Over the past couple of days, I was out at VMworld 2009 atĀ Moscone CenterĀ in San Francisco, which is a trade show put out by the fine folks atĀ VMware. While it was not my "official" job,Ā I did do a bit of booth duty atĀ Check Point's booth. It's been a while since I've done that.
While there, I met a couple people I've been meaning to meet for years: Randy Bias, the guy behindĀ Cloudscaling, andĀ Chris Hoff (a.k.a. Beaker). I also got to experience first-hand at the show was the absolutely spectacular epic fail that is AT&T's wireless network during a trade show at Moscone Center. Full signal, yet calls were dropping like flies. Data might as well have been GPRS for all the speed I wasn't getting. It was horrible. Why AT&T doesn't have several microcells inside Moscone with either a fiber link or several DS3s for backhaul is absolutely beyond me.
Meanwhile, back to VMworld and why Check Point was there. We were demonstratingĀ Security GatewayĀ R70 Virtual Edition (or R70 VE for short). The main difference between the R65 VE we ship today and R70 VE, aside from the new Software Blades architecture, is the level of integration with the VMware environment. Specifically, we use theĀ VMsafe APIsĀ provided by VMware, which give us a whole new level of visibility into the networking that goes on inside aĀ VMware ESXĀ server.
If you wanted to see what was going through every port in a physical switch, you might have some trouble either setting up mirror ports for everything or network taps. In VMware with the new VMsafe APIs, applications like R70 VE can seeĀ everythingĀ going through the virtual switch and can block it as appropriate.
In our demo, we show a couple of virtual machines hooked up to a virtual switch along with a separate VM for R70 VE. One of the VMs is compromised and starts "attacking" the other. These VMs and the R70 VE VM are on the same logical subnet, hooked to the same virtual switch. R70 VE is able to successfully block the attacking traffic using theĀ IPSĀ blade.
The good news for the firewall administrator is that this virtual gateway is managed with the same set of tools you use today: SmartCenter and all of the SmartConsole apps. It feels just like a gateway on a physical appliance, except it is running inside a virtual machine.
R70 VE is not shipping today. The code shown at VMworld is of alpha quality. We are expecting a Q4 2009 release timeframe, but that is not final and is subject to change.If you're looking for more details, let me know and I'll hook you up.