The challenge
With all new technologies comes trade-offs and in the case of virtual security appliances the trade-off is many times performance restrictions. In the past, companies such as Tipping Point delivered Intrusion Prevention technology in an appliance form factor and provided the highest levels of performance by leveraging application specific integration circuits [ASIC] and field programmable gate arrays [FPGA] that reside on dedicated hardware bus boards. Today, companies such as Reflex Security and Blue Lane that are virtualizing intrusion prevention, firewall and other application layer technologies. These goals are challenged with delivering optimal performance levels because in the virtualized world, applications running on operating systems compete for the same hardware computing resources. In the physical appliance world, those resources are dedicated and are less likely to suffer from blocking status waiting for resources.
Some security applications maintain fewer dynamic states. Firewall technologies typically inspect smaller amounts of data such as TCP & UDP headers and usually maintain less state. Therefore, simple IP firewall technologies more likely to be candidates for virtualization. Many intrusion prevention technologies use signatures and dynamic configurations that enable a deep inspection into the payload and sometimes monitoring session streams. Intrusion prevention also typically requires heavy state retention and maintenance, and make heavy use of dynamic data in memory. Often highly dynamic data memory segments are less able to be deduplicated as they are more dynamic than code segments. As shared resources are required more often this leads to resource contention which can add latency particularly for systems that forward datagrams. Technology such as Blue Lane's application layer enforcement is less affected because it inspects less traffic: that which is heading to known vulnerabilities while letting innocent traffic pass.
Another reason for performance challenges are because IPS technologies dynamic signatures make inspection applications need to run user processes outside of the operating system kernel to avoid outages incurred from kernel reloads or system reboots. User processes typically suffer from higher overhead due to their separation from the governing operating systems' memory and process management policies. Firewall technologies traditionally run as part of the operating system kernel. The performance concerns are reduced due to tight coupling with operating system internals.
To overcome these limitations, ASICs and Multi-Core processors have traditionally been used with IPS applications. This luxury is not available in virtualized environments because virtualization technologies typically do not allow direct hardware access to the underlying application-specific hardware. Virtualization is well suited for general purpose applications which would otherwise be underutilized on dedicated hosting hardware. Overcompensating for the loss of specific hardware by using larger than normal amounts of compute cycles for encryption, or memory for state maintenance, defeats the purpose of server virtualization.
IBM Internet Security Systems, formerly Internet Security Systems, and often known simply as ISS or ISSX is a security software provider founded in 1994. The company was acquired by IBM in 2006.
Cisco PIX was a popular IP firewall and network address translation (NAT) appliance. It was one of the first products in this market segment.
A hypervisor or virtual machine monitor (VMM) is computer software, firmware or hardware that creates and runs virtual machines. A computer on which a hypervisor runs one or more virtual machines is called a host machine, and each virtual machine is called a guest machine. The hypervisor presents the guest operating systems with a virtual operating platform and manages the execution of the guest operating systems. Multiple instances of a variety of operating systems may share the virtualized hardware resources: for example, Linux, Windows, and macOS instances can all run on a single physical x86 machine. This contrasts with operating-system-level virtualization, where all instances must share a single kernel, though the guest operating systems can differ in user space, such as different Linux distributions with the same kernel.
A software appliance is a software application combined with just enough operating system (JeOS) to run optimally on industry-standard hardware or in a virtual machine. It is a software distribution or firmware that implements a computer appliance.
An XML appliance is a special-purpose network device used to secure, manage and mediate XML traffic. They are most popularly implemented in service-oriented architectures (SOA) to control XML-based web services traffic, and increasingly in cloud-oriented computing to help enterprises integrate on premises applications with off-premises cloud-hosted applications. XML appliances are also commonly referred to as SOA appliances, SOA gateways, XML gateways, and cloud brokers. Some have also been deployed for more specific applications like Message-oriented middleware. While the originators of the product category deployed exclusively as hardware, today most XML appliances are also available as software gateways and virtual appliances for environments like VMWare.
The following is a comparison of notable firewalls, starting from simple home firewalls up to the most sophisticated Enterprise-level firewalls.
