--- title: "Firewall and NGFW Testing with the Policy On: Throughput, CPS, Failover | TEST4NET" description: "Independent firewall and NGFW testing in CloudLAB for the shortlist, the acceptance and every update: throughput and connections per second with IPS and TLS inspection on, latency, failover with sessions in flight. Test plan in 1–3 days." --- [Skip to content](https://test4net.com/solutions/firewalls-ngfw#main-content) [![TEST4NET](https://test4net.com/hubfs/test4net-logo-fixed-2.svg)](https://test4net.com/?hsLang=en) - Services - Products - Resources - Company [News](https://test4net.com/news?hsLang=en) [Login](https://lab.test4net.com) [Support](https://test4net.com/support?hsLang=en) What we test By technology Industries [Load & Performance Testing Throughput, sessions and latency up to and past the rated limit](https://test4net.com/services/load-performance-testing?hsLang=en) [Functional & Conformance Testing Features against the spec, RFC compliance with evidence](https://test4net.com/services/functional-conformance-testing?hsLang=en) [Interoperability Testing Multi-vendor behaviour, before it reaches production](https://test4net.com/services#interop) [Security & Resilience Testing NGFW, IPS and VPN efficacy and performance with threats on the wire](https://test4net.com/services/security-resilience-testing?hsLang=en) [Test Plan & Methodology Design What to test, how, and what counts as a pass](https://test4net.com/services/test-plan-design?hsLang=en) [Test Automation & CI/CD Regression suites wired into your release pipeline](https://test4net.com/services#automation) [Training Programs Hands-on courses for your test engineers](https://test4net.com/services#training) [Equipment Repair Diagnostics and repair of test equipment](https://test4net.com/services#repair) [All services](https://test4net.com/services?hsLang=en) [Routing & Switching RFC 2544 and RFC 2889 on real ports, 1G to 100G](https://test4net.com/solutions/routing-switching?hsLang=en) [Firewalls & NGFW RFC 9411 throughput with inspection switched on](https://test4net.com/solutions/firewalls-ngfw?hsLang=en) SD-WAN & WAN Path selection and QoS under emulated WAN conditions Cloud & NFV Virtual appliances and cloud services under load 5G & Mobile Core Transport and core functions under subscriber traffic Wi-Fi Wi-Fi 6 clients and access points, Wi-Fi 7 in progress Storage & Infrastructure Storage networks and servers under realistic I/O [AI / Switching Fabric (RoCEv2) Lossless Ethernet for GPU clusters: PFC, ECN, fabric load](https://test4net.com/solutions/ai-fabric-rocev2?hsLang=en) All technologies [Telecom Operators Pre-deployment acceptance and vendor comparison](https://test4net.com/solutions/industries#telecom) [Network & Security Vendors Independent validation of your product claims](https://test4net.com/solutions/industries#vendors) [System Integrators Proof for the customer before the rollout](https://test4net.com/solutions/industries#integrators) [Enterprise & Banks Upgrades and new platforms checked before production](https://test4net.com/solutions/industries#enterprise) [All industries](https://test4net.com/solutions/industries?hsLang=en) Not sure where to start? Test plan and quote in 1–3 business days Tell us what you run and what worries you. We propose the tests, tools and timeline. [Request a test plan](https://test4net.com/contacts?hsLang=en) CloudLAB How It Works Pick a scenario, run it in the live lab, get the report Equipment & Capabilities L2-3 to 100G, L4-7 past 200G, Wi-Fi, WAN emulation Access Plans Hourly sessions, subscriptions, dedicated racks Hosted DUT Testing Ship the box or upload the VM, we run the tests [Open the CloudLAB portal](https://lab.test4net.com) Our tools Traffic Generator L4-7 and security traffic past 200 Gbit/s, app mix library WANemu Delay, jitter, loss and bandwidth shaping per link [Book a demo](https://test4net.com/contacts?hsLang=en) New: our own test tools Our own tools, in