Hi all,
I have a firewall running using IP filter version 3.4.30 on a
Solaris sparc box running Solaris version 9.
My application modifies rules dynamically by running the ipnat tool
with the corresponding flags and rule files.
For example, the application adds a rule by running the following
command
ipnat -f temp_rules_to_add.conf
where temp_rules_to_add.conf contains the rule(s) to add.
I am facing a performance problem here as this (ipnat command) takes
~8-10 seconds to process under the following circumstances.
I have investigated this a little and found that the number of
existing nat rules (usually in the order of thousands) does not have a
direct impact on the performance. In the absence of any network traffic, the
processing is fast and takes less than a second. But, when there is a lot of
network traffic from the machines thru the ipfilter, then the ipnat
processing for adding the rule becomes slow.
I understand that there is a lock on the data structures, while
adding a rule.and I assume that this might be the cause for the problems as
the lock may also be used while processing the packets from the machines.
Any suggestions/solutions to this problem?
If ipnat supports active/inactive rule set, perhaps that would be
the solution (modifying the inactive set and swapping it in) but I believe
ipnat does not support this feature.
Regards,
sathvanth
Sathvanth.
iLabs Ltd.
85,Kutchery Road. Millennium Center
Mylapore, Chennai 600 004
Email: [EMAIL PROTECTED]
TalkToMe: 24616768, Extn: 311
