Agilio OVS Firewall Software

The Agilio OVS Firewall Software is designed to enable zero-trust stateful security in data centers using OpenStack-based automation. Agilio OVS Firewall Software, combined with Agilio SmartNICs, enable zero-trust stateful security while significantly improving server-based networking performance. Agilio OVS Firewall Software restores valuable CPU cores by offloading OVS and connection tracking (Conntrack) to Netronome’s SmartNICs.

Netronome Firewall Software

Agilio OVS Firewall gives users the ability to define more intelligent filtering policies, security groups, access control lists, and stateful firewall applications. The solution is a drop-in accelerator for OVS, making it compatible with existing network tools, controllers and orchestration software. This, combined with XVIO, now brings the same security and performance to Virtio-based VM workloads.

Features

Netronome Agilio SmartNICs and Agilio software track the features of standard OVS, which are continuously evolving and include server-based networking functions such as flexible match-action forwarding, connection tracking (Conntrack), network overlay control with tunneling protocols such as VXLAN and NVGRE, and fine-grained statistics and meters. These features enable functions such as L2/L3 forwarding, network virtualization, security, load balancing and analytics.

Architecture

Agilio Firewall Software, combined with Agilio SmartNICs augments the Agilio OVS Software product to enable zero-trust stateful security while significantly improving server-based networking performance. Agilio Firewall restores valuable CPU cores by offloading Open vSwitch (OVS), and Linux Connection Tracking (Conntrack) to Netronome’s family of SmartNICs. Provisioning of the zero-trust security policies is enabled through standard OVS interfaces and related OpenStack security group support.

This gives users the ability to define more intelligent filtering policies, security group rules, access control lists, and stateful firewall applications. Agilio OVS Firewall offloads Conntrack from the kernel boosting security performance dramatically. Performing this connection tracking in the NFP, in addition to standard OVS match/action profiles, adds value by offloading and accelerating the enforcement of the most comprehensive policies, thereby eliminating the bottlenecks associated with implementation of zero-trust stateful security within a server.

Benchmarks

Standard OVS and Conntrack without acceleration struggles with packet processing which ties up valuable server CPU resources and creates a bottleneck that starves applications. Netronome Agilio SmartNICs reclaim up to 50% of the server CPU resources previously dedicated to OVS and stateful security, while at the same time delivering 4X or more of the packet data throughput to more applications. For detailed benchmarking results, see the Enabling Efficient and Scalable Zero-Trust Security Whitepaper.