Appliance Builder

Build Your Firecradle Appliance

Tell us about your network. We'll recommend the exact firewall hardware you need - and explain why. Every recommendation can be overridden if you know better.

Mode:
1

What's Your Network?

Enter the number of users and devices per category.

LAN Users & Devices
Workstations, laptops, VoIP phones
25devices
Remote / Road-Warrior VPN Users
IPsec, WireGuard, or OpenVPN clients
5users
Guest & IoT Devices
Guest Wi-Fi, cameras, badge readers
10devices
Servers / DMZ Hosts
Publicly-reachable or heavy-throughput hosts
3hosts
Branch / Site Locations
Remote offices via site-to-site VPN
1sites
Total users & devices51
When in doubt, round up. Servers/DMZ hosts are weighted heavier than desktop users since they typically drive more inspected throughput. Switch to Advanced if you'd prefer to enter your total user count and bandwidth-per-user directly.
2

Traffic & Inspection Requirements

How much throughput do you need, and how deep should inspection go? Deeper inspection costs CPU headroom.

Throughput Target
★ Most common target for SMB internet edges
Inspection Depth
Firewall + IPS covers most SMB deployments. Full DPI + SSL inspection costs more CPU but catches encrypted threats.
Peak Traffic Window
Hours per day traffic runs near peak - informs the sustained throughput your appliance must sustain.
Firewall + IPS (~15%) at a Moderate traffic profile means an aggregate demand of 204 Mbps across 51 users/devices. After inspection overhead and burst headroom, plan for 288 Mbps of appliance capacity during your 16 hrs peak window.
3

Interface & Redundancy Configuration

We calculate the port count you need based on your throughput target. You can override any value.

Port Speed
Faster ports = fewer ports for the same aggregate throughput. SFP+ modules require compatible switch-side optics.
Port Count
Recommended: 2 ports × 2.5GbE
2.5 Gbps effective
You need 288 Mbps of effective throughput (peak demand + inspection overhead + 20% burst headroom). Active-Backup bonding only carries traffic on one link at a time (2.5 Gbps per port) - the second port is a hot standby, not added capacity. We recommend 2 ports → 2.5 Gbps effective.
Link Bonding Mode
With 2 ports, Active-Backup is the simplest option - one link carries traffic while the other stays idle as a hot standby, taking over if the primary link or switch port fails.
Secondary WAN Uplinks
Independent ISP circuits for internet-edge failover
No secondary WAN uplink configured. A single ISP circuit is a single point of failure - if it drops, every user and site loses internet connectivity until it's restored. Adding a secondary uplink is a common resiliency upgrade.
4

Performance & Security Goals

Set your failover target and traffic intensity. This drives hardware tier selection and the performance analysis shown on the right.

Traffic Profile
Session target: 25,000 - influences hardware tier recommendation
Failover Target
How fast must an appliance failure recover? Sub-5-second targets require an Active-Passive HA pair.
Peak Concurrent Sessions
10k
Session capacity: ~960,000 ✓ sufficient
Thousands of simultaneous connection-table entries at peak (up to 500k).
5

VPN & Remote Access

How many concurrent VPN tunnels/users do you need? We'll recommend the right crypto performance tier.

Concurrent VPN Tunnels
5
IPsec / WireGuard / OpenVPN, combined
Crypto Performance Tier
Recommended: Standard (multi-core crypto)
For 5 concurrent tunnels with your traffic profile, AES-NI hardware crypto offload is intended to keep IPsec/WireGuard/OpenVPN throughput up without starving inspection.
6

High Availability & Fleet Management

Pair two appliances for automatic failover, and optionally manage every site from one console.

No HA Pair Configured
If this appliance fails, restoring service means replacing hardware and restoring your saved configuration - typically hours, not seconds. Your selected failover target requires an HA pair to hit reliably.
Active-Passive HA pairs typically fail over in ~1-3 seconds with existing sessions preserved.
Centralized Cloud / Fleet Management
Standalone appliance - managed locally via the on-box admin console. Switch to Fleet-Managed once you're running more than a couple of locations or managing multiple customer tenants.
Your Recommended Spec
All values are recommended for your network
Throughput Requirements
Aggregate demand204 Mbps
After inspection overhead240 Mbps
Burst headroom (20%)+ headroom applied
Total capacity needed288 Mbps
Network Interfaces
2× 2.5GbE ports
Active-Backup (1-link fault tolerance)
Effective: 2.5 Gbps
No secondary WAN uplink
✓ Meets your throughput target
Threat Detection / IPS
Firewall + IPS (~15%)
Rule/signature-based inspection engine
ET Open/Pro, VRT, and custom rule sources
Inline drop mode, per-rule tuning supported
Processor
8 cores / 16 threads minimum
2.4+ GHz base clock · Est. TDP ~45W
AES-NI (crypto offload) required
Handles 2.5 Gbps inspected traffic + 5 VPN tunnels
Memory (RAM)
16 GB DDR4/DDR5 ECC
ECC required for connection-table integrity
Session capacity: ~960,000 concurrent
VPN headroom: 5 tunnels
VPN & Remote Access
5 concurrent tunnels (Standard (multi-core crypto))
AES-NI, multi-core
IPsec (strongSwan) · WireGuard · OpenVPN
✓ Tier supports your tunnel count
High Availability & Management
Standalone appliance
Failover: Manual (hardware swap + config restore)
Locally managed console
Component Summary
2× 2.5GbEIPS / Threat Detection8-core CPU16 GB ECC RAM5 VPN tunnels
Power & Environment
Load draw
~91W
Annual energy
~797 kWh
Power cost/yr
~$104
Noise level
28–36 dB
Failover after appliance failure
Manual (hardware swap + config restore)
high risk
no HA pair configured
No secondary WAN uplink - single ISP circuit is a single point of failure
Quiet enough for a wiring closet, reception desk, or small-office rack. Power at $0.13/kWh. Breakdown: Ports 6W + RAM 3W + CPU ~45W.
Expected Performance
Aggregate Throughput✓ Target met
2.5 Gbps effective · 288 Mbps needed (16 hrs peak window)
Failover Speed⚠ Misses target
~300 sec achieved · target: < 30 sec
Concurrent Sessions (Moderate)✓ Sufficient
960,000 available · 10,000 needed
Optimal Bonded Pair Layout
1× 2-port bonded group✓ Optimal
Ports per group: 2 (even ✓)
Single bonded group - add another group to isolate failure domains
Effective throughput: 2.5 Gbps
Cost Estimate - Gross Approximation
Hardware (one-time est.)~$794
Hardware amortized /yr~$117/yr
Annual power cost~$104/yr
Total annual operating~$221/yr
Prices are rough estimates based on typical enterprise hardware costs and vary significantly by vendor, region, and market. This is not a formal quote.
This is a minimum specification. Adding 20–30% headroom (more RAM, faster ports) extends lifespan and handles unexpected growth. Firecradle can help finalize your hardware selection.