VMware ESXi is an enterprise-class, type-1 hypervisor developed by VMware for deploying and serving virtual computers. As a type-1 hypervisor, ESXi is not a software application that is installed on an operating system (OS); instead, it includes and integrates vital OS components, such as a kernel.
Hardware virtualization is the virtualization of computers as complete hardware platforms, certain logical abstractions of their componentry, or only the functionality required to run various operating systems. Virtualization hides the physical characteristics of a computing platform from the users, presenting instead an abstract computing platform. At its origins, the software that controlled virtualization was called a "control program", but the terms "hypervisor" or "virtual machine monitor" became preferred over time.
Infrastructure as a service (IaaS) are online services that provide high-level APIs used to dereference various low-level details of underlying network infrastructure like physical computing resources, location, data partitioning, scaling, security, backup etc. A hypervisor, such as Xen, Oracle VirtualBox, Oracle VM, KVM, VMware ESX/ESXi, or Hyper-V, LXD, runs the virtual machines as guests. Pools of hypervisors within the cloud operational system can support large numbers of virtual machines and the ability to scale services up and down according to customers' varying requirements.
Sourcefire, Inc was a technology company that developed network security hardware and software. The company's Firepower network security appliances are based on Snort, an open-source intrusion detection system (IDS). Sourcefire was acquired by Cisco for $2.7 billion in July 2013.
A virtual security switch is a software Ethernet switch with embedded security controls within it that runs within virtual environments such as VMware vSphere, Citrix XenDesktop, Microsoft Hyper-V and Virtual Iron. The primary purpose of a virtual security switch is to provide security measures such as isolation, control and content inspection between virtual machines.
Altor Networks, Inc., a Juniper Networks Company, is a provider of security for virtual data centers and clouds. The company developed the world’s first firewall purpose-built for virtual networks, a software security "appliance" that runs in a virtualized environment and enforces security policy on a per-virtual-machine basis. Data center administrators could pinpoint a broad range of virtual network security comprises and create roles-based security policies. Security policies could be continuously enforced on individual virtual machines (VM), even as they moved throughout the virtualized data center.
A virtual firewall (VF) is a network firewall service or appliance running entirely within a virtualized environment and which provides the usual packet filtering and monitoring provided via a physical network firewall. The VF can be realized as a traditional software firewall on a guest virtual machine already running, a purpose-built virtual security appliance designed with virtual network security in mind, a virtual switch with additional security capabilities, or a managed kernel process running within the host hypervisor.
Stonesoft Corporation was a public company that developed and sold network security solutions based in Helsinki, Finland. It was publicly owned until 2013 when it was acquired by Intel's subsidiary McAfee.
A network virtualization platform decouples the hardware plane from the software plane such that the host hardware plane can be administratively programmed to assign its resources to the software plane. This allows for the virtualization of CPU, memory, disk and most importantly network IO. Upon such virtualization of hardware resources, the platform can accommodate multiple virtual network applications such as firewalls, routers, Web filters, and intrusion prevention systems, all functioning much like standalone hardware appliances, but contained within a single hardware appliance. The key benefit to such technology is doing all of this while maintaining the network performance typically seen with that of standalone network appliances as well as enabling the ability to administratively or dynamically program resources at will.
A next-generation firewall (NGFW) is a part of the third generation of firewall technology, combining a traditional firewall with other network device filtering functionalities, such as an application firewall using in-line deep packet inspection (DPI), an intrusion prevention system (IPS). Other techniques might also be employed, such as TLS/SSL encrypted traffic inspection, website filtering, QoS/bandwidth management, antivirus inspection and third-party identity management integration.
SD-WAN is an acronym for software-defined networking in a wide area network (WAN). SD-WAN simplifies the management and operation of a WAN by decoupling (separating) the networking hardware from its control mechanism. This concept is similar to how software-defined networking implements virtualization technology to improve data center management and operation.
IPFire is a hardened open source Linux distribution that primarily performs as a router and a firewall; a standalone firewall system with a web-based management console for configuration.
