Firewall performance tuning: Common issues & resolutions

A firewall that runs 24/7 requires a good amount of computing resources. Especially if you are running a complex firewall system, your performance overhead can actually slow down the overall throughput of your systems and even affect the actual functionalities of your firewall.

Here is a brief overview of common firewall performance issues and the best practices to help you tune your firewall performance.

7 Common performance issues with firewalls

Since firewall implementations often include some networking hardware usage, they can slow down network performance and traffic bottlenecks within your network.

1. High CPU usage

• The more network traffic you deal with, the more CPU time your server will need.

• When a firewall is running, it adds to CPU utilization since the processes need more power to execute the network packet analysis and subsequent firewall

• This may lead to firewall failures in extreme cases where the firewall process is completely shut down or the system experiences a noticeable lag affecting overall functionality.

• A simple way to resolve this issue would be to increase the hardware capabilities.

• But as that might not be a viable solution in all cases, you must consider minimizing the network traffic with router-level filtering or decreasing the server load with optimized
  

2. Route flapping

• Router misconfiguration or hardware failure can cause frequent advertising of alternate routes.

• This will increase the load on your resources and thus lead to performance issues.
  

3. Network errors and discards

• A high number of error packets or discarded packets can burden your resources as these packets are still processed by the firewall even when they ultimately turn out to be dud in terms of traffic.

• Such errors usually happen when routers try to reclaim some buffer space.
  

4. Congested network access link

• Network access link congestion can be caused due to a bottleneck happening between a high bandwidth IP Network and LAN.

• When there is high traffic, the router queue gets filled and causes jitters and time delays.

• When there are more occurrences of jitter, more packets are dropped on the receiving end, causing a degradation of the quality of audio or video being transmitted.

• This issue is often observed in VoIP systems.

5. Network link failure

• When packet loss continues for over a few seconds, it can be deemed a network link failure.

• While re-establishing the link could take just a few seconds, the routers may already be looking for alternate routes.

• Frequent network link failures can be a symptom of power supply or hardware issues.

6. Misconfigurations

• Software or hardware misconfigurations can easily lead to overloading of LAN, and such a burden can easily affect the system’s performance.

• Situations like these can be caused by misconfigured multicast traffic and can affect the overall data transfer rate of all users.

7. Loss of packets

• Loss of packets can cause timeout errors, retransmissions, and network slowness.

• Loss of packets can happen due to delayed operations, server slowdown, misconfiguration, and several other reasons.

How to fine-Tune your firewall performance

Firewall performance issues can be alleviated with hardware upgrades. But as you scale up, upgrading hardware at an increasing scale would mean high expenses and an overall inefficient system.

A much better cost-effective way to resolve firewall performance issues would be to figure out the root cause and make the necessary updates and fixes to resolve the issues.

Before troubleshooting, you should know the different types of firewall optimization techniques:

Hardware updates

Firewall optimization can be easily achieved through real-time hardware updates and upgrades. This is a straightforward method where you add more capacity to your computing resources to handle the processing load of running a firewall.

General best practices

This involves the commonly used universal best practices that ensure optimized firewall configurations and working. Security policies, data standard compliances, and keeping your systems up to date and patched will all come under this category of optimizations. Any optimization effort generally applied to all firewalls can be classified under this type.

Vendor specific

Optimization techniques designed specifically to fit the requirements of a particular vendor are called vendor-specific optimizations. This calls for a good understanding of your protected systems, how traffic flows, and how to minimize the network load.

Model specific

Similar to vendor-specific optimizations, model-specific optimization techniques consider the particular network model you use. For instance, the Cisco network models usually have debugging features that can slow down performance.

Similarly, the PIX 6.3 model uses TCP intercept that can slow down performance. Based on your usage and requirements, you can turn the specific features on or off to boost your firewall performance.

Best practices to resolve the usual firewall performance bottlenecks

Here are some proven best practices to improve your firewall’s performance. Additionally, you might also want to read Max Power by Timothy Hall for a wholesome understanding.