beta this autumn Built in our lab, priced per gigabit. Join the beta list and see them first. [Join the beta list](https://test4net.com/contacts?hsLang=en) Read Technologies / Protocols Methodologies [Blog Case studies, test insights and lab notes](https://test4net.com/blog?hsLang=en) [Industry News What is changing in network testing and infrastructure](https://test4net.com/news?hsLang=en) FAQ How the lab, sessions and reports work BGP Route exchange, policy and convergence OSPF & IS-IS IGP adjacency, flooding and SPF timing MPLS & SR LDP, RSVP‑TE and SR‑MPLS label paths EVPN / VXLAN Overlay fabrics, MAC/IP routes, multi-homing IPsec & IKEv2 Tunnel setup, rekeying and throughput TLS / HTTPS Handshakes, cipher suites and inspection RoCEv2 Lossless Ethernet, PFC and ECN for AI fabrics Wi-Fi 6 / 6E / 7 802.11ax/be, OFDMA, MLO and roaming All protocols [RFC 2544 Throughput, latency, frame loss and back-to-back](https://test4net.com/methodologies/rfc-2544?hsLang=en) [RFC 2889 LAN switch benchmarking: forwarding, MAC learning, congestion](https://test4net.com/methodologies/rfc-2889?hsLang=en) [RFC 9411 / RFC 3511 Firewall and NGFW performance benchmarking](https://test4net.com/methodologies/rfc-9411-rfc-3511?hsLang=en) RFC 6349 TCP throughput and buffer delay testing RFC 5180 IPv6 benchmarking methodology ITU-T Y.1564 Ethernet service activation: CIR, EIR, KPIs per service ITU-T Y.1731 Ethernet OAM: delay, jitter, loss and SLA monitoring TR-398 Wi-Fi in-premises performance test plan All methodologies Read [Case studies, test insights and lab notes Blog](https://test4net.com/blog?hsLang=en) [What is changing in network testing and infrastructure Industry News](https://test4net.com/news?hsLang=en) How the lab, sessions and reports work FAQ [About Us Independent lab in Armenia, team and history](https://test4net.com/about?hsLang=en) [Why TEST4NET What you get that vendor slides never show](https://test4net.com/why-test4net?hsLang=en) Lab & Certifications Bench capacity, methods and the standards we test against Partners Test tool vendors and IT partners we work with [Contacts Talk to an engineer, not a sales bot](https://test4net.com/contacts?hsLang=en) [Support portal](https://test4net.com/support?hsLang=en) - Services What we test [Load & Performance Testing](https://test4net.com/services/load-performance-testing?hsLang=en) [Functional & Conformance Testing](https://test4net.com/services/functional-conformance-testing?hsLang=en) [Interoperability Testing](https://test4net.com/services#interop) [Security & Resilience Testing](https://test4net.com/services/security-resilience-testing?hsLang=en) [Test Plan & Methodology Design](https://test4net.com/services/test-plan-design?hsLang=en) [Test Automation & CI/CD](https://test4net.com/services#automation) [Training Programs](https://test4net.com/services#training) [Equipment Repair](https://test4net.com/services#repair) [All services](https://test4net.com/services?hsLang=en) By technology [Routing & Switching](https://test4net.com/solutions/routing-switching?hsLang=en) [Firewalls & NGFW](https://test4net.com/solutions/firewalls-ngfw?hsLang=en) SD-WAN & WAN Cloud & NFV 5G & Mobile Core Wi-Fi Storage & Infrastructure [AI / Switching Fabric (RoCEv2)](https://test4net.com/solutions/ai-fabric-rocev2?hsLang=en) All technologies Industries [Telecom Operators](https://test4net.com/solutions/industries#telecom) [Network & Security Vendors](https://test4net.com/solutions/industries#vendors) [System Integrators](https://test4net.com/solutions/industries#integrators) [Enterprise & Banks](https://test4net.com/solutions/industries#enterprise) [All industries](https://test4net.com/solutions/industries?hsLang=en) [Not sure where to start? Test plan and quote in 1–3 business days](https://test4net.com/contacts?hsLang=en) - Products CloudLAB How It Works Equipment & Capabilities Access Plans Hosted DUT Testing [Open the CloudLAB portal](https://lab.test4net.com) Our tools