firewall rules efficency

[Andre_Backs]

Hi everyone, her is another starter question for you: which ruleset is processed more efficient: (goal of the ruleset is that anyone on the internet can reach 3 servers via either HTTP, HTTPS or SSH. The ruleset is fictuous) A) from: all to: server1, server2, server3 service: http, https,ssh (i.e. everything on 1 line but seperate firewall objects) B) from: all to: [server_group] service: [service_group] (like A but now we made a group of servers and a group of services) C) from: all to: server1 service: http from: all to: server1 service: https from: all to: server1 service: ssh from: all to: server2 service: http from: all to: server2 service: https from: all to: server2 service: ssh from: all to: server3 service: http from: all to: server3 service: https from: all to: server3 service: ssh (a seperate rule for each) Several variations can be made of course. I guess that it all depends on how the ruleset is built in memory. Is it interpreted for each packet (I sincerely hope not) or is it compiled What is your expert opinion please ?

[Mark_Oakton]

B

[Camshaft007]

B

[emnoc]

FWIW I think from efficiency,  it would not make a difference. From the number of policy-ids the less is always better.

I believe the  fortigate load and process the  policies so you would probably no notice anything.

[rwpatterson]

I would think A (marginally), only because the FGT would have to go to one less table to get the answer. (Not have break down the groups) Obviously C is the least efficient.