How to Optimize Your Firewalls for Maximum Performance

By Reuven Harrison  |  Posted 2010-02-23 Print this article Print

Are your firewalls overloaded? Symptoms of overloaded firewalls include high CPU, low throughput and slow applications. Before upgrading your hardware, it is worth checking whether or not your firewall configuration can be optimized. Here, Knowledge Center contributor Reuven Harrison gives firewall administrators some best practices for optimizing firewalls for maximum performance and throughput.

Configuration optimization techniques for firewalls can be divided into two groups: general best practices and vendor-specific, model-specific configurations. This article will focus on best practices. The following are eleven best practices for firewall administrators to use to optimize firewalls for better performance and throughput.

Best practice No. 1: Ensure outbound traffic is compliant with policies

Remove bad traffic and clean up the network. Bad traffic includes non-compliant, unauthorized or undesired traffic. Notify server administrators about servers hitting the firewall directly with outbound denied Domain Name System (DNS), NTP, SMTP, HTTP and HTTP Secure (HTTPS) requests, as well as dropped/rejected internal devices. The administrators should then reconfigure the servers not to send this type of unauthorized outbound traffic (thereby taking load off the firewall).

Best practice No. 2: Filter unwanted traffic on the router(s) instead of the firewall

Move the filtering rules for unwanted inbound traffic from the firewall to the edge router(s) to balance the performance and effectiveness of the security policy. To do this, first identify the top inbound dropped requests that are candidates to move upstream to the router as Standard Access Control List (ACL) filters. This can be a time-consuming process but it is a good method for moving blocks upstream to the router, thus saving firewall CPU and memory.

Then, if you have an internal choke router between your network and firewall, consider moving common outbound traffic blocks to your choke routers. This will free more processing on your firewall.

Best practice No. 3: Remove unused rules and objects

Remove unused rules and objects from the rule bases. While cleaning up an unwieldy rule base might sound like a daunting task, there are a variety of automated tools available that can assist with rule cleanup. These automated tools make firewall policy management a much more manageable endeavor.

Best practice No. 4: Reduce rule base complexity

Reduce rule base complexity and rule overlapping should be minimized. Again, there are tools available that can dramatically reduce the time and headache involved in cleaning up and simplifying the rule base.

Reuven Harrison Reuven Harrison is CTO at Tufin Technologies. Reuven co-founded Tufin in 2003, serving as CTO during the company's fast-paced growth. Responsible for Tufin's flagship product, Reuven leads Tufin's development staff, managing all product architecture. Reuven brings more than 17 years of software development experience, holding two key senior developer positions at Check Point Software, as well other key positions at Capsule Technologies and ECS. He received a Bachelor's degree in Mathematics and Philosophy from Tel Aviv University. He can be reached at

Submit a Comment

Loading Comments...
Manage your Newsletters: Login   Register My Newsletters

Rocket Fuel