What the Huawei HiSecEngine USG6650E is designed to do

The Huawei HiSecEngine USG6650E belongs to the USG6600E enterprise firewall family and is positioned for networks where security policy enforcement must keep pace with multi-gigabit traffic, large session counts and a mix of routed, transparent, VPN and virtualized security services. It is not simply a packet-filtering appliance. Its value comes from combining network-layer firewalling with application identification, content inspection, encrypted-traffic controls, user awareness and centralized operations. For UAE enterprises, this combination can reduce the number of separate appliances required at the Internet or data-center edge while giving network teams a single enforcement point for inbound, outbound, branch and remote-access traffic.

In a typical Dubai headquarters deployment, the USG6650E can be placed between an ISP or SD-WAN edge and the campus or data-center core. Security zones can separate Internet, DMZ, corporate user, server, guest, OT, partner, development and management networks. Policies can then combine source and destination addressing with application, service, user, time range, URL category and content-security controls. The objective is to move beyond broad port-based rules. A policy allowing HTTPS on TCP 443, for example, does not have to imply unrestricted access to every web application carried inside HTTPS. Application identification and URL categorization can apply a more precise business policy.

The platform is also relevant when an organization is consolidating branch VPN termination. Published specifications list 30 Gbit/s of IPsec VPN throughput under Huawei’s stated test conditions and up to 15,000 gateway-to-gateway and 15,000 client-to-gateway IPsec tunnels. Those figures do not replace a real sizing exercise: encryption algorithms, packet size, tunnel topology, routing, logging, inspection features and traffic mix all affect usable capacity. They do, however, show that the model is intended for substantially larger VPN estates than an SMB-class firewall. FourTeck can align platform sizing with actual WAN circuits, peak utilization, growth targets, security profiles and availability requirements through its Firewall Dubai engineering practice.

Published performance: how to read the numbers correctly

Huawei notes that performance is tested under defined laboratory conditions and that actual results vary by environment. The correct design method is therefore to begin with the protected throughput requirement, not the raw firewall number. If a customer expects 8 Gbit/s of sustained Internet traffic with IPS, antivirus, URL filtering and substantial HTTPS decryption, the engineer must size against those services together, add growth and failover headroom, and confirm the intended software release and license set.

Interface architecture and physical connectivity planning

Huawei’s published ordering guide identifies the USG6650E AC host with 2 × 40GE QSFP+, 12 × 10GE SFP+ and 12 × GE RJ45 fixed interfaces. That combination makes the platform particularly useful when a firewall must connect simultaneously to redundant core switches, high-speed data-center aggregation, multiple ISP handoffs, DMZ switching and management or auxiliary networks. The 40GE interfaces can serve as high-capacity north-south or east-west uplinks, while 10GE SFP+ ports can connect to core or distribution switches using optical transceivers or supported direct-attach media. Copper Gigabit interfaces remain useful for management segments, lower-speed WAN handoffs, out-of-band services and legacy infrastructure.

Port count should never be treated as the same thing as usable design capacity. A resilient deployment may consume interfaces in pairs because each logical service requires a path to two independent switches. Link aggregation can consume multiple physical ports to create one logical bundle. Some operators keep dedicated physical interfaces for HA heartbeat, management, logging or isolated break-glass access. Optical reach and fiber type also matter: short-range multimode optics, long-range single-mode optics and DAC/AOC connectivity solve different cabling problems. The quotation should therefore include a port map showing every firewall interface, its speed, media, VLAN strategy, connected switch and redundancy role.

For 40GE, engineers must confirm the exact QSFP+ module compatibility and whether breakout behavior is required. For 10GE, validate SFP+ transceivers, wavelength, fiber plant, link budget and switch-side compatibility. For copper GE, confirm whether ISP or LAN handoffs are fixed-speed, auto-negotiated or delivered through a media converter. These details prevent an otherwise correctly sized firewall from arriving without the optics or cables necessary to connect it.

The chassis is a 1U design and published dimensions for the family are 44 × 442 × 420 mm. Rack-depth, airflow, power distribution and front/rear cable management should still be checked against the selected rack. UAE data centers frequently use high-density racks with strict A/B power policies and structured fiber trays, so physical planning should be completed before the maintenance window rather than during installation.

