Performance impact of large network CIDR Aliases
-
If I were to have several IP-Network aliases, each consisting of CIDRs representing millions of addresses, and I were to include those aliases in firewall rules, would this degrade the firewall's performance? I know that the answer depends on my machine's capabilities but I am interested in an "all other things being equal" answer.
So, I guess my question relates to: does the algorithm for checking an IP's match with an aliased CIDR set require iterating over a large set of potential IPs before a firewall match decision is complete? Or, is a fast algorithm that does not require storage or inspection of each potential IP being used?
-
If you use the network alias vs IP, then it would just be the cidr.. There would be no real difference if a /29 or a /8 - where you would have a problem is putting a large cidr into the IP alias - where the range is broken out into individual IP vs the network.
If you are putting hundreds or thousands of cidr ranges - this could have an effect on rule evaluation.
-
Hi,
ThanksJust to be sure, that's:
use Firewall/Aliases/IP : type = Network
and not Firewall/Aliases/IP: type = URL Table (IP)
Is that correct?
-
Set the type here for IP
here is one I have
-
Thanks
