Why two network cards are non-negotiable, what the sizing really depends on, and how to choose between a spare PC and a virtual machine — without inventing numbers.
Most NG Firewall questions go wrong before the installer even runs, because they start from the PC instead of the job. A gateway is a border: internet on one side, your network on the other. That single fact decides the hardware. This page covers the two-network-card rule and why it cannot be negotiated away, what actually drives CPU and RAM needs (it is the apps, not the firewall), and the honest choice between physical hardware and a virtual machine.
Filtering only works on traffic that passes through the box. The External interface takes the connection from your modem or ISP router; the Internal interface connects to your office switch. Packets cross the rack of apps between the two ports — that crossing is where firewall rules, filtering and logging happen. A single-NIC machine can only sit beside the network, watching copies of some traffic; it cannot enforce anything. Laptop built-in networking plus Wi-Fi does not count as a practical pair: Wi-Fi as a WAN side is unreliable for a gateway role, and a USB network dongle is the first part to fail under 24x7 load. Add a proper second card (PCIe in a desktop) or give a virtual machine two virtual NICs.
Plain routing and firewall work is light. The load arrives with the inspection apps: Virus Blocker scans files as they cross, SSL Inspector decrypts and re-encrypts HTTPS, Intrusion Prevention matches traffic against large rule sets, and Reports writes a database of everything. Honest sizing logic:
The system itself is compact; the disk mostly holds the Reports database and logs. An SSD is the sensible default: report searches and dashboard pages feel instant, and there are no spinning parts in a box that runs all year. A larger disk buys longer report retention, not more speed or more security. Whatever you fit, remember the installer formats the entire drive — nothing else should live on this machine.
Both are documented, supported shapes. A physical spare PC is independent: it keeps working when your server reboots, and its two real ports are easy to reason about. A virtual machine (the OVA download exists for this) snapshots beautifully before upgrades and needs no extra hardware, but the whole office loses internet whenever the host is down for maintenance, and the virtual switches must be mapped carefully so WAN and LAN can never mix. For a first evaluation, the VM wins. For a permanent office gateway, most admins end on dedicated hardware.
The gateway, the modem and the core switch belong on the same small UPS. In a short power cut the office keeps internet and phones; in a long one the box shuts down cleanly instead of corrupting its database mid-write. It is the cheapest reliability upgrade in this entire guide, and it is a hardware decision, so it belongs on this page.
See the machine, the two network connections and the full install on real hardware in the video.
▶️ Watch Full VideoIt will usually work, and it is acceptable for a weekend test. For a permanent gateway it is the weak link — USB adapters run hot, reset under load and complicate boot. A PCIe card in a desktop, or a second virtual NIC in a VM, is the reliable answer.
It depends on the app mix more than the headcount. Firewall, filtering basics and reports for a small office run comfortably on a modest modern machine; SSL inspection and virus scanning for many users push requirements up quickly. Check Arista's published sizing guidance for your number of users and the apps you plan to enable, and leave room to grow.
Quite possibly — the platform is not demanding for basic use. The real questions are whether it has (or can take) a second network card, whether its disk is healthy enough for a 24x7 role, and whether you accept that when that old PC dies, the office internet dies with it until you restore the backup on new hardware.