Use server-class chipsets
Server-class Intel and Chelsio cards behave most consistently. Cheap consumer cards are a common source of packet loss that is painful to trace.
Enough. Not more.
A starting point for BYOD, not a performance promise. Final sizing is confirmed during the assessment, because real load follows the features you turn on.
| Scale | CPU cores | Memory | Storage | Notes |
|---|---|---|---|---|
| Up to 25 users | 2 | 8 GB | 128 GB SSD | One small office or clinic. Enough for firewall, VPN and DNS filtering. |
| 25–100 users | 4 | 16 GB | 256 GB SSD | Turning on IDS/IPS here costs memory, not extra cores. |
| 100–500 users | 8 | 32 GB | 512 GB SSD | Start considering an HA pair. Storage grows with logs and reporting. |
| 500+ users or data centre | 8+ | 64 GB | 1 TB SSD | Designed case by case. Throughput follows the network cards and rule count, not the user count. |
The part most often gotten wrong
Avoid USB interfaces
USB adapters do not belong on a production path. Not even at a small site.
Leave one port spare
One idle interface saves you the day you need out-of-band management or a second WAN.
SSD, not a memory card
Logs and reports write constantly. Cheap flash wears out sooner than you expect.
Being compiled
We only list units we actually run in production, with versions and the problems we hit. That list is not ready, so it is not up. Meanwhile, send the specs you are considering and you get an honest read.