Choosing Firewall Capacity for a Campus

An undersized firewall becomes the bottleneck for the entire campus: internet feels slow even though the link has spare capacity. An oversized firewall wastes money that could fund Wi-Fi or other improvements. Sizing correctly takes a few key inputs.

Start with internet bandwidth

The firewall must handle the full internet bandwidth with all security features enabled, plus headroom for planned upgrades over the next few years.

Count concurrent devices

Campuses have thousands of devices online at once, each opening many connections. Check the firewall's concurrent session capacity and new connections per second, not just throughput.

Account for security features

Intrusion prevention, SSL inspection and application control all reduce throughput — sometimes dramatically. Use vendor figures measured with these features turned on.

Include internal traffic

If the firewall also enforces segmentation between campus networks, add that internal traffic to the load.

VPN and remote access

Staff connecting remotely add encryption overhead. Estimate peak remote users.

Plan for growth

Student numbers, devices per student and bandwidth all grow. Size for three to five years.

Consider high availability

For larger campuses or critical services, a pair of firewalls in high availability prevents a single device failure from taking everyone offline.

Cloud-delivered options

Cloud firewalls scale automatically and remove much of the sizing guesswork, though a local device may still be needed for internal segmentation.

Validate after installation

Test throughput with real traffic and security features enabled, especially during evening hostel peaks.

The bottom line

Size firewalls on bandwidth, devices, features and growth. UbiFi Managed Firewall is sized for each campus as part of the service.

Learn more about Managed Firewall for Education from UbiFi, or talk to our team.