topic Re: what makes firewall performance down in Firewall and Security Management

what makes firewall performance down

Roshan_Sinha — Tue, 17 Aug 2021 11:25:35 GMT

Hi Team,

this is just for general information, that from below, what makes firewall performance degrade, and what will be best practice to configure firewall rules:

> Configuring specific /32 source host IP and specific /32 host destination IP or

> Configuring specific server subnet /24 as source and /32 as destination.

Re: what makes firewall performance down

Timothy_Hall — Tue, 17 Aug 2021 12:16:44 GMT

Short Answer: I don't think it will make a meaningful difference in performance.

Long Answer: I assume you would need multiple instances of the first /32 /32 rule as compared to the second rule, which would increase the size of your rulebase. Normally you'd want the rulebase to be as short as possible for optimization purposes, but performance-wise this doesn't matter nearly as much as it used to due to the introduction of column-based matching in R80.10. Technically it would be best to keep your destination columns as specific as possible (especially trying to avoid using "Any" in that field), as column-based matching looks at the Destination column in the first round of matching, and can "throw out" many more non-matching rules in that first round if the Destination columns are as specific as possible, and have far fewer rules to look at during round 2 (source IP) and round 3 (destination port).

Re: what makes firewall performance down

_Val_ — Tue, 17 Aug 2021 12:38:43 GMT

adding to @Timothy_Hall , having less rules is always better from the performance perspective. For a single rule, it does not matter if you use a subnet, a group of host objects or just list all those hosts in the rule. That said, you also need to consider your own administrative effort to build this rule.