Traffic Generator WANemu [Book a demo](https://test4net.com/contacts?hsLang=en) [New: our own test tools Our own tools, in beta this autumn](https://test4net.com/contacts?hsLang=en) - Resources Read [Blog](https://test4net.com/blog?hsLang=en) [Industry News](https://test4net.com/news?hsLang=en) FAQ Technologies / Protocols BGP OSPF & IS-IS MPLS & SR EVPN / VXLAN IPsec & IKEv2 TLS / HTTPS RoCEv2 Wi-Fi 6 / 6E / 7 All protocols Methodologies [RFC 2544](https://test4net.com/methodologies/rfc-2544?hsLang=en) [RFC 2889](https://test4net.com/methodologies/rfc-2889?hsLang=en) [RFC 9411 / RFC 3511](https://test4net.com/methodologies/rfc-9411-rfc-3511?hsLang=en) RFC 6349 RFC 5180 ITU-T Y.1564 ITU-T Y.1731 TR-398 All methodologies Read [Blog Case studies, test insights and lab notes](https://test4net.com/blog?hsLang=en) [Industry News What is changing in network testing and infrastructure](https://test4net.com/news?hsLang=en) FAQ How the lab, sessions and reports work - Company [About Us](https://test4net.com/about?hsLang=en) [Why TEST4NET](https://test4net.com/why-test4net?hsLang=en) Lab & Certifications Partners [Contacts](https://test4net.com/contacts?hsLang=en) [News](https://test4net.com/news?hsLang=en) [Login](https://lab.test4net.com) [Support](https://test4net.com/support?hsLang=en) [Services](https://test4net.com/services?hsLang=en) / Firewalls and NGFW # Firewalls and NGFW: one bench from the shortlist to every update after We test firewalls, NGFW, IPS, VPN gateways, virtual and cloud firewalls and WAFs on the CloudLAB security bench: 200 Gbps and more of application traffic between emulated users and servers, with your policy, IPS, antivirus, application control and TLS inspection switched on. A run takes from 2 weeks and ends with a report that holds throughput and connections per second with every feature on, latency per transaction at each load step, failover time with sessions in flight, and the cost of each feature in Gbps. Test plan and quote in 1–3 business days. [Request a test plan](https://test4net.com/solutions/firewalls-ngfw#lead-form) [See the device classes](https://test4net.com/solutions/firewalls-ngfw#classes) **Three gates, one plan** The same test cases at each gate, so the numbers compare TENDER GO-LIVE IN OPERATION Shortlist Acceptance Change 2–3 candidates, one plan your policy, your traffic firmware or policy update plan 40 plan 40 plan 40 A 21 B 9 C 44 31 47 day 1 → day 9 47 44 firmware n → n+1 Gbps, every feature on Ranked result table Signed go-live report Diff per KPI in 3 days - **200 Gbps+**security bench in CloudLAB - **5 classes**from perimeter NGFW to WAF - **From 2 weeks**for a run - **1–3 days**test plan and quote When the number is needed ## Three moments in a firewall project where a datasheet is not enough Each gate asks a different question, so each gets its own scope. The test cases stay the same, which is what makes the shortlist number, the acceptance number and the post-update number comparable. 1. 1 ### Shortlist Tender, 2–3 candidates Every candidate runs the same plan on the same bench with your policy and your traffic mix. Vendors see the plan before the first packet and the results after the last. Ranked table per KPI, feature cost per device, 3–4 weeks for 3 boxes 2. 2 ### Acceptance Before go-live The delivered pair with the production rulebase, inspection profiles and logging. Throughput, sessions, latency and failover against the capacity plan, not against the datasheet. Signed report with pass and fail per case, config exports, from 2 weeks 3. 