Danny,
There has been no in-depth sizing test done on access-list. With that said here are some observations.
1) The number of ACL elements in one access-list is memory bound. Each element requires about 40-56 bytes.
2) My testing with an access-list with 4000 entries shows minimal impact on responsiveness.
As far as I know, we have not have any sizing test done. However, our access-list checks are done once per flow so it help minimize the impact. So far we have no report about unacceptable performance impact on the number of access-list rules. We do have some fairly large customers so it does give me some confidence.
I can give a rough rule of thumb is that the longer the access-list, the longer the session will take to initiated. Once it is created or blocked, then impact is zero.
Regarding the UltraSurf/TOR app, those are in a perpetual game of cat and mouse. It works on tcp port 9666, but just blocking this port doesn't help as it work on both port 80 & 443 and it makes thinks more hard as they also uses a lot of open proxies.
I have been looking into this for similar reasons. Option 1 from what I have found is to have your DNS servers referencing one of the RBL's that keep track of the open proxy sites. That seems to help but I am not familiar with that option. Option 2 involves adding a 3rd party product called WebSense that appears to have the ability to block proxy traffic like this or Ironport appliance.
Does that answer your question?
Regards,
Juan Lombana
Please rate helpful posts.
