Changing Policies at Off-Peak Hours and Enabling Policy Backup-based Acceleration as Required

You are advised to change security policies during off-peak hours to minimize the impact on firewall performance and established sessions. This is especially important for high-load firewalls.

To improve the security policy matching speed, the firewall creates an index for each security policy and accelerates policy query (index matching) during policy matching. This function is known as policy acceleration. When a security policy changes, the new security policy takes effect immediately. However, the firewall creates an index for the new security policy after an acceleration delay (60 seconds by default) to ensure that the index is created after the change is complete. Before the index update is complete, the firewall performs regular policy matching, resulting in low efficiency of policy matching. To resolve this problem, you can configure the policy backup-based acceleration function. When a security policy changes, the firewall backs up the index of the original policy and uses the backup index to match security policies. After an index is re-created, the firewall uses the new index for policy matching and the new security policy takes effect.

Determine whether to enable the policy-based backup acceleration function by referring to Table 4-3.