(a) Pre-parsing both files into arrays

(b) Using a crude state machine to skip the BEGIN ... END sections

(c) Then handing the shrunken arrays to Text::Diff

Thank you all for helping me to think through this.

P.S. This script now allows me to checkpoint my firewall config files into a config database, so that I can do things like report on how frequently we change firewall configuration.