cancel
Showing results for 
Search instead for 
Did you mean: 
Create a Post
Highlighted
Tom_Cripps
Silver

Inline Layers vs Ordered Layers - Who's more efficient

Hi,

Recent discussion here at the office, what is more efficient in regards to Layers. Is it better to more rules within a single layer, or use ordered layers to achieve the same goal.

@Tomer_Sole do you have anything to add?

0 Kudos
16 Replies

Re: Inline Layers vs Ordered Layers - Who's more efficient

I would assume that this largely depends on the production environment, type and amount of traffic and used blades...

0 Kudos
Admin
Admin

Re: Inline Layers vs Ordered Layers - Who's more efficient

I don't know that it makes much of a difference performance-wise.
What would be the reason for using multiple ordered layers?
0 Kudos

Re: Inline Layers vs Ordered Layers - Who's more efficient

To simplify and make huge policies more readable?
When large policies are setup more like zone based policies you can build a policy that is a lot simpler to look at when you can drill down into the layers where specific DMZ's are completely taken care of, in and outbound.
Regards, Maarten
0 Kudos
Admin
Admin

Re: Inline Layers vs Ordered Layers - Who's more efficient

I could see inline layers being used to create zone-based policies.
Not sure how that would work with ordered layers.
0 Kudos
Tom_Cripps
Silver

Re: Inline Layers vs Ordered Layers - Who's more efficient

Hi Daemon,

We currently have an inline layer with two rules at the end of it currently serving as a catch all. My plan was to either include within the layer which is accepted then have a final clean up rule with Deny all of other traffic, or make the catch all go to another and within there I then govern access. 

Make sense?

0 Kudos
Admin
Admin

Re: Inline Layers vs Ordered Layers - Who's more efficient

Keep in mind if you use Ordered Layers, the traffic must hit an Accept rule in EACH ordered layer.
For the use case you describe, I'm not seeing where Ordered Layers makes sense.
0 Kudos
Tom_Cripps
Silver

Re: Inline Layers vs Ordered Layers - Who's more efficient

I see to have been confused with descriptions, see my later comment. A layer within a layer is still an inline layer, that I wasn't aware of.

0 Kudos
Employee+
Employee+

Re: Inline Layers vs Ordered Layers - Who's more efficient

Inline layers are the beauty of R80.x, one of the many new features why it's better than previous versions. With ordered layers there is not much change to the earlier behavior in R77.x where you had separate firewall and application control policies.

With inline layers you can simplify complex unified policies by segmenting them into separate sub-policies. Use security zones in parent rules.

So, to answer your question inline layers are much more efficient way of creating policies. By efficiency I don't mean only the CPU power, but the simplified way building your security policies.

0 Kudos
Tom_Cripps
Silver

Re: Inline Layers vs Ordered Layers - Who's more efficient

Is a layer within an Inline layer classed as an Inline layer still?

0 Kudos
phlrnnr
Silver

Re: Inline Layers vs Ordered Layers - Who's more efficient

Yes, an inline layer within an inline layer is also an inline layer.

(Say that 3 times fast)

Tom_Cripps
Silver

Re: Inline Layers vs Ordered Layers - Who's more efficient

Ah, that's where I'm getting confused then.

0 Kudos
phlrnnr
Silver

Re: Inline Layers vs Ordered Layers - Who's more efficient

It is my understanding that once traffic matches an inline layer, you will never leave that inline layer.  You will either match a rule in the layer, or be dropped / accepted by the Cleanup rule at the bottom of the inline layer.  However, you can match a generic inline layer (eg. All traffic to the Internet) and then match another (more specific) inline layer that is inside of the generic one (eg. Authenticated users to the Internet).  However, the same rules apply.  You cannot leave the inline layer -- you must match a rule in that layer, or get dropped/accepted by the Cleanup rule at the bottom of the layer.

I hope that helps!

Re: Inline Layers vs Ordered Layers - Who's more efficient

I guess that I misunderstood the meaning of ordered layers.

The performance impact is huge, the following graphic is from a customer where we migrated ordered layers from Access and Application control to Inline layers with Access + Application control.

Active blades: IPS, AV, AB, URLF, AppCtrl, HTTPS Inspection / Distributed deployment - Cluster of x2 5600 appliances with R80.10

Blue is memory usage, I guess that you can clearly see the before/after.

WhatsApp Image 2019-10-04 at 12.20.09.jpeg

 

https://www.linkedin.com/in/federicomeiners/
phlrnnr
Silver

Re: Inline Layers vs Ordered Layers - Who's more efficient

That looks like a memory leak being reset at time of reboot 😀

0 Kudos

Re: Inline Layers vs Ordered Layers - Who's more efficient

Indeed but it isn't 🤣 I can assure you that memory consumption has lowered like 50% average.

https://www.linkedin.com/in/federicomeiners/
0 Kudos

Re: Inline Layers vs Ordered Layers - Who's more efficient

The reduction in memory usage shown on the graph was due to a reboot, not ordered vs. inline layers.  Notice the small gap in the graph lines just before the big drop, that was while the system was rebooting and until the first set of graph data was written.  This drop in memory usage is typical after a reboot since the longer a system is up, the more memory is utilized for buffering/caching of disk operations (up to a certain point that will not adversely impact the system of course).   A reboot starts the memory used for buffering/caching back at a low value and it slowly grows again.

As stated in my Max Power book, I don't see a huge difference in ordered vs. inline layers as far as rulebase lookup overhead on the firewall in the F2F path (R80.10 and earlier) or the F2V path (R80.20+).  It is on my to-do list to take a closer look at this in near future and try to quantify the difference a bit more.  Inline layers can most definitely be easier to manage than ordered layers, and consume less of an administrator's time trying to find and modify rules in day-to-day operations.

 

"IPS Immersion Training" Self-paced Video Class
Now Available at http://www.maxpowerfirewalls.com