Standardize your network traffic

Any good practice starts with rectifying your internal errors and vulnerabilities. Ensure all your outgoing traffic aligns with your cybersecurity standards and regulations.

Weed out any application or server sending out requests that don’t comply with the security regulations and make the necessary updates to streamline your network.

Router level filtering

To reduce the load on your firewall applications and hardware, you can use router-level network traffic filtering.

This can be achieved by making a Standard Access List filter from the previously dropped requests and then routing them using this list for any other subsequent request attempts. This process can be time-consuming but is simple and effective in avoiding bottlenecks.

Avoid using complicated firewall rules

Complex firewall rules can be resource heavy and place a lot of burden on your firewall performance. Simplifying this ruleset can boost your performance to a great extent.

You should also regularly audit these rules and remove unused rules. To help you clean up firewall rules, you can start with Algosec’s firewall rule cleanup and performance optimization tool.

Test your firewall

Regular testing and auditing of your firewall can help you identify any probable causes for performance slowdown. You can collect information on your network traffic and use it to optimize how your firewall operates.

You can use Algosec’s firewall auditor services to take care of all your auditing requirements and ensure compliance at all levels.

Make use of common network troubleshooting tools

To analyze the network traffic and troubleshoot your performance issues, you can use common network tools like netstat and iproute2. These tools provide you with network stats and in-depth information about your traffic that can be well utilized to improve your firewall configurations. 

You can also use check point servers and tools like SecureXL, and CoreXL.

Follow a well-defined security policy

As with any security implementation, you should always have a well-defined security policy before configuring your firewalls. This gives you a good idea of how your firewall configurations are made and lets you simplify them easily. Change management is also essential to your firewall policy management process.

You should also document all the changes, reviews, and updates you make to your security policies to trace any problematic configurations and keep your systems updated against evolving cyber threats.

A good way to mitigate security policy risks is to utilize AlgoSec.

Network segmentation

Segmentation can help boost performance as it helps isolate network issues and optimize bandwidth allocation.

It can also help to reduce the traffic and thus further improve the performance. Here is a guide on network segmentation you can check out.

Automation

Make use of automation to update your firewall settings. Automating the firewall setup process can greatly reduce setup errors and help you make the process more efficient and less time-consuming.

You can also extend the automation to configure routers and switches. Algobot is an intelligent chatbot that can effortlessly handle network security policy management tasks for you.

Handle broadcast traffic efficiently

You can create optimized rules to handle broadcast traffic without logging to improve performance.

Make use of optimized algorithms

Some firewalls, such as the Cisco Pix, ASA 7.0 , Juniper network models, and FWSM 4.0 are designed to match packets without dependency on rule order. You can use these firewalls; if not, you will have to consider the rule order to boost the performance.

To improve performance, you should place the most commonly used policy rules on the top of the rule base. The SANS Institute recommends the following order of rules:

• Anti-spoofing filters

• User permit rules

• Management permit rules

• Noise drops

• Deny and alert

• Deny and log

DNS objects

Try to avoid using DNS objects that need DNS lookup services. This slows down the firewall.

Router interface design

Matching the router interface with your firewall interface is a good way to ensure good performance. If your router interface is half duplex and the firewall is full duplex, the mismatch can cause some performance issues.

Similarly, you should try to match the switch interface with your firewall interface, making them report on the same speed and mode.

For gigabit switches, you should set up your firewall to automatically adjust speed and duplex mode. You can replace the cables and patch panel ports if you cannot match the interfaces.

VPN

If you are using VPN and firewalls, you can separate them to remove some VPN traffic and processing load from the firewall and thus increase the performance.

UTM features

You can remove the additional UTM features like Antivirus, and URL scanning features from the firewall to make it more efficient.

This does not mean you completely eliminate any additional security features. Instead, just offload them from the firewall to make the firewall work faster and take up fewer computing resources. 

Keep your systems patched and updated

Always keep your systems, firmware, software, and third-party applications updated and patched to deal with all known vulnerabilities.