3 ### Change Firmware or policy update The acceptance cases run again on the new build or rulebase. What moved, by how much, and whether it still clears the plan. The box stays in production; we test the twin or the lab unit. Diff per KPI against the last run, 3 business days What we test ## Five device classes, and the numbers each one has to show The bench is the same, the traffic and the pass criteria are not. The table is the starting point of the plan; your policy and capacity plan set the thresholds. | Device class | Numbers in the report | Traffic and policy on the bench | Typical size | | --- | --- | --- | --- | | 01Perimeter NGFW | Throughput and connections per second with IPS, application control and TLS inspection on; latency per transaction at each load step; HA failover time | Internet mix with 70% and more HTTPS, SaaS and video, object sizes from your NetFlow; the full production policy with logging | 1–40 Gbps | | 02Data-center firewall and cluster | Throughput per policy set, 8–20 M concurrent sessions, failover with session sync, policy push under load | East-west application mix, storage and backup flows, segmentation rulebase with thousands of rules | 40–200 Gbps | | 03VPN and remote-access gateway | Tunnel setup rate, concurrent tunnels, throughput per tunnel profile, reconnect storm after an outage | IPsec and SSL VPN clients by the thousand, mixed MTU, application mix inside the tunnels | 1–20 Gbps | | 04Virtual and cloud NGFW | The same KPIs per instance size and vCPU count, behaviour when the instance scales, throughput per licensed core | Image on the bench hypervisor or in your cloud tenant, the same mix and policy as the hardware class | 1–20 Gbps per instance | | 05WAF and reverse proxy | Requests per second and latency per request with the full rule set and TLS termination on, session handling at load | HTTP and HTTPS application transactions with real payloads, object sizes and request rates from your logs | Up to 100k requests per second | Any vendor, physical, virtual or cloud. Named test tools are picked for the setup and listed in the report. The bench around one firewall pair Emulated users your mix, 2–20 M sessions VPN clients IPsec and SSL tunnels FW-1 · activeFW-2 · standby Firewall pair HA, your policy, TLS inspection Emulated servers web, SaaS, storage, DNS Log collectors syslog, SIEM, sync and async FAULT INJECTION latency · failed transactions throughput · failover time Around the firewall ## What sits on each side of the box while it is measured A firewall number only means something with the right things around the device: the traffic your users produce, the policy it has to apply, and the faults it has to survive. All three are on the bench at once. 1. ### Your traffic, not a sample Application mix from your NetFlow or a pcap sample, or the RFC 9411 profile when there is no production data yet. HTTPS share, object sizes and session rate match the real network. 2. ### The policy as you run it Rulebase, IPS, antivirus, application control, URL filtering, TLS inspection scope and logging from your export. The features are the load: the report shows what each one costs in Gbps and connections per second. 3. ### Faults on purpose HA failover with sessions in flight, uplink flap, policy push and signature update under load, log collector outage. Each one timed and logged. Typical scenario ## A data-center pair rated 100 Gbps, a capacity plan of 40, and a policy that cost 16 of them An integrator hands over a data-center firewall pair for acceptance. The datasheet says 100 Gbps. With the production rulebase, two inspection profiles and TLS inspection on, the pair carries 31 Gbps against a capacity plan of 40, and fails the case. The run log points at a duplicated inspection profile and synchronous logging to two collectors. The vendor and the integrator tune the policy on day 9, the rerun gives 47 Gbps, p99 latency per transaction is 3.4 ms, failover with 8 M sessions takes 2.1 s. Go-live is approved on a signed report, and the same cases run again after the next firmware in 3 days. 31 → 47 Gbps with every feature on, before and after tuning 2.1 s HA failover with 8 M sessions 12 days from the first packet to the signed report Composite scenario from projects of this type. Numbers are realistic and not from one client. Throughput with every feature on, Gbps