Create a Post
cancel
Showing results for 
Search instead for 
Did you mean: 
Roshan_Sinha
Explorer

what makes firewall performance down

Hi Team,

this is just for general information, that from below, what makes firewall performance degrade, and what will be best practice to configure firewall rules:

> Configuring specific /32 source host IP and specific /32 host destination IP  or 

> Configuring specific server subnet /24  as source and /32 as destination.

 

 

 

0 Kudos
2 Replies
Timothy_Hall
Champion
Champion

Short Answer: I don't think it will make a meaningful difference in performance.

Long Answer: I assume you would need multiple instances of the first /32 /32 rule as compared to the second rule, which would increase the size of your rulebase.  Normally you'd want the rulebase to be as short as possible for optimization purposes, but performance-wise this doesn't matter nearly as much as it used to due to the introduction of column-based matching in R80.10.  Technically it would be best to keep your destination columns as specific as possible (especially trying to avoid using "Any" in that field), as column-based matching looks at the Destination column in the first round of matching, and can "throw out" many more non-matching rules in that first round if the Destination columns are as specific as possible, and have far fewer rules to look at during round 2 (source IP) and round 3 (destination port).

New 2021 IPS/AV/ABOT Self-Guided Video Series
now available at http://www.maxpowerfirewalls.com
0 Kudos
_Val_
Admin
Admin

adding to @Timothy_Hall , having less rules is always better from the performance perspective. For a single rule, it does not matter if you use a subnet, a group of host objects or just list all those hosts in the rule. That said, you also need to consider your own administrative effort to build this rule.

0 Kudos