4 cores, AES-NI
Crypto acceleration matters more here than clock speed. Without it the processor encrypts in software, and tunnel throughput falls off a cliff that no extra core climbs back.
Firewall hardware for 100 users.
Four CPU cores with AES-NI, 16 GB of memory, a 256 GB SSD and two server-class network ports. That is the starting point for a hundred people behind one gateway running firewall, segmentation, VPN and DNS filtering.
The short answer
16 GB
Memory holds the state table, one entry per live connection. A hundred people run thousands at once, because a single browser tab opens far more than one.
256 GB SSD
Logs and reports write constantly. Storage is sized by how long you keep them, not by how fast the link is.
2+ server-class ports
Server-class Intel or Chelsio chipsets, and one port left spare for out-of-band management or a second WAN.
What pushes it higher
- IDS/IPS turned on
- Inspection reads packet content, not just headers. Budget 32 GB rather than 16, and expect the ceiling to come from inspection rather than from cores.
- Many site-to-site tunnels
- Every branch tunnel is encryption work. Ten tunnels move the CPU answer further than fifty extra users do.
- A large ruleset
- The cost is how many rules a packet is evaluated against before it matches, not how many sit in the list.
- Small packets
- Voice and gaming traffic move few bytes per packet, forcing a decision far more often than a file transfer at the same bandwidth.
What "100 users" actually means
A hundred users is a purchasing unit, not a load. What the device counts is concurrent connections, and the two do not track each other. A hundred office workers on mail and browsers sit well below a hundred students on phones with everything open, and both can sit below fifty machines that all start a backup at the same hour. When in doubt, count the devices that hold connections, not the people who own them.
What we will not tell you
We will not hand you a throughput figure for this build, because we have not measured it on units we run ourselves. A number borrowed from another vendor would describe their configuration, not yours, and it would be the easiest lie for you to check. At the assessment we measure against your real load.
Not sure which side of the line you fall on?
Send the specs you are considering and the features you plan to turn on. You get an honest read, including when the answer is that the box is enough already.