Cisco’s new virtual firewall for the multi-tenanted virtualised data centre

“If it takes only one minute to bring up a virtual machine then why should it take a day to get the firewall policies in?” This is the question posed by Rajneesh Chopra, a senior product manager at Cisco, when announcing the new ASA 1000V Cloud Firewall.

The problem is that existing firewalls are designed for physical servers and have an inherent lack of agility and flexibility when the modern data centre is full of virtual devices. ASA 1000V, a virtual version of the current ASA 1000 physical firewalls is designed to solve this problem. It is deployed as a virtual machine on a server, using the proven ASA security technology but optimised for virtual and cloud environments.

It has been developed with the existing Cisco Adaptive Security Appliances (ASA) infrastructure and maintains consistent security with other physical ASA deployments.

It is also designed to complement the existing Virtual Series Gateway (VSG) switches. Where VSG provides zone-based security for intra-tenant communications, the ASA 1000V provides multi-tenant edge security for security between multiple tenants. In short, the ASA 1000V is designed to protect the virtual and multi-tenanted cloud environments while providing consistency across both physical and virtual infrastructures.

In addition to standard firewall capabilities such as filtering and network address translation, the ASA 1000V also provides a comprehensive real-time threat defense and always-on remote access VPN.

Device management is achieved through the Virtual Network Management Centre (VNMC) for virtual devices rather than the Cisco Security Manager which is used for physical devices. VNMC, also used for the VSG series, enables rapid security deployment through template-driven security profiles, and provides an XML API for integration with other third-party management and orchestration tools.

The ASA 1000V is currently in final beta and expected for general release during the first half of 2012. It will be delivered as a software package and will be downloadable as an OVF (Open Virtualisation Format) file.

Written by: Zahid Hassan