Virtualization in Network security - Present and future

Service providers are increasingly providing security services at their edge for their customers. Firewall, IPsec VPN, IPS and P2p rate throttling are some of the security services provided by service providers. SPs are providing this functionality using virtualization capability provided by many security appliance vendors. Virtualization provided is at the level of instantiating configuration and run time states. That is, for each customer, there is separate routing table, firewall session table, configuration tables, Ipsec SA table etc.. But the code and data segments are shared. With role based management, different customer accounts are handled by different admin personnel of service provider.

Here is the question. Do Xen/VmWare/KVM based virtualization technology replace current security virtualization? Note that in this virtualization, there would be as many VM instances as number of virtual instances (customers) required. Each virtual instances has its own OS and security application in addition to configuration and run time states.

Advantages of Xen/VmWare/KVM based virtualization:

• It provides isolation : If there is any software problem, only current instance is effected. In case of traditional virtualization provided by security vendors, any software problem brings down the entire system.
• It provides mechanism to assign CPU for each virtual system.
• It provides mechanism to control memory used by each virtual system.
• It provides mechanism to control bandwidth used by each virtual system.
• Basically, it is true virtualization.

Disadvantages of this type of virtualization over traditional virtualization:

• It requires as many virtual machines as number of customers.
  
• Memory requirements are too high
  
• CPU utilization is very high.
• System Performance would be way less
• High cost.

In summary, if the number of virtual instances needed are more than few dozen, then traditional security virtualization is the choice for service providers. Traditional virtualization provides optimal cost and performance over Xen/VmWare based virtualization. I have a feeling that Vmware/Xen based virtualization becomes popular in Enterprise environments where it can replace multiple security appliances. But, in case of service providers market, traditional virtualization would be used for some more years to come.