Object-group optimization

Use object optimization to evaluate and optimize network or host policy objects that are used in rules. The system then creates associated network object groups on the device.

Optimization merges adjacent networks and removes redundant network entries. This reduces runtime access list data structures and decreases configuration size for memory-constrained devices.

Note	Object optimization applies only to objects created by the Cloud-Delivered Firewall Management Center. These objects are created when IP addresses are added directly to an access control rule, instead of using custom network objects. User-defined network objects are not changed.

For example, consider a network or host object that contains these entries and that is used in an access rule:

192.168.1.0/24
                        192.168.1.23
                        10.1.1.0
                        10.1.1.1
                        10.1.1.2/31

When optimization is enabled, the resulting object group configuration is generated:

object-group network test
                        description (Optimized by management center)
                        network-object 10.1.1.0 255.255.255.252
                        network-object 192.168.1.0 255.255.255.0

When optimization is disabled, the group configuration is:

object-group network test
                        network-object 192.168.1.0 255.255.255.0
                        network-object 192.168.1.23 255.255.255.255
                        network-object 10.1.1.0 255.255.255.255
                        network-object 10.1.1.1 255.255.255.255
                        network-object 10.1.1.2 255.255.255.254

Important

The optimizations occur on the managed device on the first deploy after the feature is enabled on the Cloud-Delivered Firewall Management Center. If you have a high number of rules, the system can take several minutes to an hour to evaluate your policies and perform object optimization. During this time, you may see higher CPU use on your devices. After this feature is enabled or disabled, we recommend you deploy when it will have the least impact, such as a maintenance window or a low-traffic time.