Security services and policy depth

Encrypted traffic inspection: the practical design questions

HTTPS and TLS now carry a dominant share of enterprise traffic, so a next-generation firewall can only inspect a portion of modern threats if encrypted sessions remain opaque. The USG6650E supports SSL-encrypted traffic detection and published SSL inspection throughput of 7 Gbit/s under Huawei’s stated TLS and IPS test conditions. That figure is valuable, but it should not be interpreted as a promise that every real-world HTTPS workload will sustain the same rate. Cipher suites, TLS versions, certificate chains, connection reuse, object size, application behavior and the number of new handshakes per second can all influence performance.

A successful decryption deployment starts with policy architecture. Organizations should identify which traffic genuinely needs decryption, which categories are exempt for privacy or legal reasons, which applications use certificate pinning, which unmanaged devices cannot trust an enterprise certificate authority, and which destinations break when subjected to man-in-the-middle inspection. Banking, healthcare, identity and other sensitive categories are frequently treated differently from general web browsing. The exact policy must be determined by the customer’s governance requirements rather than copied from a generic template.

Certificate distribution is equally important. Managed Windows, macOS, mobile and Linux endpoints may require different trust-distribution mechanisms. BYOD and guest devices present a different challenge because the enterprise often cannot install a private CA certificate. For inbound inspection of public services, the firewall must be integrated with the organization’s certificate and key-management process. Expiry monitoring, key custody and renewal procedures should be documented before production cutover.

When sizing, use the encrypted traffic percentage rather than total Internet bandwidth. A 10 Gbit/s ISP circuit carrying 70 percent TLS traffic presents a different inspection requirement from a 10 Gbit/s private WAN link carrying mostly non-web applications. FourTeck’s UAE IT services team can incorporate certificate rollout, pilot testing, application exceptions and phased decryption into the implementation scope instead of treating SSL inspection as a single checkbox.

VPN architecture for headquarters, branches and remote access

The USG6650E supports several VPN technologies, including IPsec, SSL VPN, L2TP, MPLS VPN and GRE capabilities documented for the family. The most common enterprise requirement is site-to-site IPsec between headquarters, data centers, branches or cloud networks. Huawei publishes IPsec VPN throughput of 30 Gbit/s for the USG6650E using AES-256 with SHA256 and 1420-byte traffic in its defined test conditions. The platform also lists up to 15,000 gateway-to-gateway tunnels, providing substantial scale for hub-and-spoke and regional aggregation designs.

Tunnel count alone is not enough for sizing. A branch estate of 1,000 sites sending a few megabits each may be easier to process than a smaller number of branches pushing continuous multi-gigabit encrypted traffic. Routing behavior, dead-peer detection, rekey intervals, dynamic routing inside tunnels, failover paths and logging affect the operational design. In a resilient architecture, branches may establish tunnels to two independent head-end firewalls or two separate sites, doubling the number of security associations relative to the logical branch count.

For remote access, the published USG6650E maximum is 5,000 concurrent SSL VPN users with the appropriate license, while the default entitlement listed by Huawei is lower. This distinction is procurement-critical. A customer expecting 2,500 simultaneous remote workers should not assume that the hardware purchase by itself includes that concurrency level. The bill of materials must list the required SSL VPN user license, software support and any security subscriptions separately so that the final system matches the intended operating state.

Authentication integration should be decided early. Huawei documents support for local, RADIUS, HWTACACS, Active Directory and LDAP-related authentication options across the family. In production, centralized identity is generally preferred because it enables consistent user lifecycle management, MFA integration where supported by the broader solution, and more useful audit trails. The firewall policy can then differentiate users or groups rather than relying only on IP addressing.

Remote-access capacity also depends on the type of application traffic. Interactive office applications, VDI, large file transfer, backup, software distribution and voice/video create different bandwidth and latency profiles. A well-designed remote-access project therefore combines firewall sizing with identity design, DNS reachability, split-tunnel policy, endpoint posture requirements, certificate handling and a support process for users outside the corporate LAN.

High availability and failure-domain design

For enterprise perimeter security, the firewall is usually a critical-path device. A single chassis may be technically powerful enough for the bandwidth requirement but still be architecturally unsuitable because maintenance, component failure or software upgrades would interrupt service. Huawei documents Active/Standby and Active/Active high-availability modes for the USG6600E family. The correct mode depends on topology, state synchronization, routing, asymmetric traffic risk, operational simplicity and the customer’s recovery objectives.

