resiliency-of-vm-nic-firewalls.html

---
date: 2013-04-24T06:59:00.000+02:00
tags:
- firewall
- workshop
- virtualization
- high availability
title: Resiliency of VM NIC firewalls
url: /2013/04/resiliency-of-vm-nic-firewalls.html
---

<p>Dmitry Kalintsev left a great comment on my <a href="https://blog.ipspace.net/2013/04/are-you-ready-to-change-your-security.html?showComment=1365545262207">security paradigm changing</a> post: </p>
<blockquote class="cite">I have not yet seen redundant VNIC-level firewall implementations, which stopped me from using [...] them. One could argue that vSwitches are also non-redundant, but a vSwitch usually has to do stuff much less complex than what a firewall would, meaning chances or things going south are lower.</blockquote>
<p>As always, things are not purely black-and-white and depend a lot on the product architecture and implementation.<!--more--></p>
<h4>VM NIC firewalls implemented in VMs</h4><p>Products like vShield App/Zones implement the <a href="https://blog.ipspace.net/2012/11/virtual-firewall-taxonomy.html">VM NIC firewall functionality</a> in a separate VM running on the same host as the protected VM – all the traffic sent and received by the protected VM has to traverse a non-redundant firewall VM:</p>
<div class="separator"><a href="/2013/04/s1600-VGW_SlowPath.png" imageanchor="1" style="margin-left:1em; margin-right:1em"><img border="0" height="178" src="/2013/04/s320-VGW_SlowPath.png" width="320"/></a></div>
<p>You could configure what happens when the firewall VM crashes in vShield release 5 and later – it’s either fail-open or fail-close, but neither one is a good option. vSphere HA cluster doesn’t react to firewall VM crashes (why should it), leaving the VMs residing on the same host either unprotected or isolated from the network.</p>
<p class="info">vShield Edge is a totally different beast – the latest release has high-availability features including stateful failover ... but then it’s a routed firewall, not a VM NIC firewall.</p>
<p><a href="https://blog.ipspace.net/2012/10/cisco-virtual-security-gateway-vsg-101.html">Cisco’s VSG</a> is a totally different story – it has <a href="http://www.cisco.com/en/US/docs/switches/datacenter/vsg/sw/4_2_1_VSG_1_3_1/vsg/configuration/guide/vsg_config_high_availability.html">full high-availability with stateful failover</a>.</p>
<h4>VM NIC firewalls implemented in the hypervisor kernel</h4><p>Although Juniper’s vGW uses the same API as VMware’s vShield App firewall, its implementation is totally different – <a href="https://blog.ipspace.net/2011/11/junipers-virtual-gateway-virtual.html">all the firewalling functionality is implemented in a loadable vSphere kernel module</a>. The control VM (still running on the same vSphere host) is used solely for configuration, monitoring and logging purposes, and you can have a HA pair of them (on each vSphere host) in mission-critical environments.</p>
<div class="separator"><a href="/2013/04/s1600-VGW_FastPath.png" imageanchor="1" style="margin-left:1em; margin-right:1em"><img border="0" height="178" src="/2013/04/s320-VGW_FastPath.png" width="320"/></a></div>
<p>I can only guess what happens if the vGW kernel module crashes, but hopefully it brings down the whole vSphere host, in which case vSphere HA kicks in and restarts the VMs on other hosts in the same cluster.</p>
<h4>Firewall impact on hypervisor host</h4><p>Dmitry raised another valid point: “<em>There's a non-insubstantial risk of firewall module consuming too much of the host resources, and either slowing down network for collocated VMs, or starving them of CPU (or both).</em>” </p>
<p>Obviously that can always happen (although I would be more concerned about the explosion of connection tables), but <a href="https://blog.ipspace.net/2010/08/i-dont-need-no-stinking-firewall-or-do.html">physical firewalls fare no better</a> (see also <a href="https://blog.ipspace.net/2010/08/i-dont-need-no-stinking-firewall-or-do.html?showComment=1282223383000#c6942259205103401245">this comment</a>). You have to choose your poison: do you want a single vSphere host to be hosed (DRS would probably save the day in VMware environments and spread the load across the cluster) or do you want your Internet-facing firewall to be hosed and bring down the whole data center? Obviously you can also decide not to have firewalls at all and rely solely on hardened hosts ;)</p>
<h4>More information</h4><p><a href="http://www.ipspace.net/Virtual_Firewalls">Virtual Firewalls</a> webinar has a more detailed overview of virtual firewall solutions (including VM NIC firewalls) and description of individual products for VMware, Hyper-V and Linux environments.</p>
<p>Advantages and drawbacks of virtual firewalls are also one of the topics of my <a href="http://www.interop.com/lasvegas/conference/it-workshops.php?session_id=4">Network Infrastructure for Cloud Computing</a> workshop @ <a href="http://www.interop.com/lasvegas/">Interop Las Vegas</a>, so make sure you drop by if you plan to attend Interop.</p>