The 2/9 Virtualization Security Podcast held a discussion on when would one use a virtual firewall. This was in response to being told that there are some people that would never use a virtual firewall for anything, and that got me thinking. Outside of the politics involved with using virtual vs physical firewalls, when would you use one? What are the cut offs, and best practices around using virtual firewalls. We were joined by Rob Randell of VMware to discuss this point.

Firewall Type
Where FW Sits
Edge Sits between two or more virtual portgroups or virtual switches
Intro-spective
Resides within the hypervisor side of each virtual NIC

Some background first, there are two types of virtual firewalls available to day, one that is a traditional Edge firewall and one that is more ‘introspective’ using introspection APIs to do their work. We discussed both types of these firewalls with respect to defence in depth. So the first best practice that came out of our discussion was:

Use Virtual Firewalls to Provide defence in depth

However, one could argue that in guest firewalls can also provide defence in depth, but that could lead to issues of how to manage each of those in-guest firewalls, the resources that each in-guest firewall takes up, hacks that attack the in-guest firewalls, as well as how to handle transient and dormant (powered-off, suspended) VMs for firewall rule updates.

Introspective Firewalls

Using an introspective approach provides a well managed way to keep each VM protected regardless of virtual machine state. Lastly, in-guest firewall attacks would fail, as the firewall is not running in-guest but outside the guest.

Throughput of introspective firewalls was also brought up, but well written rules can assist with such performance. With vShield App, for example, up to 5000 rules cause no impact to throughput.  However, this will depend mostly on how the rules are written and perhaps even their order. Unfortunately, no one on the podcast knows of any introspective firewalls for any hypervisors except VMware vShield App and the third party VMsafe firewalls from Trend Micro, Reflex Systems, Juniper, Checkpoint, etc.

Edge Firewalls

Workload Size
Best Practice
> 15000 Sessions/sec
> 10GB/s throughput
Use Physical or at least a Physical Load balancer with distributed virtual firewalls behind
2000-15000 Sessions/sec
> 5GB/s throughput
Use combination of physical and virtual
< 2000 Sessions/Sec
< 5GB/s throughput
Use Virtual

The alternative firewall is an Edge firewall, these can be used at the Edge of your data centre or between trust zones within your virtual or cloud environments.  But, the real question arises to when you can use such an Edge firewall and when you should use a physical firewalls. So we discussed the difference size workloads and organization types to set some ground rules. We broke the types of workloads into three based on sessions per second and throughput requirements. Why these? Because we also measure physical firewalls by these values. Refer to the table to the left, but in most cases a virtual firewall can also be used, but for the higher end workloads, there is quite a bit more architecture to be done to make use of a virtual firewall, as there are limits with nearly any technology.

Let’s take an example brought up during the podcast, if you had a need to 1B queries per day that exceed 15K sessions per second, you could use either a bigger physical firewall or you could distribute the load across  multiple virtual firewalls, but if you distributed this workload over virtual firewalls, you most likely need a physical load balancer to handle the incoming sessions and queries. So while virtual firewalls may be possible, you still need something physical to make it work properly. As a side note, most in-guest firewalls would be crushed with this type of workload even when distributed.

These numbers seem fairly high but are not unreasonable for certain industries, so if we reduce the workload, we run into the middle ground where you can go in either direction based on the specifications of the virtual firewall chosen. So this leads to our next best practice rule for when to use virtual firewalls.

Compare Virtual and Physical Firewall Specifications

When choosing to use a virtual firewall or not, it is not about the fact that the firewall is virtual, but what that firewall offers. We can easily get specifications for all physical firewalls, those same specifications should be available for virtual firewalls. However, we still have to manage these virtual firewalls, and in most cases, this leads to a political discussion about changing how anyone does business but there are solutions to this as well. Choose a virtual firewall that is an extension of your existing physical environment or at least integrates into your existing environment either using vendor tools or tools specifically designed to keep disparate firewall constructs in sync. All major firewall and switch vendors have virtual versions of their firewall that can be controlled via the same interface as their physical firewalls and switches such as Juniper vGW, CheckPoint, Cisco vASA, etc. However, there is one more best practice that should be considered:

Do not limit yourself to just one breed of firewall, choose best of breed.

I would not ignore virtual firewall vendors such as Catbird, Vyatta, Trend Micro, etc. but instead include them in any discussion to determine the best fit for your needs. In many cases, a virtual firewall can exceed the expectations of any physical firewall due to its placement within the network. We can do more with a virtual firewall than we have ever been able to do with physical firewalls. Granted, the Next Gen physical firewalls will also exceed our expectations, but expect virtual versions of the same things very soon.

In conclusion, there are times when a fully virtual solution does not make sense, but there are other times when they do. It depends on your needs. We just looked at two key numbers, throughput and sessions/second, but there are others equally important depending on your workloads. I would  choose  to go with a virtual firewall based on requirements and workload needs. When can you use a virtual firewall? Nearly everywhere with the proper architecture.

Share this Article:

Share Button
Edward Haletky (381 Posts)

Edward L. Haletky, aka Texiwill, is the author of VMware vSphere(TM) and Virtual Infrastructure Security: Securing the Virtual Environment as well as VMware ESX and ESXi in the Enterprise: Planning Deployment of Virtualization Servers, 2nd Edition. Edward owns AstroArch Consulting, Inc., providing virtualization, security, network consulting and development and The Virtualization Practice where he is also an Analyst. Edward is the Moderator and Host of the Virtualization Security Podcast as well as a guru and moderator for the VMware Communities Forums, providing answers to security and configuration questions. Edward is working on new books on Virtualization.

[All Papers/Publications...]

Connect with Edward Haletky:


Related Posts:

3 comments for “When to use a Virtual Firewall

  1. February 13, 2012 at 5:28 PM

    This was true until multicore chip vendors released their latest platforms for enabling high performance networking software equipment.

  2. February 16, 2012 at 9:42 AM

    Hello David,

    These numbers are not really based on hardware numbers, but the software numbers from some of the vendors and underlying software technologies used for many virtual firewalls. For example, standard iptables based firewalls within Linux subsystems have serious issues with high sessions/second counts, but have no real issues with bandwidth. Granted, there are ways to tune iptables to support such numbers, but it takes a fair amount of specialized knowledge to do so.

    I agree, such hardware will help with overall performance, but if the software used has limits independent of hardware?

    Best regards,
    Edward Haletky

Leave a Reply

Your email address will not be published. Required fields are marked *


7 × = twenty eight