When it comes to firewall upgrades or refreshes, you need to know your: Current traffic volumes and mixture Session counts Number of users Current and future Internet or private connection pipes Current and future throughput requirements (VPN, SSL Inspection and decryption, etc...) Current and future unified threat management (UTM) needs Interface requirements Number of IP devices LAG requirements Future growth I am sure you can come up with more variables and compare it to the vendors specification sheet in order to come up with an accurate size or model of a security appliance. However, nothing beats a real/live test with a traffic generator. When I usually size a box based on the customer's requirements, I also factor in real life examples, previous firewall implementations and what the Internet/application traffic trends. I have heard so many "oh we are not going to use such and such application" or "we will never use SSL inspection"...
This is a blog of a systems engineer's everyday life. Believe it or not, engineer's life could be interesting.