We have a limited type of user so scalability is not so relevant and it's difficult to quantify. We have 1,500 internal users but I have no idea how many external users we have. 

Symantec WAF is a scalable solution, although we do not have requirements for scalability. It is possible to just add a box and add capacity, as needed.