Firewall performance monitoring

Question

Hi everyone,

Could we please have a guide to monitor Firewall's performance?

Thank you

Answer 1

Hello Handinata Tanudjaja

I understand that you're looking to effectively monitor and evaluate your Firewall's performance. Here’s a step-by-step guide to help you identify any issues and optimize performance:

Identify Key Metrics to Monitor

To gauge the performance of your Firewall, focus on the following metrics:

• Latency: Measure traffic latency to see how much delay your Firewall introduces. Compare latency measurements with and without the Firewall.
• Traffic Throughput: Monitor the amount of data passing through the Firewall to understand its capacity.
• Data Processed: Keep track of the total data processed to assess workload.
• Rule Hits: Track which rules are hit most frequently to identify potential bottlenecks.

Set Up Monitoring Tools

Leverage Azure Monitor or equivalent solutions to collect and analyze the metrics mentioned above:

• Use Azure Monitor to aggregate logs and performance data.
• Set up alerts on key metrics to ensure you are notified of any concerning deviations from baseline performance. For example-Configure alerts for:
  • CPU > 80% for more than 5 min
  • SNAT port usage > 90%
  • Throughput near SKU limit
  • Unexpected spike in denied connections

Analyze Logs & Metrics Regularly

Regularly review the collected data:

• Inspect traffic logs to analyze permitted vs. denied access attempts, looking for any patterns that indicate security threats or misconfigurations.
• Use Log Analytics / SIEM / Dashboard: Set up custom dashboards or queries.

Configuration Adjustments

Based on the analysis:

• Optimize Rules: If certain rules are causing latency spikes, reconsider their placement or structure. Use less restrictive rules where possible.
• Logging and Audit: Ensure that your firewall logging is configured to capture essential events (like dropped packets) for further troubleshooting.

Regular Health Checks and Updates

• Keep your firewall updated for performance fixes and enhancements.
• Test the Firewall’s impact on network latency and adjust configurations if any thresholds are exceeded.
• Simulate network traffic to assess the Firewall's performance under load.

Refer Best Practices for Azure Firewall, Azure Monitor Firewall

---

Please don’t forget to close the thread by clicking "Accept the answer" and "Yes" wherever the information provided helps you, as this can be beneficial to other community members.