How to choose · Network security
How to choose a business firewall
Last updated 25 October 2026 · 3 sources listed · Reading time about 3 minutes
Short answer
Choose a firewall by matching throughput under your real security features, management model and update commitments to your environment. Inspect how much traffic it can handle with inspection enabled, what remote access it supports, how policy is managed and logged, and how long the maker supplies security updates. Support lifetime and management effort matter more than the feature list.
Who this is for: An IT lead or owner replacing an ageing perimeter device or setting up a first firewall for an office, branch or small data room.
What to evaluate
Throughput with inspection enabled
Rated speeds are often measured with features off. Turning on intrusion prevention and decryption can reduce capacity substantially.
How to check: Ask for performance figures with your intended features on, and verify during a trial with realistic traffic.
Security update commitment
Firewalls sit on the boundary and are routinely targeted, so prompt patches and a defined end-of-support date are essential.
How to check: Obtain the written support lifecycle and the process for notifying and delivering security fixes.
Management and policy clarity
Rules that cannot be understood or audited accumulate errors that create hidden exposure.
How to check: Review how rules are displayed, grouped, commented and exported, and whether changes are logged.
Remote access and branch connectivity
Many firewalls double as the tunnel endpoint for staff and sites, so their access features and authentication options matter.
How to check: Check support for modern authentication, multi-factor sign-in and site-to-site connections that match your needs.
Logging and visibility
You cannot investigate suspicious traffic without sufficient, exportable logs.
How to check: Confirm log detail, retention and forwarding to a central system.
Resilience and failover
A single firewall is a single point of failure for connectivity.
How to check: Ask about high-availability pairing and how configuration is backed up and restored.
Comparison
| Type | Good when | Watch out for |
|---|---|---|
| Basic router firewall | A very small office with simple needs | Limited inspection, logging and remote access options |
| Next-generation firewall appliance | You need application control, intrusion prevention and VPN in one device | Performance falls when all features are enabled; licence dependence |
| Virtual firewall in the cloud | Workloads live in cloud networks | Rules must be managed separately from office equipment |
| Firewall as a service | Many remote sites and users with little hardware to manage | Dependency on the provider and on internet path quality |
| Host-based firewalls | You want protection on every device regardless of location | Needs central policy management to be consistent |
Decision worksheet
Rate up to three options against this guide’s own criteria. It runs in your browser and saves only on this device. It is a thinking aid, not a recommendation.
1. Have you checked each criterion?
0 of 6 criteria checked.
2. Compare options (0 = fails or unknown, 3 = meets it well)
| Criterion | |||
|---|---|---|---|
| Throughput with inspection enabled | |||
| Security update commitment | |||
| Management and policy clarity | |||
| Remote access and branch connectivity | |||
| Logging and visibility | |||
| Resilience and failover | |||
| Total (max 18) | 0 | 0 | 0 |
Questions to ask before you commit
- How long will this model receive security updates and what are the terms after that?
- What is the sustained throughput with inspection and decryption enabled?
- Which features require subscriptions, and what happens if they lapse?
- How is the management interface protected and can it be restricted from the internet?
- What logging and export options exist for our central monitoring?
- How is configuration backed up and restored after a hardware fault?
- How does failover work and how long would it take to recover?
- How are vulnerabilities in the product disclosed and fixed?
Typical trade-offs
Hardware appliance versus cloud-delivered firewall
- Upside
- Appliances give local control and keep working during upstream outages.
- Downside
- They need physical upkeep, capacity planning and replacement cycles.
Deep inspection of encrypted traffic versus privacy and performance
- Upside
- Inspection can reveal threats hidden in encrypted sessions.
- Downside
- Adds processing load, certificate handling complexity and privacy considerations.
Simple rule set versus granular segmentation
- Upside
- Simple rules are easier to understand and audit.
- Downside
- Granular policies limit lateral movement better but need ongoing upkeep.
Common mistakes
- Sizing by advertised throughput alone. Test with the security features on under realistic load.
- Leaving the management interface reachable from the internet. Restrict it to a management network or VPN with strong authentication.
- Letting subscriptions lapse and assuming protections continue. Track licence renewals and the features tied to them.
- Keeping default or shared administrator credentials. Use named accounts and multi-factor sign-in.
- Not backing up the configuration. Store an encrypted copy off the device and test restoring it.
Related questions
How much firewall capacity do I need?
