Toolify Toolify logo
open
Home Hardware Boost Network Security Performance: NSX DFW Policy Offloading with BlueField DPU

Boost Network Security Performance: NSX DFW Policy Offloading with BlueField DPU

Updated on Apr 05,2024

Boost Network Security Performance: NSX DFW Policy Offloading with BlueField DPU

Table of Contents:

  1. Introduction
  2. Creating a NSX Distributed Firewall Policy
  3. Offloading the Firewall Policy to an Nvidia Bluefield DPU
  4. Creating a Demo Policy in NSX
  5. Adding a DNS Rule to the Policy
  6. Applying the Rule to the Firewall
  7. Enabling Logging and Creating a Label for the Rule
  8. Publishing the Changes and Checking System Configuration
  9. Checking Distributed Firewall Rules on the Host and DPU
  10. Inspecting Traffic and Rejecting DNS Packets
  11. Allowing DNS Traffic and Republishing the Changes
  12. Verifying the Changes and Monitoring Traffic
  13. Conclusion

🧰 Creating a NSX Distributed Firewall Policy

In this article, we will explore the process of creating and configuring a NSX distributed firewall policy. This policy will be then offloaded to an Nvidia Bluefield DPU within a Lenovo server. By offloading the firewall policy to the DPU, we can enhance the performance and efficiency of our network security infrastructure.

Introduction

The NSX distributed firewall is a key feature that allows us to define and enforce security policies in a distributed manner across our network. By distributing the firewall functionality, we can achieve better performance and scalability while ensuring the security of our network traffic.

2. Creating a NSX Distributed Firewall Policy

To begin, we need to create a new policy within NSX. By accessing the security and distributed firewall feature in NSX, we can see the default rules that come with any NSX installation. However, we need to add our own policy to fulfill our specific requirements.

3. Offloading the Firewall Policy to an Nvidia Bluefield DPU

The next step is offloading the created firewall policy to an Nvidia Bluefield DPU within our Lenovo server. This combination of Hardware allows us to offload the distributed firewall from the host to the DPU, enhancing the overall performance and efficiency of our network security.

4. Creating a Demo Policy in NSX

After accessing the security and distributed firewall feature within NSX, we can create a new policy for demonstration purposes. This demo policy will serve as an example to showcase the functionality of the distributed firewall.

5. Adding a DNS Rule to the Policy

For this demonstration, we will create a specific DNS rule within the demo policy. The objective of this rule is to block and allow DNS traffic as per our requirements. We can achieve this by navigating to the services section and filtering on DNS. Here, we will select all types of DNS traffic.

6. Applying the Rule to the Firewall

Once the DNS rule is created, we need to apply it to our distributive firewall that is being offloaded to the Nvidia Bluefield DPU. We can also choose to reject any packets that hit on this rule to further enhance the security of our network.

7. Enabling Logging and Creating a Label for the Rule

To monitor the effectiveness of our DNS rule, we can enable logging and create a label for the rule. By turning on logging, we can track and analyze the traffic that is being inspected and processed by the distributed firewall. The label helps us identify the rule and its purpose easily.

8. Publishing the Changes and Checking System Configuration

After making all the necessary changes to our distributed firewall policy, we have unpublished changes within NSX that need to be pushed out to the firewall. We can publish these changes and then wait for the progress update to ensure the changes are successfully applied.

9. Checking Distributed Firewall Rules on the Host and DPU

To verify the distribution of the firewall rules, we can check the rules Present on both the host and the DPU. The ESXi host should have no rules present, indicating that the rules are being offloaded to the Nvidia Bluefield DPU. We can confirm that the DNS demo rules we created within NSX are applied on the DPU.

10. Inspecting Traffic and Rejecting DNS Packets

To further validate the functionality of the distributed firewall, we can tail the distributive firewall raw logs on the ESXi host and the DPU. By doing a TCP dump for DNS traffic on the receiver VM and performing an NS Lookup on the sender VM, we can observe that the ESXi host receives no traffic while the distributed firewall on the DPU inspects and rejects the DNS packets.

11. Allowing DNS Traffic and Republishing the Changes

After observing the rejection of DNS traffic, we can go back to NSX and modify the rule to allow DNS traffic instead. We need to republish the changes to the distributed firewall and wait for the changes to take effect.

12. Verifying the Changes and Monitoring Traffic

Once the changes are published, we can again monitor the traffic by tailing the logs and performing the same exercise of TCP dump for DNS traffic and NS lookup. This time, we will Notice that the receiving VM is now receiving DNS traffic, and the DPU is logging that the traffic is being allowed through. On the other HAND, the host still shows no applied rules.

13. Conclusion

In conclusion, we have demonstrated the process of creating a NSX distributed firewall policy, offloading it to an Nvidia Bluefield DPU within a Lenovo server, and verifying its functionality by inspecting and processing DNS traffic. By offloading the firewall policy, we can achieve better network performance and efficiency while ensuring the security of our network infrastructure.

Highlights:

  • NSX distributed firewall policy offloading to Nvidia Bluefield DPU
  • Enhancing performance and efficiency of network security
  • Creating and configuring a demo policy
  • Adding DNS rule and filtering on DNS traffic
  • Applying rules and enabling logging for monitoring
  • Verifying firewall rules on host and DPU
  • Inspecting traffic and rejecting DNS packets
  • Allowing DNS traffic and republishing changes
  • Monitoring traffic and validating changes
  • Enhancing security and performance with the distributed firewall

FAQ:

Q: What is NSX distributed firewall? A: NSX distributed firewall is a feature that allows the creation and enforcement of security policies in a distributed manner across a network.

Q: Why is offloading the firewall policy to an Nvidia Bluefield DPU beneficial? A: Offloading the firewall policy to a DPU can enhance network performance and efficiency by relieving the host from the firewall processing tasks.

Q: How can I create a demo policy in NSX? A: To create a demo policy in NSX, you need to access the security and distributed firewall feature and follow the steps outlined in the article.

Q: Can I customize the DNS rule within the demo policy? A: Yes, you can customize the DNS rule by selecting the desired types of DNS traffic to block or allow according to your requirements.

Q: How can I verify that the distributed firewall rules are applied correctly? A: By checking the firewall rules on both the host and the DPU, you can confirm that the rules are being offloaded to the DPU and applied as intended.

Q: What are the benefits of enabling logging and creating a label for a rule? A: Enabling logging allows you to monitor and analyze the traffic being inspected by the distributed firewall. Creating a label helps you easily identify the purpose of the rule.

Q: What happens when the DNS rule is modified to allow traffic instead of blocking it? A: Once the DNS rule is modified to allow traffic, the distributed firewall will now permit the specified DNS packets to pass through the network.

Resources:

Unleash the Potential of EVGA SR3 Dark: The Ultimate Xeon Workstation Motherboard
Test Your Ship's Maneuvering Thrusters for Safe Navigation

Most people like

Related Articles
Top AI Tools
More Tools
Recommend
Resourse
Browse by Alphabet
Top 1000 AI Tools Directory
Read more
About
Contact Us
toolify
Toolify, The Best AI Websites & AI Tools Directory
English 简体中文 繁體中文 한국어 日本語 Português Español Deutsch Français Tiếng Việt

Copyright ©2026 toolify