Is TLS/SSL inspection throughput important while sizing a Firewall?

Question

Our firm is planning on purchasing a Firewall solution, but are confused with the sizing requirement. We currently have 5 wired internet connections which make a total throughput of 500 Mbps (each 100Mbps). In the future we plan to procure a 1Gbps Internet connection (single line) making our total office internet throughput to be around 1.5 Gbps.
While looking at the Firewall Configurations these throughputs are mentioned

1. Firewall Throughput
2. NGFW throughput
3. TLS/SSL inspection or decryption throughput.

Our Requirement from the Firewall is to log all the HTTPS URL’s. And to achieve this we need to enable TLS/SSL inspection on the Firewall so that all HTTPS request are decrypted and the URLS are logged. But as per the datasheets when TLS/SSL inspection is enabled the throughput is reduced significantly.

1. Now since we have a total of 1.5 Gbps internet throughput available, should we select a firewall that has say 1.5 Gbps of TLS/SSL inspection throughput since we have our backup servers updating Data to cloud?
2. Will the TLS / SSL inspection throughput affect Uploads and Downloads speeds ( i.e, if we purchase a firewall with TLS/SSL inspection throughput of 500mbps, does that mean we cannot use fully utilize our 1Gbps internet connection.)

Answer 1

In addition to Ron's answer to the basic problem:

Now since we have a total of 1.5 Gbps internet throughput available, should we select a firewall that has say 1.5 Gbps of TLS/SSL inspection throughput since we have our backup servers updating Data to cloud?

Basically yes. But you can skip SSL inspection for those connections that you deem harmless, depending on policy. I wouldn't decrypt/scan traffic between sites, including your own cloud services. Some only decrypt user-initiated traffic but no traffic between servers. You can also exempt services that you trust. But all that depends on your requirements/risk assessment.

Will the TLS / SSL inspection throughput affect Uploads and Downloads speeds ( i.e, if we purchase a firewall with TLS/SSL inspection throughput of 500mbps, does that mean we cannot use fully utilize our 1Gbps internet connection.)

Generally yes. However, if you only use SSL inspection for HTTPS traffic, other traffic won't be impacted. You might want to scan FTP, SFTP, SMTP, IMAP, ... traffic for malware as well though.

If the firewall (with the defined workload) is slower than your Internet link then yes, it'll become the bottleneck, slowing potentially faster connections.

Putting Ron's answer in a slightly different way: you either need to scale down the requirements or scale up the budget. After all, it's a risk/cost tradeoff and you might need to accept a risk when avoiding it isn't worth the cost.

Answer 2

Now since we have a total of 1.5 Gbps internet throughput available, should we select a firewall that has say 1.5 Gbps of TLS/SSL inspection throughput since we have our backup servers updating Data to cloud?

You should size it based on the amount of SSL traffic you anticipate. Since most web traffic is SSL (and the percentages are increasing), this should be close to the maximum. You also want to account for traffic growth.

Will the TLS / SSL inspection throughput affect Uploads and Downloads speeds ( i.e, if we purchase a firewall with TLS/SSL inspection throughput of 500mbps, does that mean we cannot use fully utilize our 1Gbps internet connection.)

Depends on whether your backups use SSL as well.

Ultimately, it comes down to performance vs. price. Only you can decide if it's worth it.