Q: What throughput do I actually need for a 100-user office?

For a 100-user office, we recommend a firewall with a rated throughput of at least 2–3 Gbit/s — even if your internet connection is only 500 Mbps. Real-world throughput under full UTM load (IPS, SSL inspection, antivirus) can be 40–60% lower than the headline figure. Buying headroom now avoids a costly upgrade in 18 months as your team grows and cloud application usage increases.

Q: Is there a meaningful difference between Cisco ASA and FTD software?

Yes — and it matters more than most buyers realise. ASA is a traditional stateful firewall; FTD adds next-generation threat detection including IPS, application visibility, and malware analysis. If you're buying a Cisco Firepower appliance primarily for perimeter security on a tight budget, ASA is simpler to manage. If you need advanced threat intelligence and have the staff to use Firepower Management Centre, FTD is the right choice. Don't pay for FTD capabilities you won't configure.

Q: Are hardware firewalls from Zyxel as reliable as Cisco or Fortinet?

For SMB deployments, Zyxel's USG Flex range is genuinely competitive and significantly cheaper than equivalent Cisco or Fortinet units. The hardware quality is solid, the web interface is accessible to non-specialists, and the subscription costs are more transparent. Where Zyxel falls short is in very large enterprise environments requiring deep integration with SIEM platforms or advanced compliance reporting — that's where Fortinet and Cisco pull ahead.

Q: What are the hidden costs I should watch out for when buying a hardware firewall?

Annual subscription licences are the biggest hidden cost — and they're often not mentioned prominently at point of sale. Threat signature updates, cloud management access, and technical support renewals can add 20–40% of the hardware cost per year. SonicWall and Fortinet are particularly aggressive with their licensing models. Always ask for a three-year total cost of ownership breakdown before purchasing, and check what happens to the device's functionality if you let a licence lapse.

Q: Which brands offer the best value for a small business in 2026?

Zyxel offers the best value for most small businesses , with the USG Flex 50H and USG Flex 100 covering the majority of SMB use cases at prices starting from 304 £. Cisco Meraki Go is worth considering if ease of cloud management is a priority and you don't have in-house IT expertise. Avoid over-specifying — a WatchGuard or SonicWall mid-range appliance is excellent kit, but the licensing overhead makes it hard to justify for a sub-50-user organisation.

Question 1

What throughput do I actually need for a 100-user office?

Accepted Answer

For a 100-user office, we recommend a firewall with a rated throughput of at least 2–3 Gbit/s — even if your internet connection is only 500 Mbps. Real-world throughput under full UTM load (IPS, SSL inspection, antivirus) can be 40–60% lower than the headline figure. Buying headroom now avoids a costly upgrade in 18 months as your team grows and cloud application usage increases.

Question 2

Is there a meaningful difference between Cisco ASA and FTD software?

Accepted Answer

Yes — and it matters more than most buyers realise. ASA is a traditional stateful firewall; FTD adds next-generation threat detection including IPS, application visibility, and malware analysis. If you're buying a Cisco Firepower appliance primarily for perimeter security on a tight budget, ASA is simpler to manage. If you need advanced threat intelligence and have the staff to use Firepower Management Centre, FTD is the right choice. Don't pay for FTD capabilities you won't configure.

Question 3

Are hardware firewalls from Zyxel as reliable as Cisco or Fortinet?

Accepted Answer

For SMB deployments, Zyxel's USG Flex range is genuinely competitive and significantly cheaper than equivalent Cisco or Fortinet units. The hardware quality is solid, the web interface is accessible to non-specialists, and the subscription costs are more transparent. Where Zyxel falls short is in very large enterprise environments requiring deep integration with SIEM platforms or advanced compliance reporting — that's where Fortinet and Cisco pull ahead.

Question 4

What are the hidden costs I should watch out for when buying a hardware firewall?

Accepted Answer

Annual subscription licences are the biggest hidden cost — and they're often not mentioned prominently at point of sale. Threat signature updates, cloud management access, and technical support renewals can add 20–40% of the hardware cost per year. SonicWall and Fortinet are particularly aggressive with their licensing models. Always ask for a three-year total cost of ownership breakdown before purchasing, and check what happens to the device's functionality if you let a licence lapse.

Question 5

Should I buy a hardware firewall or use a software/cloud firewall instead?

Accepted Answer

For any organisation with physical premises and on-site servers or workstations, a hardware firewall remains the right choice. Software firewalls running on general-purpose servers introduce latency and single points of failure. Cloud-based firewalls (FWaaS) are compelling for fully remote or cloud-native organisations but add ongoing costs and latency for on-premise traffic. A hybrid approach — hardware firewall at the perimeter, cloud management — is increasingly common and well-supported by platforms like Cisco Meraki and Zyxel Nebula.

Question 6

Which brands offer the best value for a small business in 2026?

Accepted Answer

Zyxel offers the best value for most small businesses, with the USG Flex 50H and USG Flex 100 covering the majority of SMB use cases at prices starting from 304 £. Cisco Meraki Go is worth considering if ease of cloud management is a priority and you don't have in-house IT expertise. Avoid over-specifying — a WatchGuard or SonicWall mid-range appliance is excellent kit, but the licensing overhead makes it hard to justify for a sub-50-user organisation.

Question 7

Can I use a hardware firewall as a VPN concentrator for remote workers?

Accepted Answer

Yes, but check the maximum concurrent VPN tunnel limit before buying — it varies enormously and is often the first bottleneck in remote-work scenarios. Entry-level appliances may cap at 10–25 simultaneous SSL VPN sessions, which is inadequate for a team of 30 remote workers. The DrayTek Vigor 3912 and Cisco Firepower 1010 are both well-regarded for VPN-heavy deployments. Also confirm whether SSL/TLS client VPN is included in the base licence or requires an additional subscription.

Hardware Firewalls Price Comparison

Zyxel USGFLEX50H-EU0101F hardware firewall

DrayTek Vigor 3912 VPN Enterprise Router

Hardware Firewalls Price Comparison

Hardware Firewalls price comparison UK

Zyxel USGFLEX50H-EU0101F hardware firewall

DrayTek Vigor 3912 VPN Enterprise Router