WAF Sizing Tool

48 platforms and 35 licence SKUs across F5 (BIG-IP Advanced WAF on rSeries, iSeries, VELOS, Virtual Edition, NGINX App Protect and Distributed Cloud WAAP), Imperva (WAF Gateway X-series, virtual gateways and Cloud WAF) and Citrix NetScaler (MPX, SDX, VPX, BLX and CPX on Premium edition).

Sizing runs on layer-7 requests per second and new TLS handshakes per second, because a WAF parses every request and response rather than forwarding packets — the headline throughput on a datasheet is measured with no policy at all, and the tool says so.

Four figures are derived and every candidate is measured against all of them: WAF request rate, WAF throughput, TLS handshake rate at the key type in use, and the connection table.

Handshake load is sized separately from policy load, and the tool points out when moving the certificates from RSA-2048 to ECDSA P-256 would roughly double the available handshake capacity — usually cheaper than the next model up.

An active/active pair is sized at 100% per unit rather than 50%, because sizing a pair at half the load each works right up until the day a unit is lost. Clusters are sized so the loss of one node still leaves enough capacity.

Inspection cost, insertion mode, compounded growth, design headroom and the HA share are applied in order, and each step is written out with the reasoning behind it.

A platform is excluded when it fails request rate, throughput, TLS handshakes, the connection table, the application count, the insertion mode, its position in the estate or the form factor — and each rejected model lists the reasons.

Five insertion modes are modelled, and out-of-band monitoring is drawn honestly: production traffic goes around the WAF, and the design is marked as detection only rather than a control.

Two diagrams are drawn from the answers: physical connectivity from the client down to the database tier, and the inspection pipeline stage by stage. The WAF is drawn as the real appliance — chassis, rack ears, vendor wordmark, LCD panel, status LEDs and the port layout the chosen model actually has.

Exports are real Office files — a full Word design document, an eleven-slide deck with editable tables, and an eleven-sheet workbook including the bill of materials and the whole catalogue marked pass or fail against your design.

The recommendation is a starting point, not a verdict: pick any other platform and the diagrams, licences and exports all follow it — an undersized choice is kept and flagged, never silently corrected.

Performance figures are held for relative sizing and every vendor links to its data sheet, because the final model must always be confirmed against the current one before quoting.