Best Practices for Fastpath Prefiltering

When you use the fastpath action in a prefilter rule, the matching traffic bypasses inspection and is simply transmitted through the device. Use this action for traffic that you can trust and that would not benefit from any of the security features available.

The following types of traffic are ideal for fastpathing. For example, you could configure the rules to fastpath any traffic from or to the IP addresses of the endpoints or servers. You can further limit the rule based on ports used.

• VPN traffic that is going through the device. That is, the device is not an endpoint in the VPN topology.

• SQL traffic between trusted endpoints on the internal network.

• Scanner traffic. Scanner probes can create a lot of false-positive responses from intrusion policies.

• Voice/video.

• Backups.

• Management traffic (sftunnel) that traverses threat defense devices. Performing deep inspection on management traffic (using access control policies) can cause issues. You can prefilter based on port TCP/8305 between the management center and managed devices.