Work from measured need, not headcount guesses. Record peak traffic, number of simultaneous connections, remote-access users and which security features you will enable. Add headroom for growth and for cloud or video traffic increases. Then request performance data with those features active and confirm it in a trial. Remember that decryption and intrusion prevention are the features that most often cut real-world speed below the headline figure.
Is a firewall alone enough to secure a network?
No. A firewall controls traffic between zones, but attackers frequently arrive through phishing, stolen credentials and unpatched internal systems that bypass it. Pair it with endpoint protection, patching, strong authentication, segmentation and monitoring. Treat the firewall as one layer that limits exposure and lateral movement. Government guidance on network security stresses defence in depth rather than any single device.
How often should firewall rules be reviewed?
Regularly and after any major change. Rules accumulate for projects that ended, staff who left and vendors long gone, leaving broad openings no one remembers. Schedule reviews to remove unused rules, tighten overly permissive ones and confirm every rule has an owner and a reason. Use hit counters and logs to see which rules are active. Keep change records so you can trace why each rule exists.
Should we choose a firewall from the same maker as our other network gear?
It can simplify management and support, but it concentrates risk if one maker's products share a flaw. Judge by integration benefits against your need for independence. Whatever you choose, prioritise the maker's security record handling: transparency about vulnerabilities, speed of fixes and clarity of lifecycle. Avoid decisions based only on commercial bundling.
Sources and further reading
These pages were reachable when we last checked. They informed definitions and rules referred to above; they do not endorse this guide. Where rules differ by country, check the authority for your location.
- Guidelines on Firewalls and Firewall Policy (SP 800-41 Rev. 1) — National Institute of Standards and Technology, retrieved 27 October 2026
- 10 Steps to Cyber Security — National Cyber Security Centre (UK), retrieved 27 October 2026
- Cybersecurity Best Practices — Cybersecurity and Infrastructure Security Agency, retrieved 27 October 2026
Related guides
Comparison · Network security
Traditional VPN vs zero trust network access for remote staff
A traditional remote-access VPN places a user's device on the internal network, so a compromised laptop can reach much more than it needs. Zero trust network access verifies user and device for each application and grants only that access. The second model limits lateral movement but needs good identity, device inventory and application mapping, so many organisations adopt it in stages.
Requirements · Network security
Network segmentation and remote access requirements for a small office
A small office should separate staff devices, guests, servers and untrusted internet-of-things equipment into distinct network zones, with a firewall controlling traffic between them. Secure administration, change default credentials, update router and access point firmware, require strong authentication for remote access and keep logs. Simple, consistently applied rules beat elaborate designs nobody maintains.
Problems & fixes · Network security
Why firewall rules become unmanageable and how to fix them
Rule sprawl happens when temporary exceptions are never removed, rules lack owners and several people edit without records. It causes hidden exposure, outages when something is changed and slow audits. Fix it by documenting what exists, using hit counters and logs to identify unused rules, consolidating through objects and groups, and putting a change process in place.
How to choose · Identity and access
How to choose a single sign-on and identity provider
Choose an identity provider by checking which of your applications support standard federation, how provisioning and deprovisioning work, what authentication methods and policies are available, and how the provider behaves when it fails. The directory you already run, the number of unsupported legacy apps, and your admin capacity shape the best fit more than feature lists do.
How to choose · B2B software
How to choose a project management tool for a cross-functional team
Choose a project management tool by the kind of work and the coordination it must support: task ownership, dependencies, deadlines, resource load, approvals and reporting. Test it with a real project, including guests from outside the team, and look at views, permissions, automation limits and integrations. Simplicity of daily use matters as much as power, because tools only help when updates are entered promptly.
How to choose · Endpoint protection
How to choose endpoint protection for a small business
Pick endpoint protection by matching detection capability to the staff you actually have. Without anyone to watch alerts, favour strong automatic prevention, simple policy management and a response option that is either automated or provided by a service. Confirm operating system coverage, central management, tamper resistance and exportable logs before looking at extras.
How to choose · Managed IT providers
How to choose a managed IT provider
Choose a managed IT provider by testing how they run service, not how they describe it. Look for a documented onboarding process, clear scope and exclusions, security practices applied to their own systems, named responsibilities for patching and backups, and references from clients similar to you. Contract terms on exit, data ownership and administrative access matter as much as response times.