topic Does heavy hit rule position still matter on performance? in Firewall and Security Management

Does heavy hit rule position still matter on performance?

Jin_Zhou — Tue, 22 Feb 2022 15:36:18 GMT

I need to move some heavy hit rules from top to bottom and wonder if this will affect gateway performance on modern firewalls such Checkpoint. Thanks.

Re: Does heavy hit rule position still matter on performance?

the_rock — Tue, 22 Feb 2022 15:39:19 GMT

I will let others give their feedback, but personally, I only found that to matter in pre R80 versions.

Re: Does heavy hit rule position still matter on performance?

G_W_Albrecht — Tue, 22 Feb 2022 15:43:49 GMT

Adjusting rule position will not change fw performance anymore - but you are able to identify unmatched rules that can be disabled after some time to lower the number of rules.

Re: Does heavy hit rule position still matter on performance?

Timothy_Hall — Tue, 22 Feb 2022 16:05:56 GMT

In gateway versions R80.10 and later, it won't make a difference. The relevant new feature is Column-based Matching which is enabled by default. Not strictly necessary, but if you can limit as much as possible using "Any" in the Destination column of your rules it will help maximize the gains provided by this feature: Unified Policy Column-based Rule Matching.

Re: Does heavy hit rule position still matter on performance?

K_montalvo — Tue, 22 Feb 2022 16:19:27 GMT

Excellent recommendation!

Re: Does heavy hit rule position still matter on performance?

_Val_ — Wed, 23 Feb 2022 08:27:35 GMT

@Timothy_Hall with all due respect, I would rather say, it won't make much of a difference.

Moving a heavily used rule down in the policy will actually require more CPU cycles to match. It is just with R8x family, it requires much less efforts than with R7x. There still be minor performance drag, depending on how big is the policy.

Saying it will not matter at all is not 100% correct 🙂

Re: Does heavy hit rule position still matter on performance?

Timothy_Hall — Wed, 23 Feb 2022 13:23:45 GMT

In my experience moving rules around even in very large policies does not make a measurable difference in CPU use in R80.10+. But I would agree the difference is not zero, and in the real world probably not worth the administrator's time to analyze and move rules around for this form of optimization.

Re: Does heavy hit rule position still matter on performance?

the_rock — Wed, 23 Feb 2022 13:30:07 GMT

I agree with both of you @Timothy_Hall and @_Val_ . In my experience as well, difference is so minor, that it might not be worth spending too much time on it...

Re: Does heavy hit rule position still matter on performance?

Chris_Atkinson — Thu, 24 Feb 2022 01:09:23 GMT

sk32578 talks to some version specific edge cases (mostly historic) as the others have alluded to but generally speaking you should be fine.