ACL optimization

Rule complexity

ACL rule complexity, matching, and the number of rules that are checked before servicing each request can affect performance. For this reason, rules and restrictive policies should be cautiously applied. Ordering rules, grouping rules, and using the correct variables to form rules are just a few techniques that ensure optimal performance when you implement secure policies for controlling access to NetCache services. These techniques include:

Matching frequency
Collapsing ACLS
Using contiguous blocks
Ordering rules
Using contains and contains-case operators
Note
See, Contains and contains-case operators for information about using these operators an as efficient alternative for matching URL substrings.

Matching frequency

To achieve optimum efficiency, order the most frequently matched rules at the top of an ACL list. You can use the Web access log files to determine the frequency at which a match occurs.

Collapsing ACL rules

Minimize the length of your ACL lists by collapsing many complex rules into one simple rule where possible. For example, the following ACL lists multiple directories that can be collapsed into one:

deny url-prefix http://www.company.com/monitoring

deny url-prefix http://www.company.com/administration

deny url-prefix http://www.company.com/security

The preceding ACL can be collapsed into the following simple rule:

deny server-domain company.com

Using contiguous blocks

Contiguous blocks are useful for optimizing performance when the same ACL action and variable occur in 10 or more rules. A contiguous list of at least 10 like rules is converted internally to a data structure that optimizes matching. For example:

allow client-ip 128.126.10.40

allow client-ip 128.126.10.41

allow client-ip 128.126.10.42

allow client-ip 128.126.10.43

allow client-ip 128.126.10.44

allow client-ip 128.126.10.45

allow client-ip 128.126.10.46

allow client-ip 128.126.10.47

allow client-ip 128.126.10.48

allow client-ip 128.126.10.49

allow client-ip 128.126.10.42

allow client-ip 128.126.10.43

deny any

NetCache supports contiguous blocks for the following variables:

server-name

client-name

url

client-ip

server-ip

Ordering rules

You can optimize performance by ordering rules according to their requirements for system resources. Network Appliance recommends that you list rules by order of impact on system resources, beginning with the rules that have the least impact on resources and ending with the rules that have the greatest impact. The following table illustrates this guideline.

Order	Description	Example
1	Absolute values directly obtainable from a request	`client-ip, server-name, server-ip, url, req-header`
2	Absolute values requiring an extra DNS cache lookup Caution A low DNS cache hit ratio in combination with a slow DNS service can cause a serious bottleneck. If a bottleneck occurs, the impact on performance is significantly greater than any of the following types of rules.	`client-name`
3	Simple request patterns	`url-prefix, server-domain`
4	Simple regular expressions	`server-name matches company`
5	Content filtering application categories To optimize expressions that contain categories, use one rule for each category and form a contiguous block for two or more rules. SmartFilter examples: deny smartfilter "cults" deny smartfilter "entertainment" DynaBLocator examples: deny wwfilter "chat" deny wwfilter "sports"	`cults, entertainment` or `chat, sports`
6	Complex regular expressions	`url-matches "foo([Bb][Aa][Rr])?.com"`

Absolute values are significantly more efficient if they are sorted by variable. Use contiguous blocks when the same variable occurs in 10 or more rules.