Strengthening Cloud Security with Intelligent Microsegmentation

Summarize this blog article with AI:

Ask ChatGPTAsk GrokAsk PerplexityAsk ClaudeAsk Google AI

As organizations reassess their VMware environments, security is increasingly part of the virtualization modernization decision. The goal is not only to migrate workloads, but also to reduce lateral-movement risk, improve visibility into east-west traffic, and apply security policies that can keep pace with dynamic cloud operations.

This challenge is becoming more urgent as application environments grow more distributed and business dependencies become harder to map. Traditional perimeter controls cannot fully protect traffic between workloads inside the data center, while manually maintaining rules for hundreds or thousands of VMs can create operational complexity and increase the risk of blocking legitimate services.

This article examines how microsegmentation has evolved, why policy design remains difficult, and how Sangfor combines traffic visibility, identity-based distributed firewalling, intelligent policy recommendation, and pre-enforcement validation to strengthen cloud security during VMware replacement.

PART 1. Microsegmentation and Policy Recommendation Approaches

1. Microsegmentation Implementation Models

Virtualization-Native Model

The hypervisor or virtualization platform provides protection between VMs as a native capability. This model offers flexibility, scalability, and close integration with networking, security, and VM management.

Hardware-Centric Model

Physical security or switching appliances consume cloud-platform APIs to protect cloud traffic. This model can suit relatively static private clouds but is less effective for dynamic hybrid environments with mobile or temporary workloads and may introduce traffic choke points.

Agent-based Model

Security vendors operate independently of the hardware and hypervisor, usually requiring an agent in each VM or integration with multiple hypervisors. This can support mobile workloads, but deployment and policy operations may become complex at scale.

Sangfor therefore implements its distributed firewall and microsegmentation capabilities natively within the virtualization platform.

2. Why Microsegmentation Rules Are Difficult to Manage

Microsegmentation requires policies for individual VMs and application types, together with continuous updates. Existing and new applications may have complex east-west and north-south dependencies, and legacy application owners may no longer be available. Missing a legitimate flow can cause a new rule to interrupt normal access.

VMs are also created, deleted, stopped, started, and migrated frequently. IP addresses, workload identifiers, and application versions change, requiring security policies to be updated continuously.

3. Microsegmentation Policy Recommendation Approaches

Some products use machine learning to analyze historical traffic and workload context, automatically creating groups, labels, and recommended policies. Although powerful, repeated generation of new groups and labels can increase management complexity.

Sangfor uses existing VM labels, VM groups, or selected workloads to define the policy scope, and then derives recommended DFW rules from observed historical traffic flows. This preserves the customer’s existing workload organization while reducing the need to create additional automatically generated labels.

PART 2. Sangfor Microsegmentation in Detail

1. Network Traffic and Access Visualization

The network traffic and access visualization collector sends traffic to the aNI (Network Insights) through an out-of-band path. The aNI analyzes the collected traffic and stores the results in the aNI database for administrator queries.

Figure 1. Logical architecture of Sangfor network traffic and access visualization.

Specific capabilities include:

• Firewall rule intent validation to determine whether access traffic complies with policy, quickly isolate abnormal traffic, and help administrators configure access policies more effectively.
• Visualization of business access traffic and access relationships to help administrators optimize application topology.
• Identification of the attack blast radius, enabling administrators to rapidly isolate the smallest necessary set of affected workloads.
• Historical access-detail queries to help administrators analyze access relationships for specified applications, locate problems more quickly, and improve operational efficiency.
• Export of historical access details for analysis and statistical processing on internal analytics platforms.
• 100% sampling of business access traffic with virtually no loss of network-forwarding performance within the supported deployment scale, ensuring that access traffic and access relationships are not missed.

Traffic and access visualization provides the following advantages:

• Access-relationship data is exported through an out-of-band path, supporting high-concurrency and high-throughput scenarios with minimal impact on network-forwarding performance.
• The aNI database uses a time-series database to store analytical data. It supports data aggregation and compression, reducing storage-capacity and performance requirements. It also supports broad queries across 30 days, real-time data ingestion, fast aggregation and analysis, and interface response within three seconds.

2. Identity-Based Microsegmentation (Distributed Firewall)

Sangfor Cloud Platform provides a distributed firewall (DFW) that extends security from the data center perimeter to the infrastructure core. It enables microsegmentation between virtual machines and provides Layer 3 to Layer 4 protection for internal data center traffic, reducing the potential impact of attacks inside the data center.

• Comprehensive protection for all VMs: Protection can be configured on any distributed-switch port to control access. Traffic entering and leaving a platform zone can be protected to implement microsegmentation, and policies follow VMs when their runtime location changes.
• Rapid policy activation: Sangfor Cloud Platform can deploy the distributed firewall directly without requiring users to install plug-ins. The architecture is simple, visual policy design simplifies operations, and integration with connectivity detection accelerates troubleshooting and shortens problem-location time.
• Simplified network architecture and troubleshooting: The distributed firewall is provided natively by the platform. Combined with visual policy design, the architecture is simple and easy to operate. BYPASS mode and block-log display help administrators verify rule effectiveness quickly. Connectivity detection further accelerates troubleshooting and reduces problem-location time.
• Joint protection with Sangfor virtual Next-Generation Firewall Athena vNGFW: DFW uses a distributed architecture, allowing policies to take effect across the platform and commonly controlling traffic inside virtual networks. Athena vNGFW is typically deployed at the perimeter to provide maximum protection against attacks from external traffic.
• Flexible policy objects: Policies can specify VMs, VM groups, VM labels, IP addresses, IP groups, and IP ranges. VM groups and VM labels can serve as application identity attributes for VMs.
• Comprehensive internal and external protection: The distributed firewall is available once the virtual network service (aNET) is enabled. DFW and Athena vNGFW work together across north-south and east-west traffic, and across external and internal paths, to provide comprehensive data center protection.

3. Intelligent Microsegmentation Policy Generation

Intelligently Generate Microsegmentation Rules from Historical Traffic-Visibility Data

The aNI collect access relationships reported by the data plane (DP) and store them in the Druid database. Based on administrator settings, including the protected object, date, protection direction, and rule granularity, the microsegmentation service (SEG) filters access relationships from the Druid database, generates DFW rules, and provides a rule preview that administrators can modify.

Innovation: Pre-Enforcement Validation for Microsegmentation Rules

aNET and the data plane provide DFW pre-enforcement capability. After administrators place the generated rules into pre-enforcement, those DFW rules perform matching and logging only, without enforcing the configured action. If a request first matches a pre-enforcement rule, processing continues to the active production rules, and both the matched pre-enforcement rule and active rule are reported to aNI. If the request first matches an active production rule, rule matching ends and the matched active rule is reported to aNI.

Flows that would be denied by the staged DFW rules are highlighted as potential unintended blocks. Because staged rules operate in monitor-only mode, production traffic is not interrupted.

Sangfor provides an innovative pre-enforcement capability for intelligent policy recommendations. This helps administrators observe policy behavior and make further adjustments before activation, preventing insufficiently validated recommended policies from affecting production services.

Potential False-Positive Alerts

After administrators complete the pre-enforcement observation and adjustment process, they can convert the rules into active DFW rules. Matching traffic then follows the configured action, such as block or allow. Potential false-positive notifications remain available, enabling administrators to quickly allow legitimate traffic that was blocked incorrectly.