what makes firewall performance down

[Roshan_Sinha]

Hi Team,

this is just for general information, that from below, what makes firewall performance degrade, and what will be best practice to configure firewall rules:

> Configuring specific /32 source host IP and specific /32 host destination IP  or 

> Configuring specific server subnet /24  as source and /32 as destination.

[Timothy_Hall]

Short Answer: I don't think it will make a meaningful difference in performance.

Long Answer: I assume you would need multiple instances of the first /32 /32 rule as compared to the second rule, which would increase the size of your rulebase.  Normally you'd want the rulebase to be as short as possible for optimization purposes, but performance-wise this doesn't matter nearly as much as it used to due to the introduction of column-based matching in R80.10.  Technically it would be best to keep your destination columns as specific as possible (especially trying to avoid using "Any" in that field), as column-based matching looks at the Destination column in the first round of matching, and can "throw out" many more non-matching rules in that first round if the Destination columns are as specific as possible, and have far fewer rules to look at during round 2 (source IP) and round 3 (destination port).

[_Val_]

adding to @Timothy_Hall , having less rules is always better from the performance perspective. For a single rule, it does not matter if you use a subnet, a group of host objects or just list all those hosts in the rule. That said, you also need to consider your own administrative effort to build this rule.