Close
  • Latest News
  • Artificial Intelligence
  • Video
  • Big Data and Analytics
  • Cloud
  • Networking
  • Cybersecurity
  • Applications
  • IT Management
  • Storage
  • Sponsored
  • Mobile
  • Small Business
  • Development
  • Database
  • Servers
  • Android
  • Apple
  • Innovation
  • Blogs
  • PC Hardware
  • Reviews
  • Search Engines
  • Virtualization
Read Down
Sign in
Close
Welcome!Log into your account
Forgot your password?
Read Down
Password recovery
Recover your password
Close
Search
Logo
Logo
  • Latest News
  • Artificial Intelligence
  • Video
  • Big Data and Analytics
  • Cloud
  • Networking
  • Cybersecurity
  • Applications
  • IT Management
  • Storage
  • Sponsored
  • Mobile
  • Small Business
  • Development
  • Database
  • Servers
  • Android
  • Apple
  • Innovation
  • Blogs
  • PC Hardware
  • Reviews
  • Search Engines
  • Virtualization
More
    Home Cybersecurity
    • Cybersecurity
    • Networking

    How to Optimize Your Firewalls for Maximum Performance

    Written by

    Reuven Harrison
    Published February 23, 2010
    Share
    Facebook
    Twitter
    Linkedin

      eWEEK content and product recommendations are editorially independent. We may make money when you click on links to our partners. Learn More.

      Configuration optimization techniques for firewalls can be divided into two groups: general best practices and vendor-specific, model-specific configurations. This article will focus on best practices. The following are eleven best practices for firewall administrators to use to optimize firewalls for better performance and throughput.

      Best practice No. 1: Ensure outbound traffic is compliant with policies

      Remove bad traffic and clean up the network. Bad traffic includes non-compliant, unauthorized or undesired traffic. Notify server administrators about servers hitting the firewall directly with outbound denied Domain Name System (DNS), NTP, SMTP, HTTP and HTTP Secure (HTTPS) requests, as well as dropped/rejected internal devices. The administrators should then reconfigure the servers not to send this type of unauthorized outbound traffic (thereby taking load off the firewall).

      Best practice No. 2: Filter unwanted traffic on the router(s) instead of the firewall

      Move the filtering rules for unwanted inbound traffic from the firewall to the edge router(s) to balance the performance and effectiveness of the security policy. To do this, first identify the top inbound dropped requests that are candidates to move upstream to the router as Standard Access Control List (ACL) filters. This can be a time-consuming process but it is a good method for moving blocks upstream to the router, thus saving firewall CPU and memory.

      Then, if you have an internal choke router between your network and firewall, consider moving common outbound traffic blocks to your choke routers. This will free more processing on your firewall.

      Best practice No. 3: Remove unused rules and objects

      Remove unused rules and objects from the rule bases. While cleaning up an unwieldy rule base might sound like a daunting task, there are a variety of automated tools available that can assist with rule cleanup. These automated tools make firewall policy management a much more manageable endeavor.

      Best practice No. 4: Reduce rule base complexity

      Reduce rule base complexity and rule overlapping should be minimized. Again, there are tools available that can dramatically reduce the time and headache involved in cleaning up and simplifying the rule base.

      Handle Broadcast Traffic

      Best practice No. 5: Handle broadcast traffic

      If the firewall interface is directly connected to the LAN segment, you should create a rule to handle broadcast traffic (bootp, NetBIOS over TCP/IP, etc.) with no logging.

      Best practice No. 6: Place the heavily used rules near the top of the rule base

      Place the heavily used rules near the top of the rule base. Note that some firewalls (such as Cisco Pix, ASA version 7.0 and above, FWSM 4.0, and certain Juniper Networks models) don’t depend on rule order for performance since they use optimized algorithms to match packets.

      Best practice No. 7: Avoid DNS objects

      Avoid objects requiring DNS lookups.

      Best practice No. 8: Firewall interface settings should match switch and router settings

      Your firewall interfaces should match your router and/or switch interfaces. If your router or switch is 100M bps half-duplex, your firewall should be 100M bps half-duplex. Your interfaces should be hard set to match; both should most likely be 100M bps full-duplex.

