When speaking about the DDoS protection, I can understand that it is massively dependent on the filter capacity.
When building your own DDoS protection, it is dependent on the amount of traffic you can filter, and if DDoS attack exceeds that limit, there's no other possibility to filter other traffic and it will reach back-end and therefore make back-end unavailable.
But how is this filter capacity increased? If for example I go and buy Firepower 9300 and connect it to my network before my router and therefore back-end, or exchange my router with this firewall, as it says it has 1.2 Tbps clustered throughput, does it mean I will be able to filter 1.2 Tbps of DDoS traffic potentially and block up to 1.2 Tbps size of DDoS attack? Or to filter more traffic I will need exactly to call my provider and ask for an increase in bandwidth of my internet uplink and that will be the maximum traffic I can handle?