[fw-wiz] Firewall rules order and performance

This is a well known idea that the rules order is important for the best performance of a firewall. However, nowadays:
1. Stateful firewalls use their stateful engine for existing connections to allow traffic. That means that their performance is more related to the number of existing sessions rather than the number of rules, or more exactly it is tied to the ratio new/existing sessions.
2. Some firewalls no longer parse the configuration line by line but use hardware-based or tree-based model. Again, the number of rules has less effect on the performance.

I'm looking for benchmarks/ideas that could prove I'm right or wrong. I know for sure that FW-1 and IOS depend on the rules order but what about the others ? Google didn't give any information one way or the other.

--
Pierre Blanchet
_______________________________________________
firewall-wizards mailing list
firewall-wizards@xxxxxxxxxxxxxxxxxxxxx
https://listserv.icsalabs.com/mailman/listinfo/firewall-wizards

Relevant Pages

  • Re: How Does Checkpoint Count Up IPs for Licensing?
    ... Nowadays, as noted above, IP's are only counted if they traverse the ... firewall. ... You should see a log entry of "too many internal hosts" if you ...
    (comp.security.firewalls)
  • RE: [fw-wiz] Sources for Extranet Designs?
    ... Nowadays I suspect there are so many goofy SMTP clients it would ... ;) If every firewall had choked on it, ...
    (Firewall-Wizards)
  • Best free firewall?
    ... Hey guys, ... I haven't been reading these groups often, but was wondering what the best ... *free* firewall is nowadays. ...
    (microsoft.public.windowsxp.general)
  • Re: Best free firewall?
    ... I haven't been reading these groups often, but was wondering what the best ... *free* firewall is nowadays. ... Stick with ZAF. ...
    (microsoft.public.windowsxp.general)
  • Re: Best free firewall?
    ... if you want to block out life. ... I haven't been reading these groups often, ... *free* firewall is nowadays. ...
    (microsoft.public.windowsxp.general)