      Your router/switch and firewall should both report the same speed and duplex mode. If your switch and firewall are both Gigabit Ethernet, they should both be set to auto-negotiate the speed and duplex. If your Gigabit interfaces do not match between your firewall and switch, you should try replacing the cables and patch panel ports. Gigabit interfaces that are not linking at 1000M bps full-duplex are almost always a sign of other issues.

      Best practice No. 9: Separate firewalls from VPNs

      Separate firewalls from VPNs to offload VPN traffic and processing.

      Best practice No. 10: Offload features from the firewall

      Offload Unified Threat Management (UTM) features from the firewall including: antivirus, antispam, intrusion prevention system (IPS), and URL scanning.

      Best practice No. 11: Upgrade to the latest software version

      Upgrade to the latest software version. As a rule of thumb, newer versions contain performance enhancements but also add new capabilities-so a performance gain is not guaranteed.

      Reuven Harrison is CTO at Tufin Technologies. Reuven co-founded Tufin in 2003, serving as CTO during the company’s fast-paced growth. Responsible for Tufin’s flagship product, Reuven leads Tufin’s development staff, managing all product architecture. Reuven brings more than 17 years of software development experience, holding two key senior developer positions at Check Point Software, as well other key positions at Capsule Technologies and ECS. He received a Bachelor’s degree in Mathematics and Philosophy from Tel Aviv University. He can be reached at rh@tufin.com.

      Reuven Harrison
      Reuven Harrison
      Reuven Harrison is CTO at Tufin Technologies. Reuven co-founded Tufin in 2003, serving as CTO during the company's fast-paced growth. Reuven has more than 17 years of software development experience, holding two key senior developer positions at Check Point Software, as well other key positions at Capsule Technologies and ECS. He received a Bachelor's degree in Mathematics and Philosophy from Tel Aviv University.

      Get the Free Newsletter!

      Subscribe to Daily Tech Insider for top news, trends & analysis

      Get the Free Newsletter!

      Subscribe to Daily Tech Insider for top news, trends & analysis

      MOST POPULAR ARTICLES

      Artificial Intelligence

      9 Best AI 3D Generators You Need...

      Sam Rinko - June 25, 2024 0
      AI 3D Generators are powerful tools for many different industries. Discover the best AI 3D Generators, and learn which is best for your specific use case.
      Read more
      Cloud

      RingCentral Expands Its Collaboration Platform

      Zeus Kerravala - November 22, 2023 0
      RingCentral adds AI-enabled contact center and hybrid event products to its suite of collaboration services.
      Read more
      Artificial Intelligence

      8 Best AI Data Analytics Software &...

      Aminu Abdullahi - January 18, 2024 0
      Learn the top AI data analytics software to use. Compare AI data analytics solutions & features to make the best choice for your business.
      Read more
      Latest News

      Zeus Kerravala on Networking: Multicloud, 5G, and...

      James Maguire - December 16, 2022 0
      I spoke with Zeus Kerravala, industry analyst at ZK Research, about the rapid changes in enterprise networking, as tech advances and digital transformation prompt...
      Read more
      Video

      Datadog President Amit Agarwal on Trends in...

      James Maguire - November 11, 2022 0
      I spoke with Amit Agarwal, President of Datadog, about infrastructure observability, from current trends to key challenges to the future of this rapidly growing...
      Read more
      Logo

      eWeek has the latest technology news and analysis, buying guides, and product reviews for IT professionals and technology buyers. The site’s focus is on innovative solutions and covering in-depth technical content. eWeek stays on the cutting edge of technology news and IT trends through interviews and expert analysis. Gain insight from top innovators and thought leaders in the fields of IT, business, enterprise software, startups, and more.

      Facebook
      Linkedin
      RSS
      Twitter
      Youtube

      Advertisers

      Advertise with TechnologyAdvice on eWeek and our other IT-focused platforms.

      Advertise with Us

      Menu

      • About eWeek
      • Subscribe to our Newsletter
      • Latest News

      Our Brands

      • Privacy Policy
      • Terms
      • About
      • Contact
      • Advertise
      • Sitemap
      • California – Do Not Sell My Information

      Property of TechnologyAdvice.
      © 2024 TechnologyAdvice. All Rights Reserved

      Advertiser Disclosure: Some of the products that appear on this site are from companies from which TechnologyAdvice receives compensation. This compensation may impact how and where products appear on this site including, for example, the order in which they appear. TechnologyAdvice does not include all companies or all types of products available in the marketplace.

      ×