Datasheet Delivered policy Tuned policy, day 9 100 31 47 Plan 40 0255075100 below the plan clears the plan What you take away ## Four numbers that end the argument, and the table they live in The report is built for the meeting after the test: the vendor, the integrator and your network team read the same table, with the pass band from the plan next to the measured value Each number comes with its evidence: generator statistics, device counters, captures and the config export of the run Throughput With IPS, application control, TLS inspection and logging on, at the failed-transaction limit of 0.001%. Not the fast-path number. Latency p50 and p99 per transaction at 50% and 90% of the measured throughput, so the capacity plan has a latency budget, not only a bandwidth figure Failover Seconds until traffic flows again and how many sessions survived, with 2–20 M sessions in flight, not on an idle pair Scale limits Concurrent sessions, connections per second, tunnels and policy size where a KPI leaves the pass band, so the capacity plan has a ceiling ACC-DC-02 Acceptance, data-center pair Rerun, day 9 ### Result table, 6 of 14 cases | KPI | Pass band | Measured | Result | | --- | --- | --- | --- | | Throughput, every feature on | ≥ 40 Gbps | 47 Gbps | Pass | | Failed transactions at 47 Gbps | ≤ 0.001% | 0.0004% | Pass | | p99 latency at 47 Gbps | ≤ 5 ms | 3.4 ms | Pass | | Connections per second, policy on | ≥ 300k | 340k | Pass | | HA failover, 8 M sessions | ≤ 3 s | 2.1 s | Pass | | Policy push under load | no drop | 0.4 s pause | Pass with a note | Where it runs ## The CloudLAB security bench, and the pages behind this one Physical boxes ship to CloudLAB or we connect to your lab; virtual images run on the bench hypervisor or in your tenant. The bench carries 200 Gbps and more of L4-7 and security traffic with emulated users, VPN clients and servers, and you watch the run through the portal. The method is RFC 9411 where it applies, and your own cases where it does not. [How a security run goes, step by step](https://test4net.com/services/security-resilience-testing?hsLang=en) [RFC 9411: the 9 benchmark tests](https://test4net.com/methodologies/rfc-9411-rfc-3511#tests) [Get the test plan written first](https://test4net.com/services/test-plan-design?hsLang=en) [Bench access and capacity](https://test4net.com/services#bench) ### Related reading - [BlogThe security datasheet lie, and why it is structural](https://test4net.com/blog/the-security-datasheet-lie-and-why-it-is-structural?hsLang=en) - [BlogNGFW testing: fast paths, fake AppMix and pcap replay traps](https://test4net.com/blog/ngfw-testing-fast-path-appmix-pcap?hsLang=en) - [BlogWhy vendor benchmarks are not enough for infrastructure decisions](https://test4net.com/blog/datasheet?hsLang=en) Before the brief ## What firewall buyers ask first Which firewalls can you test? Any vendor and any form factor: perimeter and data-center NGFW, IPS, VPN and remote-access gateways, virtual and cloud firewalls, WAFs and reverse proxies. We need the model, the licence set and an export of your policy; the rest is in the plan. Do we have to ship the device? Three options. The box ships to CloudLAB and goes back after the run. We connect the bench to your lab over a dedicated link. Or, for virtual and cloud firewalls, we run the image on the bench hypervisor or in your tenant. The plan names the option and what each side provides. Is it tested with our policy or with vendor defaults? With your policy: rulebase, inspection profiles, logging and TLS inspection scope as you run them, from an anonymised export. A vendor-default run can be added as a second baseline so you see what the policy costs. Which features count as load? IPS, antivirus, application control, URL filtering, TLS inspection and logging, switched on in the order the plan sets. Each step gets its own throughput, connections per second and latency figure, so the report shows what every feature