Starlight Tools
Capacity runway chart
Current and horizon utilization will appear after calculation.
PrimaryAddressServiceGroupsHard limitPlanning ceiling
Firewall Rule Capacity Calculator: Forecast Rulebase Growth and Cleanup
Estimate when a firewall will reach its rule, expanded-entry, capacity-unit, or object limit—and how many rules must be retired to stay below your planning ceiling. This is rulebase capacity planning, not throughput sizing: it does not size bandwidth, sessions per second, TLS inspection, or packet-processing performance.
Basic mode
Example data loaded: the starting values describe an illustrative enterprise edge. Replace them with your own counts before using the result.
Advanced mode: vendor scope, ranges, objects, spikes, and workload
Logical rule: one policy row authored by an administrator.
Deployed entry / ACE: a compiled entry; one logical rule can expand into many.
Vendor unit: a weighted or platform-defined capacity measure, such as AWS WAF WCU.
Scope: the device, policy, virtual system, VDOM, domain, account, or Region to which both count and limit apply.
Illustrative scenarios — not vendor limits
Capacity decision
Capacity status-
Runway range-
Earliest threshold-
Expected threshold-
Ranked action plan
- Enter values and calculate to generate recommendations.
Primary capacity
First pool to threshold:-
Planning ceiling / hard limit:-
Current → horizon utilization:-
Expected net growth:-
Cleanup required by horizon:-
Per-cleanup-cycle target:-
Known stale-candidate coverage:-
Maximum sustainable additions:-
Object and workload signals
Address-object runway:-
Service-object runway:-
Object-group runway:-
Review and validation workload:-
Forecast by month
| Month | Low primary | Expected primary | High primary | Primary utilization | Address / util. | Service / util. | Groups / util. |
|---|---|---|---|---|---|---|---|
| Calculate capacity to populate the forecast. | |||||||
Where to collect each input
Use read-only views or exports and keep the count, limit, and scope aligned. Average additions and retirements over several representative months; exclude an exceptional migration from the normal rate and enter it as a one-time spike.
- AWS WAF: open AWS WAF → Protection packs (web ACLs) or Web ACLs → select the ACL → Rules. The console shows capacity while rules are edited; the WAFv2
CheckCapacityAPI estimates WCU for a JSON rule set. AWS explains that WCU varies by rule complexity and that a web ACL has a 5,000-WCU maximum. AWS WAF capacity-unit documentation. - AWS Network Firewall: use VPC → Network Firewall → Firewall policies and total the stateful rule capacity across referenced groups for one policy. The documented default quota is 30,000 stateful rules per firewall policy per account per Region. AWS Network Firewall quotas.
- Palo Alto Networks: in the relevant device or virtual-system policy, count Security rules and Objects separately. On the firewall CLI,
show system state filter cfg.general.max*reports model limits; the official knowledge base also lists maximum security policies for several platforms. Confirm the current PAN-OS release and whether the value applies per device or virtual system. Palo Alto rule-object limits. - Cisco Secure Firewall: obtain the logical count from the access-control policy, then use the FMC access-control rule expansion script for the target device UUID when the deployed ACE basis matters. Cisco documents that network object groups can expand one logical rule into multiple ACEs. Cisco rule expansion guidance.
- Change and retirement rates: export completed firewall change records and policy-review closures for the same scope. Count implemented additions, confirmed removals, and object reuse; do not treat an unreviewed stale-rule candidate as retired. NIST recommends regular firewall policy review rather than review only during audits or emergencies. NIST SP 800-41 Rev. 1.
Formula, ranges, and counting rules
Planning ceiling: hard limit × selected utilization
Expected net growth: monthly additions − monthly retirements
Low / high net growth: additions × (1 ∓ variation) − retirements
Expected runway: the first simulated month where expected usage, including a configured temporary spike, meets the planning ceiling. The earliest threshold uses the high-growth scenario.
Object net growth: requested additions × (1 − reuse or consolidation %) − object retirements
Cleanup target: max(0, expected count at horizon − planning ceiling). A temporary spike is added once and removed after its duration; it is not treated as recurring growth.
Logical rules, expanded entries, and vendor units are not interchangeable. AWS WAF WCU reflects relative processing cost, while Cisco documents that object groups can expand logical rules into multiple deployed ACEs. The calculator blocks a documented preset if its metric and the selected capacity basis no longer match.
Worked firewall capacity examples
Enterprise edge: normal growth
Inputs: 1,800 current logical rules; 10,000 maximum; 168 added and 55 retired monthly; 75% planning ceiling; 12-month horizon.
Substitution: ceiling = 10,000 × 0.75 = 7,500; net growth = 168 − 55 = 113/month; runway = (7,500 − 1,800) ÷ 113 = 50.4 months; horizon count = 1,800 + 12 × 113 = 3,156.
