Virtual firewall design: virtualising the firewall layer.
VLAN trunking, deduplicated backups and fast VM recovery, for estates where the firewall shares hardware with everything else. The design holds whichever virtualisation platform fits your licences and skills.
NetSecure Labs · Architecture 04
Why virtualise the perimeter at all?
In smaller plants, a virtual firewall removes a box, shares the cluster's redundancy and makes configuration snapshots trivial. The trade-off is that the virtualisation host becomes part of your security boundary, so it has to be designed that way.
Trunking
WAN and LAN interfaces are passed to the firewall VM as dedicated virtual NICs. Internal VLANs ride an 802.1Q trunk so that the firewall, not the virtualisation host, enforces inter-VLAN policy. That keeps the 7-VLAN matrix intact wherever the VM runs.
Protecting the hosts
- Deduplicated, encrypted, incremental backups of every VM. Incrementals finish in under 90 seconds in our builds.
- Image-level protection with changed-block tracking and instant VM recovery for the firewall, ERP and production-planning workloads.
- Encrypted offsite copies of firewall configuration, so a replacement can be rebuilt in minutes.
Licensing changes
Recent licensing changes in commercial virtualisation have turned hypervisors into a budget line many MSMEs never planned for. We run mixed estates in production. At a multi-site laser fabrication plant, one platform hosts the directory and remote-desktop servers, while another hosts the virtual firewall, ERP and production-planning tool. We migrate when it pays for itself, not on a vendor's timetable.
Performance notes
For remote-desktop servers we use paravirtualised disk controllers with dedicated I/O threads and 10G virtual NICs. That supports 30+ concurrent manufacturing users.