Firewall Selector Tool

102 models and 63 licence SKUs across Palo Alto Networks (PAN-OS), Fortinet (FortiOS), Cisco (Secure Firewall and Meraki MX), Sophos (SFOS) and Forcepoint (NGFW).

Sizing runs on threat-protection throughput with the full inspection stack enabled — the raw firewall figure is never a safe basis, and the tool says so.

Circuit and user demand, growth, design headroom and the cost of TLS decryption are applied in order, and every step is written out so the design can be defended in a review.

A model is excluded when it fails throughput, TLS inspection, IPsec, session table, connection rate, remote-user count, deployment role or form factor — and each rejected model lists the reasons.

Licences are matched to the security capabilities you asked for, with the reason each line is on the bill of materials; choosing a Meraki MX swaps the whole Secure Firewall subscription stack for Meraki all-inclusive licensing.

The recommendation is a starting point, not a verdict: pick any other model and the diagrams, licences and exports all follow it — an undersized choice is kept and flagged, never silently corrected.

Shortlist up to six models from one vendor or several and compare them side by side, each figure marked against the requirement this design produced. The shortlist travels into the Word and Excel exports.

Two diagrams are drawn from the answers: physical connectivity from the internet circuit down to the access zones, and the zone and policy model with the inspection profile at each boundary. The firewall is drawn as the real appliance, with the port layout the chosen model actually has.

Exports are real Office files — a full Word design document, a slide deck with editable tables, and a multi-sheet workbook including the bill of materials — each with both diagrams embedded.

Performance figures are held for relative sizing and every vendor links to its data sheet, because the final model must always be confirmed against the current one before quoting.