Limit by device or user, which is better for performance?

Gary,

the answer is no. As clientless users, no more advantages to use it instead of IP.

I prefer clientless so inside the report, you know who that IP is.

Regards

So the idea is that clientless or host restrictions are just filters on the code that work exactly the same? It's not like the FW rule will hit the device "gate" first and save processing that might happen if the rule has to run until it hits the "users" gate?