How come total throughout does not equal the number/speed of interfaces?

[Sheraz_35]

I was just wondering why the total throughput of a firewall may be less than the speed of the interfaces, i.e 

Firewall throughput : 1 Gbps

Interfaces: 6 x 1000Base-T - RJ-45

Shouldn't the throughput be 6Gbps? 1gps for each port? I know I am missing something if someone could help out that would be great. Thanks

[kcrane2 · Accepted solution]

Pretty straightforward.  There is processing involved in firewalling that would not be involved in just moving a packet from here to there.  An incomplete list of checks in no particular order:

- Anti Spoofing: Is the packet source from a network expected on this interface.

- Fragmentation:  Need to assemble the packet to perform more advanced protocol fixups/inspections.

- NAT processing: Got to lookup the rules to rewrite the headers.

- Policy processing.

- ACL matching:  Is this permitted traffic in the rule table.

This takes some period of time to complete and the higher the expected throughput of the firewall the more processor power it takes to complete it in time.  A firewall is not a switch and devices that can move 5,10,20 gigabit through all that processing cost big money.