A common UAE design uses two firewalls connected to two core switches and two upstream routers or ISP devices. Every important path is physically redundant. HA state links are isolated from normal data traffic where possible, power feeds are split across independent PDUs, and each firewall can forward the full production load if its peer is unavailable. This last point is frequently missed. If two appliances share traffic in normal operation but either one must carry all traffic during failover, each device must be sized for the full peak requirement plus a safety margin.

Routing convergence and firewall failover have to be designed together. Static routes may be sufficient for small topologies, while enterprise cores often use OSPF, BGP, IS-IS or other dynamic routing supported by the platform. Route timers, BFD where applicable, link monitoring and upstream gateway behavior determine how quickly traffic returns after a failure. HA that changes firewall state in seconds is not useful if upstream routing takes several minutes to converge.

State synchronization determines whether established sessions survive a failover. Real testing should include long-lived application sessions, VPN tunnels, NAT translations, high-availability events and planned software maintenance. Test cases should cover link failure, power failure, device reboot, switch failure and ISP loss rather than only clicking a manual switchover button. The acceptance report should document which services remain stateful and which must reconnect.

Operational design matters as much as hardware. Both cluster members should run matched software and configuration states. Backup configuration, out-of-band access, console connectivity and documented break-glass credentials need to exist before an incident. Monitoring should alert on HA state changes, synchronization failures, interface errors, power events and resource pressure so that a degraded cluster does not remain unnoticed until a second fault occurs.

Virtual firewalls and segmentation at scale

Huawei publishes a maximum of 1,000 virtual firewalls for the USG6650E. Virtualization allows one physical appliance to provide separate administrative and policy contexts for different business units, tenants, environments or service zones. This is useful in data centers, managed-service environments and large enterprises where several teams need independent rules and resource boundaries without purchasing one physical firewall for every segment.

A virtual firewall strategy should begin with governance, not with the maximum number. Each virtual context adds policy, objects, routing, logging and lifecycle responsibilities. Ten well-structured virtual systems can be easier to operate than fifty poorly documented ones. Engineers should define naming, address ownership, administrator roles, logging destinations, change procedures and inter-context traffic rules before creating virtual instances. Shared services such as DNS, NTP, authentication and management must also be reachable in a controlled manner.

Resource planning is critical because virtual firewalls share the same physical forwarding and inspection capacity. A platform supporting many virtual contexts does not create additional throughput. If one tenant generates a traffic spike or a high rate of new sessions, the impact on other contexts must be understood. Where the software supports relevant resource controls, quotas and policy boundaries should be planned. Otherwise, operational monitoring needs to detect disproportionate consumption.

Segmentation can also be achieved without virtualization through zones, VLAN interfaces, routing instances and security policies. The choice depends on whether strict administrative separation is required. For example, separating production servers from users may only require zones and policies, while providing isolated security administration for multiple subsidiaries may justify virtual systems. The correct design balances isolation, visibility and operational complexity.

Routing, link selection and multi-ISP resilience

The USG6600E family supports enterprise routing features including RIP, OSPF, BGP, IS-IS and IPv6 variants documented by Huawei. This matters because a firewall deployed at a large network edge often participates directly in routing rather than sitting behind a separate router for every path. It may advertise public or private prefixes, learn internal routes, prefer one WAN for specific applications, or steer traffic between Internet, MPLS and private-cloud connections.

Multi-ISP designs need more than two default routes. Engineers must decide how outbound traffic chooses an egress, how inbound services remain reachable when a carrier fails, how NAT addresses change, whether public BGP is used, how DNS failover is handled and how sessions behave when the return path moves. Policy-based routing can direct specific applications or source groups, while intelligent uplink selection can consider link health and bandwidth-related factors. The final design should avoid accidental asymmetry where one direction of a session crosses a different firewall or policy context.

For private WANs and SD-WAN-adjacent environments, the firewall may enforce segmentation between branch routes, Internet breakout and cloud destinations. Dynamic routing inside encrypted tunnels can simplify branch expansion, but it also requires tight route filtering so that one branch cannot advertise unintended prefixes into the enterprise. Route maps, prefix lists and administrative boundaries should be documented as security controls rather than treated as purely network-engineering details.

