Edge NGFW — the one security box
An edge firewall is a dedicated security box that sits in the path between your gateway and your switches. Every packet in and out passes through it, and it drops the bad stuff before it reaches your servers. It is the one inline security box you need — intrusion-blocking and flood-absorb are features you switch on for it, not separate boxes.
The box can route a lot of traffic, but the moment it inspects deeply it slows to a fraction of that. Buy a bigger box for more throughput; it runs on its own silicon, so unlike a feature bolted onto your router it does not slow the router down. Size it for the inspected number, not the headline speed.
Detailed explanation
A consolidated next-gen firewall. Stateful L3/L4 filtering is the base; IPS/Threat (intrusion) and Scrub (volumetric absorb) are on-box function licenses you toggle. Two separate ceilings: the forwarding-ASIC rate (fabric_capacity_gbps) and the deep-inspection rate (inspection_capacity_gbps, far lower). Runs on its own ASIC, so it does not throttle the gateway — that is the reason to graduate off the gateway add-ons onto a box.
An inline box is a bump-in-the-wire: usable WAN = min(uplink lines, gateway fabric, the box ASIC / bonded WAN ports). Undersize it and it caps your pipe below your line capacity — sustained traffic over the ceiling degrades p99 through the saturation path. Bond its WAN ports (LAG) to raise the link term up to the ASIC; buy a bigger box to raise the ASIC.