Hello,
I have a question regarding the order of the rules in a firewall.
The question is whether the order of the rules affects the firewall performance.
All I could find in the community were old discussions, which claimed that placing the most used rules first will improve performance, since the firewall tries to match the rules sequentially.
Cisco also had a product called ACL manager that used to do that, but discontinued the project.
So the question is, are these assumptions still true? I'd expect the newer firewall to be able to compile the rules into a more effective data structure, which would reduce if not completely cancel the effects that rule ordering has on performance. Specifically I would like to know about ASA, PIX and FWSM firewalls.
Can anyone tell if this is the case or not?