IPv6 deserves equal planning. Huawei publishes distinct IPv6 performance values and supports IPv6 routing protocols. A dual-stack migration should include IPv6 security policies, neighbor-discovery considerations, logging, DNS, VPN behavior and address-management processes. Simply enabling IPv6 on interfaces while maintaining only IPv4 policy creates a visibility gap.

Logging, reporting and security operations integration

A high-performance firewall is only as operationally useful as the visibility it provides. The USG6600E family supports reporting across users, applications, content, time, traffic, threats and URLs. It also supports common management and integration mechanisms such as SNMP, SSH, Syslog, RESTful interfaces and NETCONF-related integration documented by Huawei. These capabilities allow the firewall to participate in a wider monitoring and security-operations architecture.

For SIEM integration, logging volume must be planned. A rulebase that logs the start and end of every connection in a high-traffic environment can generate a very different event rate from a policy that logs only denies and threat events. Security teams should decide which event classes are mandatory for investigations, how long logs must be retained, where they are stored, how timestamps are synchronized and what happens when the external collector is unavailable. NTP accuracy is essential because incident response often correlates firewall events with endpoint, cloud, identity and application logs.

Monitoring should include system health as well as security events. CPU, memory, session utilization, interface errors, drops, HA state, VPN tunnel status, license expiry, signature-update status and storage health are all operational indicators. Capacity alerts should trigger before hard limits are reached. A firewall consistently running near peak session or throughput capacity may continue forwarding, but it leaves insufficient headroom for attack spikes or failover events.

Change auditing is equally important. Enterprises should record who changed a policy, what changed, why it changed, the associated ticket or approval, and whether rollback was tested. Firewall rules accumulate quickly during projects and emergencies. Without periodic recertification, obsolete rules, expired NAT entries and temporary exemptions become permanent risk. A quarterly or semiannual rule review helps keep the policy aligned with actual application ownership.

FourTeck can coordinate firewall monitoring with broader infrastructure management through FourTeck UAE, including switching, servers, connectivity and support workflows, so that firewall alarms are interpreted in the context of the surrounding network rather than in isolation.

Licensing and subscription planning

Enterprise firewalls have two separate dimensions: hardware capability and licensed security services. The USG6650E can forward traffic without every optional subscription, but features such as signature updates, URL intelligence, antivirus updates, cloud sandbox services, additional virtual firewall capacity and higher SSL VPN user counts may depend on specific licenses. Procurement should therefore define the required operating state before requesting a quote. Buying only the appliance and discovering the subscription gap during commissioning is an avoidable project delay.

Huawei’s published ordering material lists USG6650E-specific one-year and three-year options for IPS updates, URL filtering updates, antivirus updates, combined threat-protection bundles, cloud sandbox inspection and a flow-probe function. It also lists scalable SSL VPN user licenses and virtual-system licenses. Availability, commercial packaging and current software entitlement can vary by region and time, so the final quotation should use currently orderable part numbers rather than treating an older datasheet as a live price list.

A security subscription also has an operational lifecycle. The renewal date should be recorded in asset management, with alerts well before expiry. Security teams should know what happens to each feature after subscription expiry: whether it stops, continues with an old database, or enters another state. This has direct risk implications because an IPS or antivirus engine without current intelligence may continue to appear enabled while protection quality degrades.

Support coverage should match business criticality. Organizations operating 24×7 services may need a different support and spares strategy from a branch office that can tolerate several hours of outage. Hardware replacement logistics, escalation paths, software entitlement, remote troubleshooting and local engineering availability should be clarified in the purchase. Where two firewalls form an HA pair, support entitlement should cover both serial numbers and the planned software lifecycle.

License design should also reflect growth. If remote-access usage is expected to increase from 500 to 2,000 concurrent users, the project can choose whether to license the expected final scale immediately or expand later. If virtual systems are being used for business-unit separation, estimate the three-year context count, not only the day-one number. A small amount of planned headroom is usually less disruptive than repeated emergency license procurement.

Sizing methodology for UAE enterprise environments

Correct firewall sizing begins with measured traffic, not user count. Two organizations with 2,000 employees can have radically different requirements if one primarily uses SaaS and email while the other runs video, cloud backups, public APIs and data replication. Start by collecting peak and average throughput for Internet, WAN, data-center and inter-zone paths. Use at least several weeks of monitoring so that month-end, backup windows, patch cycles and major business events are represented.

