“Buying separate physical firewalls for 20 enterprise datacenter tenants is cost-prohibitive. Virtualizing a Cisco FWSM blade into isolated Security Contexts provides dedicated firewall policy per tenant.”

In 2012, scaling Net4 India’s VPS and managed cloud platform required delivering dedicated firewall management to enterprise hosting customers.

Architecture: Multi-Tenant Virtual Security Contexts & MPF

We partitioned a Cisco Firewall Services Module (FWSM) blade installed in a Cisco Catalyst 6506-E core switch into isolated Security Contexts.

• Admin Context: System administrator domain allocating physical VLAN interfaces to virtual firewalls.
• Tenant Security Contexts: Virtual firewalls running independent NAT rules, interface ACLs, and Modular Policy Framework (MPF) inspection engines per tenant.
• Modular Policy Framework (MPF): Deep packet inspection matching SQL and HTTP traffic to block SQL injection attempts at Layer 7.

[!IMPORTANT] Allocate strict resource class limits (max TCP connections, embryonic connections) per FWSM Security Context to prevent one tenant’s SYN flood from crashing neighboring virtual firewalls.

# # Cisco FWSM System Execution Mode Configuration
mode multiple

context TENANT-A-FW
  allocate-interface VLAN110
  allocate-interface VLAN111
  config-url disk0:/configs/tenant-a.cfg

context TENANT-B-FW
  allocate-interface VLAN120
  allocate-interface VLAN121
  config-url disk0:/configs/tenant-b.cfg

The Verdict

Key Takeaway

Virtualize Hardware Security Blades to Achieve Scalable Multi-Tenant Firewall Isolation.

Partitioning Cisco FWSM Security Contexts delivers tenant-isolated firewall policies, independent NAT tables, and MPF inspection while maximizing core switch slot utilization.