Index

1. Introduction
2. Linux Interfaces for Virtual Networking
3. Open vSwitch, Bridge VEPA Isolated Modes, and IEEE 802.1Qbg
4. Microsegmentation Implementation Methods
   1. Using firewalls on each hypervisor node
   2. Using hypervisor-native tools
   3. Using Private VLANs
   4. Using VEPA and Hairpin
5. Types of Hypervisors and Microsegmentation Support
6. Conclusions

1. Introduction

Microsegmentation is an advanced technique aimed at enhancing the security of virtualized networks by segmenting traffic to reduce attack surfaces and prevent lateral movement of threats. However, despite its theoretical advantages, practical implementation still faces numerous challenges and uncertainties.

Currently, there is no universally adopted solution for microsegmentation. Among the available options, the IEEE 802.1Qbg standard represents a promising path toward providing a standardized and scalable framework. Nevertheless, its adoption by major providers remains limited. Recently, Docker began integrating it, suggesting a potential turning point for the sector.

In the absence of consolidated standardization, choosing the most effective approach remains complex. Although using firewalls on each node or employing native hypervisor tools are technically feasible, they often become difficult to scale and manage long-term. Implementation through Private VLAN (PVLAN) currently appears to be the most viable solution, allowing simpler and more manageable traffic control compared to other more complex strategies.

This document explores various microsegmentation methodologies, analyzing their advantages and challenges, aiming to clearly outline possible implementation choices and their impact on network infrastructure. This initial document will serve as a basis for assessing fundamental challenges in adopting various methodologies.

2. Linux Interfaces for Virtual Networking

Network interfaces in Linux are fundamental components for managing connectivity in virtualized systems. Key types include:

• veth (Virtual Ethernet Pair): A pair interface connecting two Linux network namespaces, enabling communication between containers or VMs.
• bridge: Simulates Layer 2 switch behavior, allowing connections between multiple network interfaces.
• macvlan: Enables multiple containers or VMs to share the same physical interface, each with its own MAC address.
• tap/tun: Virtual interfaces used for VPN creation or routing network traffic between VMs.

These interfaces are often combined with Open vSwitch or microsegmentation configurations for refined network traffic control.

3. Open vSwitch, Bridge VEPA Isolated Modes, and IEEE 802.1Qbg

Open vSwitch (OVS) is an open-source virtual software switch designed for virtualization and cloud environments, providing advanced features like traffic control, dynamic packet forwarding, and microsegmentation support.

Bridge VEPA (Virtual Ethernet Port Aggregator) and isolated modes are specific approaches for managing VM traffic:

• Bridge VEPA: Forwards all VM traffic to an external physical switch, allowing physical network devices to apply advanced security and monitoring policies.
• Isolated Mode: Prevents direct communication between VMs within the same VLAN, forcing traffic through specific network devices like firewalls or routers.

IEEE 802.1Qbg is an emerging technology standardizing VEPA and bridge isolated mode behaviors, enhancing VM traffic management efficiency, security, and scalability.

4. Microsegmentation Implementation Methods

Microsegmentation can be implemented via various strategies controlling virtualized network traffic. Each approach offers specific features, benefits, and drawbacks, making them suitable based on infrastructure security and scalability requirements.

Below are four primary microsegmentation methodologies, each with distinct functionality and impact:

4.1 Using firewalls on each hypervisor node

This method utilizes VETH (Virtual Ethernet Pair) devices to create local Ethernet tunnels between VMs and virtual firewalls on each node. VETH devices are created in pairs, enabling immediate packet transfer between tunnel ends.

• Advantages:
  • Highly granular security control.
  • Effective protection against lateral threat movement.
• Disadvantages:
  • Requires removal of distributed vSwitches.
  • Requires adding 2 virtual firewalls per node for high availability.
  • Significantly increases resource usage.

4.2 Using hypervisor-native tools

Native hypervisor tools provide integrated solutions for microsegmentation and VM network traffic management. Tools like Nutanix Flow for Nutanix AHV or NSX for VMware create security policies directly within virtualization infrastructure.

• Advantages:
  • Native hypervisor integration.
  • Centralized and simplified management.
• Disadvantages:
  • Significant lock-in difficulty.
  • Requires specialized training and difficult integration with other network devices.

4.3 Using Private VLANs

Private VLANs (PVLANs) isolate VMs within the same VLAN, preventing direct inter-VM communication.

• Advantages:
  • Effective isolation without per-node firewalls.
  • Reduces internal VM attack risks.
• Disadvantages:
  • Requires virtual switch support in the hypervisor.
  • Extensive knowledge of network and VM requirements per VLAN.

4.4 Using VEPA and Hairpin

Network traffic between VMs is forced through an external physical firewall using VEPA (Virtual Ethernet Port Aggregator) and Hairpin techniques.

• Advantages:
  • Deep traffic analysis using physical firewalls.
  • Advanced security rules on specialized devices.
• Disadvantages:
  • Significant external traffic increase.
  • Requires virtual switch support in hypervisor.
  • Requires physical switch support.

5. Types of Hypervisors and Microsegmentation Support

(* = Possible but requires CLI configuration, complicating management, especially when creating new VMs or migrating between cluster nodes.)

(** = Open Virtual Switch currently doesn’t support VEPA but implementation is under consideration.)

(*** = Though Nutanix AHV uses Open Virtual Switch, it’s unlikely to implement VEPA or PVLAN to promote its proprietary licensed solution Nutanix Flow.)

6. Conclusions

Microsegmentation is complex and continuously evolving, presenting implementation and scalability challenges. Despite high security and network segmentation benefits, adoption demands advanced skills and adequate infrastructure.

IEEE 802.1Qbg offers a promising standardized and scalable framework, though adoption remains limited, with Docker’s recent integration possibly marking an industry turning point.

Currently, Private VLANs (PVLAN) appear most practical for manageable network segmentation.

Using per-node firewalls or hypervisor-native tools, though feasible, complicates long-term management and scalability, increasing operational complexity and hindering interoperability.

Future industry convergence around open standards like IEEE 802.1Qbg may occur, but the microsegmentation landscape currently remains fragmented and experimental.