Tue, July 07, 2009 — Network World — Altor Networks has rewritten its firewall for virtual machines so the software plugs directly into VMware hypervisors, boosting the performance of the firewall by a factor of 10, the company says.

ABC: An Introduction to Virtualization

With Altor VF 3.0 software, the firewall can be integrated via VMsafe application programming interfaces published by VMware earlier this year. This enables the firewall to see traffic as it moves through the hypervisor between virtual machines (VM) on the same physical host, the company says.

Altor rewrote the firewall software so it could connect to the hypervisor via what VMware calls a Fast Path connection. This provides a direct link to the hypervisor for processing rather than through a VM, the path method that is 10 times slower, Altor says.

Return on investment for this type of firewall integration is also faster because each physical machine winds up with more processing power left over to dedicate to virtual machines, says Ted Ritter, a senior research analyst with Nemertes Research.

"If the firewall chews up a whole core on a four–core processor, that's 25% of the performance I’m giving to it," he says.Tying the firewall into the hypervisor is more efficient than the slow path method that runs the firewall through a VM.

With the new software release Altor is adding an intrusion-detection system (IDS)powered by Snort with malware signatures provided and updated by Sourcefire. Along with that the IDS monitors attempted connections to the hypervisor to flag possible attacks against it. Logs from the IDS could be used by auditors to demonstrate whether the hypervisor was violated, the company says.

Like the firewall, the IDS is geared to virtual environments and is not meant to take the place of a network-grade firewall, Ritter says. "Their IDS just handles the bare minimum to protect virtual machines and assumes you still have a physical IDS at the perimeter of the network to do the bulk of the work," he says. "The same thing with the firewall."

Locking security applications into the hypervisor means they see and can act on all traffic in and out of all VMs on a host, the company says. This enables defense in depth in a virtual environment by layering security on all VMs.

Altor VF 3.0 supports hot standby of its Altor Center firewall management software so if one instance fails the other can take over to provide a view of traffic within the virtual environment. This is important because virtualization promises better uptime than physical environments, so avoiding security failures is important to boost reliability, Ritter says.

© 2007 Network World Inc.