Virtualization Technology News and Information
The Cloud Firewall: A No-Compromise Zone

By Amir Khan, CEO of Alkira

Migrating firewalls to the cloud shouldn't be at the expense of control

The data center is the best place for enterprise firewalls - or it was, until the cloud.

Three-quarters of enterprises responding to a recent survey by Deloitte said they now run more than half of their enterprise IT as a service. The same survey found that security remains the biggest concern holding back enterprise as-a-service technologies.

Enterprises have hesitated to move firewalls to the cloud for the same reason that they have kept other services in the data center: they take longer to deploy, are more complex to configure and harder to manage in the cloud. The arguments against cloud firewalls become even more compelling when the organization wants to move workloads and applications into multiple clouds.

Yet in the cloud era, providing services centrally from the corporate data center makes no sense. Backhauling traffic to the data center, typically over MPLS connections, is inefficient, expensive and slow.

When the applications and data move to the cloud, it's logical to move the firewall too, but that's easier said than done.

Spinning up a VM in the cloud is not a big deal. How you manage it once it's there is the difficult bit.

Virtualizing firewalls in the cloud raises a number of operational issues around availability, throughput, network segmentation, traffic steering, elasticity and monitoring. The security team needs to be able to monitor the health of the firewall for performance and they need to be able to enforce enterprise security policies just as they would in an on-prem set-up.

Our vision of cloud networking, Alkira's Network Cloud, resolves this lose-lose dilemma.  Connectivity is only half the story. The critical part is how you provision the network services on top and manage them. Historically, security vendors have not been great at enterprise-class networking and networking vendors have not been great at providing strong security products. With partners, such as Palo Alto Networks, we give customers access to best-of-breed firewall solutions, while we supply the best-of-breed network services infrastructure needed to deliver the ease of connectivity, manageability and flexibility that enterprises demand. This best of breed approach enables the Alkira Network Cloud to provide a very different approach to SASE while still agreeing the main premise that networking and security must be addressed in an integrated way.

Our as-a-service platform leverages the near-infinite compute capability of the cloud to deliver performance that auto-scales up and down according to need. That capability applies to every service running over it, including firewalls, taking care of the performance and availability issues.

Critically, because Alkira is cloud-agnostic by design, services such as firewalls can be deployed and managed in the same way whether in single or multi-cloud or hybrid environments. 

Firewall administrators can manage the firewall just as they would in the data center, for example with the ability to apply intent-based policies to intra-zone and inter-zone traffic, and do network segmentation and micro-segmentation with advanced policy-based routing controls.

Software licensing is another management task that customers would like to see simplified. Because the network cloud is delivered as a service, firewall capacity can either be on a pay-as-you-go basis or provided under the terms of an existing license.

Security is more important and challenging than ever as we enter an era of cloud-enabled hyper-distributed applications. In this environment, the cloud firewall has to be a no-compromise zone.

For more information about how to build your own no-compromise zone, please see:



Amir Khan 

Amir Khan founded and led Viptela, the company that pioneered the $8 billion SD-WAN market and was sold to Cisco for $610 million in 2017. Recognising that enterprises were struggling to build networks within and between clouds, Amir and his brother Atif founded Alkira to provide a virtual network as a service (NaaS) for the cloud era. Alkira's platform delivers connectivity, integration, visibility and control to enterprise networks spanning multiple clouds and legacy environments. Before Viptela, Amir held leadership roles at Cisco, Juniper, and Nortel. Amir's holds four patents and trained as an engineer. He earned an MS in electrical engineering from the University of Colorado at Boulder, and a BS in electrical engineering from the University of Mississippi.

Published Thursday, July 08, 2021 7:29 AM by David Marshall
Filed under:
There are no comments for this post.
To post a comment, you must be a registered user. Registration is free and easy! Sign up now!
<July 2021>