9 Best Practices for Optimizing Firewall Performance.

A firewall rule base is a set of rules that determine what is and is not allowed through the firewall. Over time, firewall rule bases become large and complicated (and frankly, a headache). 

Firewall rule bases and sets often include rules that are either partially or completely unused, expired, or shadowed. The problem gets worse if multiple administrators have made changes to firewall policies or if your organization has an unwieldy number of firewalls.  

When the rule base gets big and tangled, it affects firewall performance. Maintaining firewall performance can be challenging, which can introduce security risks. In the vein of firewall audits, standards such as PCI-DSS, NERC-CIP, and ISO 27001 require that you clean up unused rules, redundant rules, duplicate objects, and more.  

With some help from our customers, I’ve compiled a list of best practices for efficiently and safely cleaning up a firewall (or router) rule base. You can do these firewall security checks on your own. Still, if you have Tufin SecureTrack+, you can run most of them automatically, including firewall rule cleanup and firewall configuration.  

9 Best Practices for Cleaning up Firewall Rule Bases  

1. Delete fully shadowed rules. If you have SecureTrack+, the Rule and Object Usage report removes these.
     
2. Delete expired and unused rules and objects. The Rule and Object Usage and the Expired Rules report will do all this.
    
3. Remove unused connections. Remove specific source/destination/service routes that are not in use. You can detect those using the Automatic Policy Generator to analyze traffic patterns.
    
4. Enforce object naming conventions. Make the rule base easy to understand. For example, use a consistent format such as host_name_IP for hosts. This is an option in the Best Practices report.
     
5. Delete old and unused policies. Check Point and some other vendors allow you to keep multiple rule bases. This is another test in the Best Practices report.
     
6. Remove duplicate objects. For example, a service or network host may be defined twice with different names. Again, the Best Practices Report can identify these.
     
7. Reduce shadowing. You can detect partially shadowed rules with Policy Analysis.
     
8. Break up long rule sections. Segment sections into readable chunks of at most 20 rules. This, too, can be checked with the Best Practices report.
     
9. Document rules, objects, and policy revisions. Do this for future reference. In SecureTrack+, you can document revisions, for instance, to indicate when an audit was performed. You can also link firewall policy changes to tickets from your help desk to store additional information about the requestor, approver, etc. You can enforce a standard for rule documentation with the Rule Comments Format test in the Best Practices report.

Lastly, some of your most important security checks also help you maintain a clean, compact rule base. If you use SecureTrack+, try these: 

• Optimize permissive rules: Run the Automatic Policy Generator (APG) to detect rules that are too open. 

• Define a zone-based compliance policy: Check it by running an audit report on all firewall rules sets. 

• Identify and reduce insecure rules: Leverage the Best Practices report.  

• Optimize performance. Read my previous posts, Tufin Firewall Expert Tip #4: Vendor and model-specific tips for optimizing firewall performance, and Tufin Firewall Expert Tip #3: Best practices for optimizing firewall performance. 

Document & Automate Firewall Rule Cleanup with Tufin  

Tufin removes the legwork from firewall management, including firewall rule base cleanup, firewall audits, and more. 

Through cleaning up your firewall rule, you’ll uncover traffic patterns, misconfigurations, and expired rules, allowing you to improve your change management process and more easily meet regulatory requirements.

By leveraging automation, Tufin ensures you can tighten up your firewall rule base and overall cybersecurity, network security, and firewall performance in nine straightforward steps. 

Less unused firewall rules and security risks mean fewer revisions and tedious troubleshooting. Get a demo to learn more about how Tufin can improve the way you manage and cleanup firewall rules, firewall policies, new rules, redundant rules, and everything in-between.