Create a Post
cancel
Showing results for 
Search instead for 
Did you mean: 
Tom_Cripps
Advisor

Inline Layers vs Ordered Layers - Who's more efficient

Hi,

Recent discussion here at the office, what is more efficient in regards to Layers. Is it better to more rules within a single layer, or use ordered layers to achieve the same goal.

@Tomer_Sole do you have anything to add?

0 Kudos
16 Replies
G_W_Albrecht
Legend
Legend

I would assume that this largely depends on the production environment, type and amount of traffic and used blades...

CCSE CCTE CCSM SMB Specialist
0 Kudos
PhoneBoy
Admin
Admin

I don't know that it makes much of a difference performance-wise.
What would be the reason for using multiple ordered layers?
0 Kudos
Maarten_Sjouw
Champion
Champion

To simplify and make huge policies more readable?
When large policies are setup more like zone based policies you can build a policy that is a lot simpler to look at when you can drill down into the layers where specific DMZ's are completely taken care of, in and outbound.
Regards, Maarten
0 Kudos
PhoneBoy
Admin
Admin

I could see inline layers being used to create zone-based policies.
Not sure how that would work with ordered layers.
0 Kudos
Tom_Cripps
Advisor

Hi Daemon,

We currently have an inline layer with two rules at the end of it currently serving as a catch all. My plan was to either include within the layer which is accepted then have a final clean up rule with Deny all of other traffic, or make the catch all go to another and within there I then govern access. 

Make sense?

0 Kudos
PhoneBoy
Admin
Admin

Keep in mind if you use Ordered Layers, the traffic must hit an Accept rule in EACH ordered layer.
For the use case you describe, I'm not seeing where Ordered Layers makes sense.
Tom_Cripps
Advisor

I see to have been confused with descriptions, see my later comment. A layer within a layer is still an inline layer, that I wasn't aware of.

0 Kudos
Lari_Luoma
Ambassador Ambassador
Ambassador

Inline layers are the beauty of R80.x, one of the many new features why it's better than previous versions. With ordered layers there is not much change to the earlier behavior in R77.x where you had separate firewall and application control policies.

With inline layers you can simplify complex unified policies by segmenting them into separate sub-policies. Use security zones in parent rules.

So, to answer your question inline layers are much more efficient way of creating policies. By efficiency I don't mean only the CPU power, but the simplified way building your security policies.

0 Kudos
Tom_Cripps
Advisor

Is a layer within an Inline layer classed as an Inline layer still?

0 Kudos
phlrnnr
Advisor

Yes, an inline layer within an inline layer is also an inline layer.

(Say that 3 times fast)

Tom_Cripps
Advisor

Ah, that's where I'm getting confused then.

0 Kudos
phlrnnr
Advisor

It is my understanding that once traffic matches an inline layer, you will never leave that inline layer.  You will either match a rule in the layer, or be dropped / accepted by the Cleanup rule at the bottom of the inline layer.  However, you can match a generic inline layer (eg. All traffic to the Internet) and then match another (more specific) inline layer that is inside of the generic one (eg. Authenticated users to the Internet).  However, the same rules apply.  You cannot leave the inline layer -- you must match a rule in that layer, or get dropped/accepted by the Cleanup rule at the bottom of the layer.

I hope that helps!

FedericoMeiners
Advisor

I guess that I misunderstood the meaning of ordered layers.

The performance impact is huge, the following graphic is from a customer where we migrated ordered layers from Access and Application control to Inline layers with Access + Application control.

Active blades: IPS, AV, AB, URLF, AppCtrl, HTTPS Inspection / Distributed deployment - Cluster of x2 5600 appliances with R80.10

Blue is memory usage, I guess that you can clearly see the before/after.

WhatsApp Image 2019-10-04 at 12.20.09.jpeg

 

____________
https://www.linkedin.com/in/federicomeiners/
phlrnnr
Advisor

That looks like a memory leak being reset at time of reboot 😀

0 Kudos
FedericoMeiners
Advisor

Indeed but it isn't 🤣 I can assure you that memory consumption has lowered like 50% average.

____________
https://www.linkedin.com/in/federicomeiners/
0 Kudos
Timothy_Hall
Champion
Champion

The reduction in memory usage shown on the graph was due to a reboot, not ordered vs. inline layers.  Notice the small gap in the graph lines just before the big drop, that was while the system was rebooting and until the first set of graph data was written.  This drop in memory usage is typical after a reboot since the longer a system is up, the more memory is utilized for buffering/caching of disk operations (up to a certain point that will not adversely impact the system of course).   A reboot starts the memory used for buffering/caching back at a low value and it slowly grows again.

As stated in my Max Power book, I don't see a huge difference in ordered vs. inline layers as far as rulebase lookup overhead on the firewall in the F2F path (R80.10 and earlier) or the F2V path (R80.20+).  It is on my to-do list to take a closer look at this in near future and try to quantify the difference a bit more.  Inline layers can most definitely be easier to manage than ordered layers, and consume less of an administrator's time trying to find and modify rules in day-to-day operations.

 

Gateway Performance Optimization R81.20 Course
now available at maxpowerfirewalls.com

Leaderboard

Epsum factorial non deposit quid pro quo hic escorol.

Upcoming Events

    CheckMates Events