Next identify the inspection stack. Raw stateful firewall throughput is relevant only if traffic does not require higher-layer services. If IPS, antivirus, application control, URL filtering and SSL inspection are all expected, size against the closest protected-traffic benchmark and then validate with a realistic pilot. Huawei publishes 11 Gbit/s for full protection using its specified large-file test and 6 Gbit/s for an enterprise-mix scenario on the USG6650E. For many buyers, the 6 Gbit/s figure is a more cautious starting point than 40 Gbit/s raw IPv4 firewall throughput.

Add failover headroom. If two firewalls are deployed in HA and one must carry all traffic during maintenance or failure, one unit should support the full production demand. A design running each appliance near its individual limit during normal operation can become overloaded when the peer disappears. Growth headroom should also reflect contract terms for ISP circuits; enterprises often upgrade bandwidth during the useful life of a firewall without replacing the security platform immediately.

Then check session scale. Web browsing and modern microservices can produce very high concurrent and new-session rates even when bandwidth is moderate. Public e-commerce, DNS-heavy workloads, API gateways and NAT aggregation are examples. Compare measured session counts and connection rates with the published 12 million concurrent TCP sessions and 400,000 new TCP sessions per second, while leaving sufficient margin for bursts and attack conditions.

Finally, size interfaces and topology. A firewall capable of 30 Gbit/s encrypted throughput is not useful if the planned links provide insufficient aggregate bandwidth or use incompatible optics. Confirm all required 1G, 10G and 40G connections, LAGs, HA links and management ports. The result should be a sizing worksheet that ties every major requirement to a published capability, an engineering assumption or a test result.

In the UAE, circuit lead times and data-center change windows can be longer than the firewall procurement itself. Sizing should therefore be coordinated with ISP upgrades, switch-port availability, rack power and migration timing so that the security appliance is not waiting on unrelated infrastructure.

Deployment topologies where the USG6650E fits well

Migration from an existing firewall

A firewall replacement is rarely a simple configuration copy. Legacy rules often contain years of temporary exceptions, duplicated objects, expired NAT mappings and application definitions based only on ports. Migrating all of that without review reproduces old risk on a new platform. The project should first inventory interfaces, VLANs, routes, NAT, policies, VPNs, certificates, identity dependencies, logging and management services. Each item needs an owner and business justification where possible.

Rule conversion should normalize naming and remove obvious duplication. Objects should use clear conventions that identify location, function and environment. Broad any-to-any rules deserve special review. Where the new platform supports application-aware enforcement, the migration can initially preserve service behavior and then tighten policy after visibility has been established. Trying to redesign every rule and replace the hardware in one change window increases risk.

NAT requires careful mapping because published services may depend on DNS records, external monitoring, third-party allowlists and certificates. A change in public IP address can affect suppliers and partners long after the firewall itself is working. Site-to-site VPNs create similar coordination challenges because the remote peer may be controlled by another organization. Pre-sharing new keys, adding secondary peers or using parallel tunnels can reduce cutover pressure.

Testing should cover more than web browsing. Validate DNS, DHCP relay if used, directory authentication, email flow, voice, cloud services, file transfer, remote access, public applications, partner VPNs, monitoring, logging and administrative access. Critical applications should have named owners available during the change. A rollback threshold and decision time must be agreed in advance so the team does not improvise under outage pressure.

After migration, run a stabilization period. Watch session counts, CPU, memory, interface errors, policy hits, threat logs and user reports. Unused rules should not be removed immediately unless clearly obsolete; first confirm that they do not serve low-frequency business processes such as monthly finance tasks. A clean post-migration review turns the new firewall into a controlled baseline rather than the next layer in a sequence of unmanaged changes.

Operations, hardening and lifecycle management

Firewall security is continuous. The initial deployment establishes a baseline, but software updates, threat-intelligence subscriptions, certificates, user accounts and policies all change over time. A production USG6650E should therefore be managed through a defined lifecycle. Administrative access should be restricted to dedicated management networks, strong authentication should be used, unused services should be disabled and configuration backups should be stored securely outside the appliance.

Software upgrades need planned testing. Security appliances often sit in complex topologies with VPN peers, routing protocols and inspection profiles, so upgrade impact extends beyond the chassis. Review release notes for behavior changes, deprecated features, minimum version dependencies and known issues. In HA deployments, validate the supported upgrade method and expected failover behavior. A maintenance window should include pre-checks, backups, health verification and rollback criteria.

