Sizing a gateway: what actually decides the model

Every job starts with the same question, usually asked backwards: how many ports do I need?

Ports are the cheapest thing to add later. A switch downstream solves that forever, for a couple of hundred dollars. What you can't fix later without buying the box twice is throughput, storage, and whether the thing will run the software you'll want on it in two years.

This applies whatever badge is on the front. Ubiquiti, Fortinet, Cisco, Meraki, SonicWall, or a pfSense box you built yourself all fail in the same order when they're undersized.

Start with the circuit you'll be paying for

The gateway routes, inspects, and translates everything coming off your internet connection. Size it against the circuit you'll have in two years, not the one you have now. If you're on 500/500 and the provider keeps mentioning a 2 Gig tier, size for 2 Gig.

Two things catch people.

Inspection costs throughput. Turning on intrusion detection puts every packet through deep inspection, and the inspected number is always well below the routed number, often by a factor of three or four. If a box routes at line rate but inspects at 1 Gbps and you've got a 2 Gbps circuit, you're picking between your full bandwidth and your security posture. That's a bad thing to find out after it's racked.

The WAN port itself can be the ceiling. A gigabit WAN port passes a gigabit no matter how fast the silicon behind it is. If multi-gig service is even plausible, get 2.5 GbE or SFP+ on day one.

Then ask whether cameras are involved

This is the biggest fork in the road and the one that most often moves a quote up a tier.

Video has to be written somewhere. Some gateways have no storage, some have onboard flash, some have real drive bays. Cameras write continuously, forever, and how long you keep footage depends on resolution, frame rate, and how many of them there are.

If cameras are anywhere in the plan, including as a phase two eighteen months out, buy the box with drive bays now. Moving a video installation later means re-adopting every camera and losing the footage you had, and nobody budgets for that.

Rough figure for early sizing: a 4K camera recording continuously eats somewhere around a terabyte a month. Motion-only recording cuts that a lot, right up until you put it in a busy warehouse where "motion-only" means "almost always." Plan against the bad case.

Then what else lives on it

Firewalls stopped being just firewalls a while ago. Video, door access, VoIP, and analytics all want to run on the same appliance now, and they all want CPU, memory, and disk. A box that's comfortable routing your traffic can get miserable once it's also managing forty cameras and a dozen door readers.

Ask what the five-year plan is. Door access in particular tends to show up as a surprise, usually right after someone gets tired of rekeying locks following a turnover.

Rack or shelf

A dull constraint that gets ignored on paper. If there's a rack, buy the rackmount version. Desktop units end up on a shelf running warm, collecting dust, and getting knocked off by whoever is storing boxes in that closet.

If there's no rack and nowhere to put one, a rackmount gateway means you're now also quoting a wall-mount rack, and that changes the number.

Ports, finally

Now you can count ports, and the answer is usually fewer than you'd guess, because a proper switch should be handling access ports anyway.

Using the gateway's own ports for everything is fine on a small site with six or eight devices. Past that, let the gateway do gateway things and let a switch do switch things. It's easier to troubleshoot, easier to grow, and when the gateway gets replaced in five years you're not re-patching the whole closet.

The short version

• No cameras, sub-gigabit circuit, under ten wired devices. A compact appliance is genuinely enough. Don't over-buy.
• Cameras, or multi-gig, or a rack. Go to something with drive bays and 2.5 GbE or SFP+ on the WAN. Most small businesses land here.
• Multiple buildings, 10 Gig, heavy inspection, or a lot of cameras. You're into the enterprise tier, and at that point the gateway is a small fraction of the project cost anyway.

The expensive mistake isn't buying one tier too high. It's buying one tier too low, working that out six months in, and paying for the install twice.

Send us the details and we'll tell you which box and why.

• Firewalls
• Gateways
• Design