Virtual network functions (VNFs) are individual network services, such as routers and firewalls, running as software-only virtual machine (VM) instances on generic hardware. For example, a routing VNF implements all the functions of a router but runs in a software-only form, alone or along with other VNFs, on generic hardware. VNFs are administered and orchestrated within the NFV architecture.

The virtualization of both NFV and VNF denotes that network functions are implemented in a generalized manner independent of the underlying hardware. VNFs can run in any VM environment in the branch office, cloud, or data center. This architecture allows you to:

  • Insert network services in an optimal location to provide appropriate security. For example, insert a VNF firewall in an Internet-connected branch office rather than incur the inefficiency of an MPLS link to hairpin traffic through a distant data center to be firewalled.
  • Optimize application performance. Traffic can follow the most direct route between the user and the cloud application using a VNF for security or traffic prioritization. In a VM environment, several VNFs may run simultaneously, isolated from each other, and can be independently changed or upgraded.

The following tables list the third-party firewalls supported by VMware along with the support matrix:

Table 1. Palo Alto Networks Firewall – Support Matrix
VMware SD-WAN Edge Platform Edge 520v Edge 620 Edge 640 Edge 680 Edge 840 Edge 2000 Edge 3400 Edge 3800
Recommended VM Series Firewall Models VM-50 Lite VM-50 Lite VM-100 VM-100 VM-100 * VM-100 VM-100
Number of vCPUs Available for VM-Series Firewall 2 2 2 2 2 * 2 2
Memory Available for VNF 4.5 GB 4.5 GB 6.5 GB 6.5 GB 6.5 GB * 9 GB 9 GB
Storage Space Available on Edge for VNF 64 GB 64 GB 120 GB 120 GB 120 GB * 220.2 GB 220.2 GB
Earliest Supported VMware Release Release 3.2.0 or later Release 3.4.3 or later Release 3.4.3 or later Release 3.4.3 or later Release 3.2.0 or later Not supported on any release Release 4.3.0 or later Release 4.3.0 or later
Panorama Version Release 8.0.5 Release 8.0.5 Release 8.0.5 Release 8.0.5 Release 8.0.5 * Release 8.0.5 Release 8.0.5
Table 2. Check Point Firewall – Support Matrix
VMware SD-WAN Edge Platform Edge 520v Edge 620 Edge 640 Edge 680 Edge 840 Edge 2000 Edge 3400 Edge 3800
Memory Available for VNF 2 GB 2 GB 4 GB 4 GB 4 GB * 4 GB 4 GB
Number of vCPUs Available for VNF 2 2 2 2 2 * 2 2
Storage Available on Edge for VNF 64 GB 120 GB 120 GB 120 GB 100 GB * 220.2 GB 220.2 GB
Maximum Throughput of SD-WAN and Checkpoint VNF 100 Mbps 100 Mbps 350 Mbps 500 Mbps 550 Mbps * 4.9 Gbps 4.9 Gbps
Earliest Supported VMware Release Release 3.3.2 or later Release 3.4.3 or later Release 3.4.3 or later Release 3.4.3 or later Release 3.3.2 or later Not supported on any release Release 4.3.0 or later Release 4.3.0 or later
Checkpoint VNF OS Version Release R80.20.05, R80.20.35 Release R80.20.05, R80.20.35 Release R80.20.05, R80.20.35 Release R80.20.05, R80.20.35 Release R80.20.05, R80.20.35 * Release R80.20.05, R80.20.35 Release R80.20.05, R80.20.35
Checkpoint Manager Software Version Release R80.40 Release R80.40 Release R80.40 Release R80.40 Release R80.40 * Release R80.40 Release R80.40
Table 3. Fortinet Firewall – Support Matrix
VMware SD-WAN Edge Platform Edge 520v Edge 620 Edge 640 Edge 680 Edge 840 Edge 2000 Edge 3400 Edge 3800
Recommended VM Series Firewall Models VM00, VM01, VM01v VM00, VM01, VM01v VM00, VM01, VM01v, VM02, VM02v VM00, VM01, VM01v, VM02, VM02v VM00, VM01, VM01v, VM02, VM02v * VM01, VM02 VM01, VM02
Memory Available for VNF 2 GB 2 GB 4 GB 4 GB 4 GB * 4 GB 4 GB
Number of vCPUs Available for VNF 2 2 2 2 2 * 2 2
Storage Available on Edge for VNF 64 GB 64 GB 100 GB 100 GB 100 GB * 220.2 GB 220.2 GB
Maximum Throughput of SD-WAN and FortiGate VNF 100 Mbps 100 Mbps 500 Mbps 500 Mbps 500 Mbps * 1.5 Gpbs 1.5 Gbps
Earliest Supported VMware Release Release 3.3.1 or later Release 4.0.0 or later Release 4.0.0 or later Release 4.0.0 or later Release 3.3.1 or later Not supported on any release Release 4.3.0 or later Release 4.3.0 or later
FortiOS Version Release 6.2.4 Release 6.2.4 Release 6.2.4 Release 6.2.4 Release 6.2.4 * Release 6.2.4 Release 6.2.4

You can deploy and forward traffic through VNF on an SD-WAN Edge.