costs and where the box stops clearing the plan. What about WAF, SASE and virtual firewalls? WAFs and reverse proxies are a device class of their own on the bench, measured in requests per second and latency with the full rule set on. SASE and cloud firewall points are tested from the bench as the client side. Virtual firewalls get the same cases per instance size and vCPU count. How long does it take and what do we get? Test plan and quote in 1–3 business days after the brief. A run takes from 2 weeks for one device and 3–4 weeks for a shortlist of 3. The report holds the result table, latency histograms, captures, device counters and config exports, and the rerun of fixed items is part of the plan. ## Send the model, the licence set and the policy export. The plan comes back in 1–3 business days. No prices on the site: scope first, then the quote. The vendor can sit in on the brief. [Request a test plan](https://test4net.com/solutions/firewalls-ngfw#lead-form) [How the run goes](https://test4net.com/services/security-resilience-testing?hsLang=en) Send the shortlist ## You have the method. Now get the numbers. Name the models and the KPIs that matter. An engineer replies within one business day with a test plan draft and a quote. Prefer to chat? [Message an engineer on WhatsApp](https://wa.me/37491612709) We use what you send only to answer you. See our [Privacy Policy](https://test4net.com/privacy-policy?hsLang=en). [Send the shortlist](https://test4net.com/solutions/firewalls-ngfw#lead-form) [![TEST4NET LLC](https://test4net.com/hubfs/test4net-logo-fixed.svg)](https://test4net.com?hsLang=en) Independent testing and validation for telecom, information security and cloud infrastructure – real insights, not assumptions [mailto:sales@test4net.com](mailto:sales@test4net.com) #### Navigate - [Home](https://test4net.com/?hsLang=en) - [Why TEST4NET](https://test4net.com/why-test4net?hsLang=en) - [About us](https://test4net.com/about?hsLang=en) - [Contact](https://test4net.com/contacts?hsLang=en) - [Blog](https://test4net.com/blog?hsLang=en) - [Industry News](https://test4net.com/news?hsLang=en) #### Get in touch Sales [sales@test4net.com](mailto:sales@test4net.com) Support [support.test4net.com](https://support.test4net.com) © 2026 TEST4NET LLC. All rights reserved. [Privacy Policy](https://test4net.com/privacy-policy?hsLang=en) [Legal](https://test4net.com/legal?hsLang=en) ```json { "@context" : "https://schema.org", "@id" : "https://test4net.com/#organization", "@type" : "Organization", "address" : { "@type" : "PostalAddress", "addressCountry" : "AM", "addressLocality" : "Yerevan", "postalCode" : "0033", "streetAddress" : "3 Hakob Hakobyan Street (Mergelyan Hub)" }, "alternateName" : "TEST4NET", "contactPoint" : { "@type" : "ContactPoint", "availableLanguage" : [ "en", "ru", "hy" ], "contactType" : "sales", "email" : "sales@test4net.com", "telephone" : "+374-60-88-88-99" }, "description" : "Independent, vendor-neutral lab for testing network and cybersecurity products — NGFW, WAF, IPS, DLP and SASE — and an authorized distributor of test, measurement and network infrastructure solutions.", "email" : "sales@test4net.com", "foundingDate" : "2024", "image" : "https://test4net.com/hubfs/og-t4n.png", "logo" : "https://test4net.com/hubfs/test4net-logo-fixed-2.svg", "name" : "TEST4NET LLC", "sameAs" : [ "https://www.linkedin.com/company/test4net/", "https://t.me/TEST4NET", "https://www.facebook.com/people/Test4net-LLC/61591470856077/" ], "telephone" : "+374-60-88-88-99", "url" : "https://test4net.com/" } ``` ```json { "@context" : "https://schema.org", "@id" : "https://test4net.com/#website", "@type" : "WebSite", "inLanguage" : "en", "name" : "TEST4NET", "potentialAction" : { "@type" : "SearchAction", "query-input" : "required name=search_term_string", "target" : { "@type" : "EntryPoint", "urlTemplate" : "https://test4net.com/hs-search-results?term={search_term_string}" } }, "publisher" : { "@id" : "https://test4net.com/#organization" }, "url" : "https://test4net.com/" } ``` ```json { "@context" : "https://schema.org", "@type" : "Service", "areaServed" : "Worldwide", "description" : "We test firewalls, NGFW, IPS, VPN gateways, virtual and cloud firewalls and WAFs on the CloudLAB security bench: 200 Gbps and more of application traffic between emulated users and servers, with your policy, IPS, antivirus, application control and TLS inspection switched on. A run takes from 2 weeks and ends with a report that holds throughput and connections per second with every feature on, latency per transaction at each load step, failover time with sessions in flight, and the cost of each feature in Gbps. Test plan and quote in 1–3 business days.", "isPartOf" : { "@type" : "WebPage", "url" : "https://test4net.com/services" }, "name" : "Firewalls and NGFW", "provider" : { "@type" : "Organization", "name" : "TEST4NET", "url" : "https://test4net.com/" }, "serviceType" : "Firewall, NGFW, IPS, VPN gateway, virtual firewall and WAF testing: performance with the full policy on, latency, failover", "url" : "https://test4net.com/solutions/firewalls-ngfw" } ``` ```json { "@context" : "https://schema.org", "@type" : "BreadcrumbList", "itemListElement" : [ { "@type" : "ListItem", "item" : "https://test4net.com/services", "name" : "Services", "position" : 1 }, { "@type" : "ListItem", "item" : "https://test4net.com/solutions/firewalls-ngfw", "name" : "Firewalls and NGFW", "position" : 2 } ] } ``` ```json { "@context" : "https://schema.org", "@type" : "FAQPage", "mainEntity" : [ { "@type" : "Question", "acceptedAnswer" : { "@type" : "Answer", "text" : "Any vendor and any form factor: perimeter and data-center NGFW, IPS, VPN and remote-access gateways, virtual and cloud firewalls, WAFs and reverse proxies. We need the model, the licence set and an export of your policy; the rest is in the plan." }, "name" : "Which firewalls can you test?" }, { "@type" : "Question", "acceptedAnswer" : { "@type" : "Answer", "text" : "Three options. The box ships to CloudLAB and goes back after the run. We connect the bench to your lab over a dedicated link. Or, for virtual and cloud firewalls, we run the image on the bench hypervisor or in your tenant. The plan names the option and what each side provides." }, "name" : "Do we have to ship the device?" }, { "@type" : "Question", "acceptedAnswer" : { "@type" : "Answer", "text" : "With your policy: rulebase, inspection profiles, logging and TLS inspection scope as you run them, from an anonymised export. A vendor-default run can be added as a second baseline so you see what the policy costs." }, "name" : "Is it tested with our policy or with vendor defaults?" }, { "@type" : "Question", "acceptedAnswer" : { "@type" : "Answer", "text" : "IPS, antivirus, application control, URL filtering, TLS inspection and logging, switched on in the order the plan sets. Each step gets its own throughput, connections per second and latency figure, so the report shows what every feature costs and where the box stops clearing the plan." }, "name" : "Which features count as load?" }, { "@type" : "Question", "acceptedAnswer" : { "@type" : "Answer", "text" : "WAFs and reverse proxies are a device class of their own on the bench, measured in requests per second and latency with the full rule set on. SASE and cloud firewall points are tested from the bench as the client side. Virtual firewalls get the same cases per instance size and vCPU count." }, "name" : "What about WAF, SASE and virtual firewalls?" }, { "@type" : "Question", "acceptedAnswer" : { "@type" : "Answer", "text" : "Test plan and quote in 1–3 business days after the brief. A run takes from 2 weeks for one device and 3–4 weeks for a shortlist of 3. The report holds the result table, latency histograms, captures, device counters and config exports, and the rerun of fixed items is part of the plan." }, "name" : "How long does it take and what do we get?" } ] } ```