Impact of rulebase size on gateway performance

[Frederic_Mereu1]

Good afternoon,

I'm currently working on a gateway with ~300 rules, trying to follow most of the rulebase best practices (most used rules at the top, grouping similar rules together, ..).

Besides this, I'm looking into automating the ruleset, and I was wondering what would be the performance impact to create one rule per "source, destination, service" tuple -- i.e. not allowing multiple sources, destinations or services in the same rule entry.

For example, the following rule:

source: clients_external, clients_internal, destination: servers, service: https, dns

Would translate into 4 rules:

source: clients_external, destination: servers, service: https
source: clients_external, destination: servers, service: dns
source: clients_internal, destination: servers, service: https
source: clients_internal, destination: servers, service: dns

From an automation point of view, this seems easier to manage. For example, if the "clients_external" group needs to be deleted, we can delete all the rules where it is found, without impacting other flows.
Also, if the service for those clients needs to be replaced, it can be done directly as it won't affect any other client.

My main concern here is the performance of the gateway. A rulebase with 300 rules could easily expand to 2k rules, so there's a risk. I'm wondering if the SmartCenter is doing some kind of optimization while it's installing the policy on the gateways..

Does anyone have an idea? Or maybe tested this in a lab?

Thanks in advance,
Frederic.

[Nick_Doropoulos]

Hi Frederic,

You are right to be concerned with a potentially dramatic increase in the number of firewall rules as that will ultimately lead to more rule-base lookups and degraded performance. To avoid going down that path, I would urge that you tweak your automation tool as much as possible to avoid creating extra rules without a need. For example, the following rules...

source: clients_external, destination: servers, service: https
source: clients_external, destination: servers, service: dns
source: clients_internal, destination: servers, service: https
source: clients_internal, destination: servers, service: dns

should be two rules:

source: clients_external, destination: servers, service: dns, https
source: clients_internal, destination: servers, service: https, dns

If it is an R80.x firewall you are working on, make use of inline and ordered layers as wisely as possible and ensure that you avoid the use of "any" in the source and destination columns as much as possible.

I hope this helps.

[PhoneBoy]

I would also be concerned about the time it takes to compile the policy when you have thousands of rules, not to mention viewing it in SmartConsole.

[HeikoAnkenbrand · Accepted solution]

Hi @Frederic_Mereu1 

Here are rulebase optimization tips:

- Refer to  R80.x - Security Gateway Architecture (Logical Packet Flow) to allow more connections to be accelerated by SecureXL "Fast Path" or "Medium Path".
- Place most used rules at the top - use the Hit Count in the SmartDashboard 
- Reduce the number of rules.
- Use optimized  inline layer rules / policys (it is faster:-)
- Optimize Unified Policy. You can easily create access policies which combine capabilities of blades such as traditional FireWall, Application Control, Content Awareness, Mobile Access and more.
- Reduce internal Threat Prevention traffic.
- and and and

More for performance tuning read here:

- R80.x - Top 20 Gateway Tuning Tips 
- R80.x Architecture and Performance Tuning - Link Collection
- Performance Tuning R80.10 Administratio Guide
- Performance Tuning R80.20 Administration Guide
- Performance Tuning R80.30 Administration Guide
- Best Practices - Security Gateway Performance 

My personal opinion:

With more than 1000 rules you should think about the concept and simplify and minimize rules. Nobody will understand the ruleset anyway. 

[Zoltan_Polowsky]

I would like a SK over R80 rulebase optimization from Check Point.

[HeikoAnkenbrand]

👍

[PhoneBoy]

There's a section in the R80.30 Next Generation Security Gateway Guide called Best Practices for Access Control Rules that covers this exact topic.
https://sc1.checkpoint.com/documents/R80.30/WebAdminGuides/EN/CP_R80.30_NextGenSecurityGateway_Guide...

[Shannon_Diotte]

I'm curious what the thoughts are on performance impact with the R80 column-based rule matching architecture.  I didn't see any reference to it when talking about a large rulebase and performance.