A lightly used internet circuit can coexist with a demanding connection workload. Treat the three figures as separate parts of the capacity discussion, then examine the conditions behind each result.
New connections and existing connections ask different questions
Imagine two hypothetical workloads. One opens a small number of connections and keeps transferring large files over them. The other repeatedly opens connections, exchanges small messages, and closes them. The second workload could transfer less data while requiring the gateway to handle more connection creation.
Now change the example: many devices open connections and leave them established. New-connection activity may settle down while the number of connections being tracked stays high. These examples illustrate the distinction; they are not measurements from a customer or a Network Box appliance.
NIST SP 800-41 Revision 1 identifies throughput, maximum simultaneous connections, connections per second, and latency as separate firewall-selection requirements for current and future traffic. Its stateful-inspection discussion also explains that the firewall maintains connection state. That is why a connection count belongs alongside the bandwidth figure.
A user count alone cannot tell you how these workloads behave. In a planning conversation, ask what the applications do: maintain connections, create frequent new ones, or transfer substantial data through established ones. Use observed application behavior rather than assigning every employee the same assumed number of sessions.
Read the conditions attached to the capacity figures
The IETF's RFC 9411, published in March 2023, defines separate tests for throughput, connection rate, concurrent connection capacity, and transaction latency. Its test configuration calls for logging and reporting, documented security settings, and validation of the security configuration before performance testing.
For encrypted traffic, the methodology distinguishes HTTPS tests and documents parameters such as cipher choices and response sizes. A result from one traffic profile therefore needs context before it can support a different deployment.
Ask the supplier which hardware, software version, traffic mix, inspection settings, and measurement definition produced each number. Confirm whether the figures describe the same configuration. Do not combine separately reported maxima into a promise that all of them can be sustained together.
RFC 9411 is informational benchmarking guidance, not a certification of a particular product. Its scope also excludes performance evaluation of machine-learning or behavioral-analysis features. A report following that methodology should not be presented as evidence for features it did not exercise.
Turn the comparison into a workload decision
Our recommendation is to describe the busiest relevant business period before choosing the model. For the hypothetical small-message workload, the useful follow-up is evidence about connection creation under the intended security policy. For the long-lived workload, ask about retained connections. In both cases, successful business transactions and acceptable response times remain part of the outcome.
Give each reported figure its time window and definition. A daily average is a different observation from a brief peak. If the available monitoring does not record connection creation or retained state, mark that requirement as unmeasured and agree how to obtain the evidence. Do not convert missing telemetry into an assumption of spare capacity.
Include planned application changes in the discussion. Adding a new integration can change connection behavior even when headcount stays flat. Document the growth assumption and the point at which capacity will be reviewed; there is no universal multiplier established by the examples here.
Validate capacity without disrupting the business
Benchmarking to find a device's limit belongs in an isolated test environment. RFC 6815 explains that overload-oriented laboratory methods can harm live traffic and produce misleading results on shared production networks. Keep production observation and an agreed rollout validation separate from a maximum-capacity stress test.
Network Box USA's Managed UTM+ combines firewall, intrusion prevention, VPN, malware inspection, policy, logging, updates, and operational support. Service design includes traffic capacity and the controls required for the environment. Confirm the proposed gateway, enabled protections, available capacity evidence, and review responsibilities during that design process.
If you are evaluating a gateway or changing the applications it protects, contact our team to discuss the workload and managed security scope your network needs.