Handle Broadcast Traffic
Best practice No. 5: Handle broadcast traffic
If the firewall interface is directly connected to the LAN segment, you should create a rule to handle broadcast traffic (bootp, NetBIOS over TCP/IP, etc.) with no logging.
Best practice No. 6: Place the heavily used rules near the top of the rule base
Place the heavily used rules near the top of the rule base. Note that some firewalls (such as Cisco Pix, ASA version 7.0 and above, FWSM 4.0, and certain Juniper Networks models) don't depend on rule order for performance since they use optimized algorithms to match packets.
Best practice No. 7: Avoid DNS objects
Avoid objects requiring DNS lookups.
Best practice No. 8: Firewall interface settings should match switch and router settings
Your firewall interfaces should match your router and/or switch interfaces. If your router or switch is 100M bps half-duplex, your firewall should be 100M bps half-duplex. Your interfaces should be hard set to match; both should most likely be 100M bps full-duplex.
Your router/switch and firewall should both report the same speed and duplex mode. If your switch and firewall are both Gigabit Ethernet, they should both be set to auto-negotiate the speed and duplex. If your Gigabit interfaces do not match between your firewall and switch, you should try replacing the cables and patch panel ports. Gigabit interfaces that are not linking at 1000M bps full-duplex are almost always a sign of other issues.
Best practice No. 9: Separate firewalls from VPNs
Separate firewalls from VPNs to offload VPN traffic and processing.
Best practice No. 10: Offload features from the firewall
Offload Unified Threat Management (UTM) features from the firewall including: antivirus, antispam, intrusion prevention system (IPS), and URL scanning.
Best practice No. 11: Upgrade to the latest software version
Upgrade to the latest software version. As a rule of thumb, newer versions contain performance enhancements but also add new capabilities-so a performance gain is not guaranteed.
Reuven Harrison is CTO at Tufin Technologies. Reuven co-founded Tufin in 2003, serving as CTO during the company's fast-paced growth. Responsible for Tufin's flagship product, Reuven leads Tufin's development staff, managing all product architecture. Reuven brings more than 17 years of software development experience, holding two key senior developer positions at Check Point Software, as well other key positions at Capsule Technologies and ECS. He received a Bachelor's degree in Mathematics and Philosophy from Tel Aviv University. He can be reached at firstname.lastname@example.org.