Signature and category updates should be monitored just like software. If IPS, antivirus or URL updates stop downloading, the firewall may remain online while its protection data becomes stale. Alerting should identify failed updates and approaching subscription expiry. Security operations should also review false positives and false negatives; a profile that blocks legitimate applications will eventually be bypassed, while one that is tuned too loosely provides little value.

Administrator roles should be separated where organizational policy requires it. Network teams may need interface and routing access, security teams may manage policies, and auditors may require read-only visibility. Shared administrator accounts reduce accountability and should be avoided. Every significant change should map to an individual identity and, ideally, a ticket or approval record.

Lifecycle planning includes end-of-sale and end-of-support awareness. The USG6650E is part of a mature product family, so purchasers should confirm current commercial status, supported software train, subscription availability and replacement roadmap at quote time. This is especially important for new long-term projects where the expected service life may extend several years. A technically suitable firewall is only a good purchase when its support horizon aligns with the organization’s investment timeline.

UAE procurement and implementation considerations

Enterprise firewall procurement in the UAE involves more than selecting a model from a datasheet. The project must align hardware, subscriptions, support, optics, rack power, cabling, software version, configuration services and acceptance testing. Where equipment is deployed in a colocation facility, access procedures and remote-hands requirements may influence the installation plan. If the firewall connects to carrier services, circuit handoff types and demarcation details should be confirmed before dispatching engineers.

Power design should reflect the site’s resilience target. Huawei documents 100–240 V AC options for the family and dual-power configurations across models. The exact ordered USG6650E power arrangement must be confirmed against the active bill of materials. In an HA pair, each firewall should ideally connect to independent A/B power paths when the facility supports them. Plug type, PDU outlet, cable length and rack location can otherwise become surprisingly practical blockers during deployment.

Optics should be quoted by link, not as a generic accessory. Each fiber connection needs compatible transceivers at both ends, correct fiber mode, connector type and reach. A 10GE SFP+ link to a switch may use SR, LR, DAC or another supported option depending on distance and cabling. A 40GE QSFP+ connection raises similar questions. Spare optics are often justified for critical facilities because a failed transceiver can take down a redundant path even when the firewall itself remains healthy.

Professional services scope should state who owns IP addressing, routing changes, switch configuration, ISP coordination, DNS, certificate distribution, endpoint trust, policy review and application testing. A firewall engineer cannot validate an ERP workflow without participation from the application owner. Clear responsibility matrices reduce change-window delays and prevent tasks from falling between teams.

FourTeck can provide an integrated UAE quotation covering the USG6650E platform, required subscriptions, optics, implementation and post-cutover support. Commercial availability, lead time and current part numbers should be confirmed at the time of inquiry because vendor packaging and regional stock can change.

Technical specification summary

Performance values are vendor-published laboratory figures and should be validated against the intended software version, license set, traffic profile and deployment topology. Product ordering and regional commercial availability should be confirmed at quotation stage.

Frequently asked engineering questions

Decision recap: when the USG6650E is a strong technical fit

The Huawei HiSecEngine USG6650E is best considered when the project requires substantially more than a small branch firewall: multi-gigabit protected throughput, very large session tables, high new-connection rates, 10G/40G connectivity, large IPsec scale, virtualized policy domains and resilient enterprise deployment. Its strongest use cases are headquarters Internet edges, data-center borders, branch VPN aggregation and shared security gateways where one platform must combine routing, security inspection and segmentation.

The most important buying decision is not whether the raw 40 Gbit/s firewall figure appears large enough. It is whether the protected throughput, SSL inspection capacity, VPN performance, interface layout, license model and support lifecycle match the actual production design. A network with 4 Gbit/s peak traffic and heavy inspection may have more practical demand than a 10 Gbit/s network that mostly forwards trusted private traffic. Likewise, an organization with 1,000 remote workers may be more constrained by authentication, endpoint compatibility and user licensing than by the firewall’s raw packet engine.

A correct selection therefore combines vendor specifications with measured traffic, a three-to-five-year growth forecast, failure-domain design and a documented feature matrix. When those inputs are available, the USG6650E can be evaluated objectively against current capacity and operational requirements.