As virtualization spreads and network virtualization deepens, the range of service types within data centers continues to grow and application systems are becoming increasingly complex, leading to ever more severe internal and external security threats. Against this backdrop, a network architecture based on zero trust principles and more granular network isolation, known as micro-segmentation, has emerged.
Micro-segmentation (or "micro-isolation") is a network isolation technology built for the virtualized world. It divides a data center's internal network into multiple logical zones that can be protected independently. These zones can be created across the physical boundaries of the data center and across different cloud environments. It is mainly used to prevent lateral ("east-west") movement attacks once an attacker has gained access to an enterprise data center's internal network. It represents a specific implementation of software-defined networking and security.
Micro-segmentation-based networks enable rapid interconnection within data centers, security compliance, elastic scaling, and automatic recovery. They also allow network configurations, including forwarding policies and security policies, to be added, updated, and deleted quickly through automated methods. IT managers can use micro-segmentation to dynamically group resources within the data center at the workload, application, operating system, or virtual machine level. This enables flexible deployment of security policies between groups, providing fine-grained, targeted security isolation and control for different nodes. Thanks to its inherent automation, granularity, and zero trust characteristics, micro-segmentation can respond promptly to a wide range of unpredictable security threats. This reduces the complex, error-prone manual configuration that would otherwise fall on IT teams.
The ANS distributed firewall's micro-segmentation function is designed for ACOS (AVE) virtualization scenarios. It uses a management and control platform built on the Kubernetes cloud-native framework, combined with virtual distributed switches, to support three forms of distributed firewall policy: VM quarantine, custom security policies, and deny communication by default. It is designed to address the challenges of virtual network security in data centers, providing flexible, fine-grained network security protection that meets the requirements of a "zero trust architecture."
An ACOS (AVE) virtual distributed switch (VDS) is a distributed switch at the virtualization layer, defined by a group of physically connected network ports (which can be combined via network port bonding). It provides the foundation for the storage network, management network, and VM network.
The ANS distributed firewall is built on a zero trust network architecture and supports application-centric security policies. The figure below shows the data center's network security model after micro-segmentation has been applied: the exterior of the data center is isolated by a perimeter firewall, while micro-segmentation provides security rule protection for each VM network internally. Administrators no longer need to focus heavily on network topology and configuration, which significantly reduces their workload while also improving the reliability and flexibility of the data center's network security.
Compared with traditional network segmentation schemes, ANS micro-segmentation offers the following key technical features:
Multiple levels of grouping for data centers
ANS micro-segmentation offers finer-grained control, allowing every virtual machine and every K8s Pod to be grouped and have security policies applied to it. This results in more precise logical security domains, aligning with the zero trust security model's requirement for minimal access permissions.
Security policies based on workload attributes
Traditional networks typically configure and manage security policies based on network IP addresses. Every virtual NIC on a data center's virtual machines is assigned an IP address, and as the workload expands or changes, these addresses often need frequent updates. In addition, a Pod's IP address changes whenever the Pod is rebuilt or migrated, making it difficult to bind an IP address to the services the Pod hosts. ANS micro-segmentation instead defines target VM groups and Pod groups based on workload attributes, using labels or security groups, and sets security policies directly for these groups rather than basing them on IP addresses. This removes the network IP address as a troublesome element for administrators to manage.
Flexible adaptation to changes in data center network topology
Data centers contain large numbers of nodes that change frequently, and virtual machines are often migrated to meet shifting service requirements. ANS micro-segmentation automatically adapts to these virtual machine changes and keeps them associated with the corresponding security policies, reducing both manual intervention and the cost of managing security policies.
The ANS distributed firewall offers the following advantages:
Usability
Scalability
High availability
Wide compatibility