Decision: no horizon cleanup is required, but growth measurements should be refreshed because the expected ceiling is roughly four years away.
Migration surge: temporary duplicates
Inputs: 9,000 current entries; 15,000 maximum; 260 added and 100 retired monthly; 80% ceiling; 2,000-entry spike beginning month 3 and removed after 6 months.
Substitution: ceiling = 15,000 × 0.80 = 12,000; normal net = 160/month; month 7 during overlap = 9,000 + 7 × 160 + 2,000 = 12,120; month 9 after removal = 9,000 + 9 × 160 = 10,440.
Decision: the temporary migration breaches the planning ceiling even though normal growth does not yet do so. Stage cleanup earlier, reduce overlap, or add temporary platform headroom.
Stable or shrinking rulebase
Inputs: 280 current rules; 1,500 maximum; 10 added and 14 retired monthly; 70% ceiling.
Substitution: net growth = 10 − 14 = −4/month; the ceiling is 1,500 × 0.70 = 1,050.
Decision: expected runway is stable because the count is shrinking. Continue governance: negative primary growth does not prove object pools or future projects are safe.
Evidence, validation, and revision record
Creator and technical review
Starlight Robotics infrastructure tooling team. No individual reviewer identity is published; none is implied.
Starlight Robotics infrastructure tooling team. No individual reviewer identity is published; none is implied.
Calculation revision
Version 2.0.0, revised 18 July 2026.
Version 2.0.0, revised 18 July 2026.
Validation method
Boundary checks for zero and negative growth, target already reached, temporary spike addition and removal, disabled-rule inclusion, custom metrics, object pools disabled with zero limits, and 1–60 month horizons.
Boundary checks for zero and negative growth, target already reached, temporary spike addition and removal, disabled-rule inclusion, custom metrics, object pools disabled with zero limits, and 1–60 month horizons.
Evidence policy
Vendor claims link to official documentation. Presets record scope and verification date. Utilization targets are organizational choices, not universal recommendations.
Vendor claims link to official documentation. Presets record scope and verification date. Utilization targets are organizational choices, not universal recommendations.
Change log
- 2.0.0 — 18 July 2026: added vendor presets, capacity bases, Basic/Advanced modes, scenario ranges, temporary spikes, actionable results, chart, dynamic forecast, collection guidance, examples, accessibility validation, and synchronized structured data.
- 1.0.0 — June 2026: initial rule and object runway model.
Firewall rule capacity FAQs
How many firewall rules can a device support?
There is no universal number. The supported count depends on vendor, model, software release, policy type, virtual context, and whether objects expand into deployed entries. Use the official model limit or a verified device-reported limit.
What is the difference between a hard limit and an operational ceiling?
A hard limit is enforced by the platform. An operational ceiling is an organization-selected planning threshold below that maximum, leaving headroom for urgent changes, migration overlap, and uncertainty.
Are logical rules the same as deployed or expanded entries?
No. One logical policy can expand into multiple deployed entries when object groups or other conditions are compiled. Compare a deployed-entry count only with a deployed-entry limit.
Do disabled firewall rules count toward the limit?
Vendor behavior differs. Use the calculator choice that matches the count and limit reported by your platform; disabled rules can still create operational review and cleanup work even when excluded from an enforced limit.
How should I combine multiple policies, virtual systems, VDOMs, or management domains?
Do not add unrelated scopes unless the vendor enforces one shared limit across them. Run one calculation per enforced scope—such as per device, policy, virtual system, VDOM, domain, account, or Region—or aggregate only when the official quota is aggregate.
How much firewall capacity headroom should I reserve?
Use an organization-approved operational ceiling based on emergency-change demand, migration overlap, measurement uncertainty, and platform behavior. Example values such as 70% or 80% are policy choices, not universal safe limits.
What does negative rule growth mean?
Negative growth means monthly retirements exceed additions. The calculator reports the runway as stable, but reviews should continue because project spikes and other capacity pools can still create constraints.
When is firewall cleanup preferable to a platform upgrade?
Prefer cleanup or consolidation when confirmed stale candidates cover the forecast requirement, duplicate objects drive expansion, or governance can make additions sustainable. Consider expansion when valid business rules exceed supported capacity despite effective cleanup, or a temporary migration cannot fit within safe headroom.
How does AWS WAF capacity differ from network-firewall rule counts?
AWS WAF uses weighted web ACL capacity units whose cost varies by rule complexity. AWS Network Firewall documents stateful and stateless rule capacity per firewall policy. They are different metrics and must not be compared directly.
Is this calculator private?
Yes. Inputs and results stay in the browser unless you choose Share, Copy, or Download.
Disclaimer
This is an infrastructure planning aid. Confirm vendor support limits, licensed features, management-server limits, HA behavior, audit requirements, security policy ownership, and change-control approval before making firewall changes.