As server virtualization becomes more established, there is a strong demand for virtualization of so-called appliance devices on the network, in other words,”network devices that run on a hypervisor,” in order to achieve even greater infrastructure flexibility.
For organizations and businesses considering providing “cloud computing” or shared infrastructure services using cloud computing technology, the existence of virtual appliances that can quickly deploy network server machines on demand is extremely useful, enabling flexible system design. Realizing Virtual Network Appliances The 1990s was a time of great development for computer networks, when network devices became more diverse and the market for appliances expanded. Before the 1990s, neither the network protocol stacks in operating systems nor the hardware (network interface cards, or NICs) were designed to handle speeds beyond the 10Mbit/s Ethernet used in LANs at the time, making it nearly impossible to process networks over 100Mbit/s at line speed using general-purpose CPUs and operating systems.
Therefore, as a solution to the need for high-speed network processing, hardware (commonly called “ASIC”) designed specifically for specific networkprocessing has come to be used instead of general-purpose CPUs and general-purpose OSs. Typical appliances using these ASICs include Layer 3 switches (routers) and Layer 4 switches (load balancers). Although this comes at the expense of functional scalability and versatility, if the range and content to be processed, such as IP addresses and port numbers, is predetermined, hardware (ASIC) operates much faster than software. Also, for highly real-time processing such as network processing, it is effective to use a CPU and OS designed for embedded devices that have such characteristics.
Furthermore, if the device is implemented as an appliance that only performs specific processes as a whole, using a dedicated OS to manage the entire system will improve operability in terms of management tools, etc. At the same time, a dedicated OS is considered to be more robust in terms of security than a general-purpose OS in order to respond to unexpected attacks from outside. For these reasons, network appliances have evolved into dedicated devices that are literally optimized for specific purposes. The older an appliance is, the more dependent it is on dedicated hardware, making it difficult to port it to a hypervisor as a virtual appliance.
Citrix Virtual Appliance
Citrix Systems (hereafter referred to as Citrix) sells three types of appliances: Citrix Access Gateway, an SSL VPN device for remote access; Citrix Branch Repeater, a WAN acceleration device; and Citrix ADC (formerly NetScaler), a load balancing device. All of these appliances are in the lineup to optimize delivery using XenApp, an application virtualization software, and XenDesktop, a desktop virtualization software.
Citrix was one of the first to add virtual appliance versions of these appliances, the VPX Series, to its product line between 2009 and 2010. Such rapid deployment was possible because the appliances were architected for x86 virtualization. An overview of the different types of virtual machines is the following.
Citrix Access Gateway VPX
Access Gateway VPX is a product that ported the software of the physical appliance Access Gateway Model 2010 to XenServer. Because the Model 2010 appliance itself is built on an x86 processor, it can provide exactly the same functionality.
Traditionally, Citrix has offered the Secure Gateway, a proxy (proxy access) server that relays the ICA protocol (a screen information terminal protocol used in Citrix virtual applications and virtual desktop environments) over SSL for XenApp users who need simple remote access. Although Secure Gateway itself is free software, it is an application that runs on Windows Server, so a separate server OS had to be purchased. This meant that in addition to OS license costs, there were concerns about the complexity
of operational management and security concerns (both Windows Server and Secure Gateway had to be taken into consideration when operating).In contrast, Access Gateway VPX is built on a dedicated OS designed to be installed in a DMZ that is vulnerable to external attacks on the Internet, making
it safer and easier to operate than the combination of Secure Gateway and Windows Server. Another advantage is that it is cheaper than a physical appliance (same price or lower than the combination of Secure Gateway and Windows Server). Also, by installing dedicated client software, you can use general-purpose VPN tunneling functions, so it complements physical appliances and Secure Gateway in both functionality and price.
Citrix Branch Repeater VPX
Branch Repeater is a product known as a WAN accelerator. WAN accelerators improve the access performance of applications that are sensitive to slow lines and latency. They accelerate the WAN by combining multiple techniques, such as optimizing TCP communications, data compression and caching,
deduplication, and accelerating specific protocols such as CIFS (Common Internet File System) and MAPI (Messaging Application Programming Interface).
In addition to these commonly provided features, Branch Repeater also accelerates the ICA protocol. Normally, XenApp or XenDesktop itself compresses and encrypts ICA traffic, but when Branch Repeater is added to the network, it compresses, encrypts, and caches ICA traffic on behalf of XenApp or XenDesktop. Benchmark tests conducted by Citrix show that performance improvements of up to 6x for ICA and up to 50x for Exchange can be expected. Branch offices (remote offices) may have small file and print servers installed for use only within that office. By converting WAN acceleration devices into virtual appliances, it becomes possible to implement file and print servers and WAN optimization devices on a single physical server, which is expected to reduce installation space and energy consumption.
Citrix ADC VPX
Citrix ADC (formerly NetScaler) is a load balancer (application switch) used by well-known cloud services and corporate data centers around the world. NetScaler VPX is a physical appliance, NetScaler MPX, with drivers added to run on a hypervisor, providing the same functionality as NetScaler MPX. A potential application of NetScaler is application development. NetScaler has a feature called Web 2.0 Push, which reduces the server load for server-push applications using Ajax (Asynchronous JavaScript + XML) or Comet, enabling communication with a larger number of clients. To use this feature, some modifications are required to the web application, but if you use a virtual appliance that is easy to implement and does not take up much space, you can proceed with development while verifying operation.The third example is application to multi-tenant environments such as cloud services. High-speed, high-capacity physical appliances can be placed at data center entrances and exits that connect to external networks, while virtual appliances can be used where detailed policy settings for individual users or applications are required. The virtual appliance model is well suited to IaaS andhybrid cloud deployments, including those by major cloud providers such as IBM Cloud (via the former SoftLayer).
The future of virtual appliances In a virtual appliance, all operations on the hardware are performed via the hypervisor. As a result, processing of the network’s data link layer and physical layer is handled by the hypervisor. This is what makes it different from a physical appliance. Also, physical appliances have an advantage in cases where scalability of processing performance is required through dedicated acceleration hardware (accelerators), such as for RSA processing used in SSL key exchange.
However, even virtual appliances can be expected to see a major breakthrough in network I/O throughput, thanks to a technology called SR-IOV (Single Root I/O Virtualization), which allows I/O arbitration work, previously handled by the hypervisor, to be performed directly on the NIC side.
Citrix has confirmed through proof-of-concept experiments that it is possible to increase the performance of NetScaler VPX to multi-10Gbps or higher throughput using SR-IOV. Today, virtual appliances are already applicable in scenarios where performance and scale previously mandated physical
appliances.Express Edition Citrix offers free or trial editions for each virtual appliance product (e.g., limitedcapacity “Express” or “VPX Express” versions). Access Gateway VPX is limited to five simultaneous connections, Branch Repeater VPX is limited to 512kbit/s, and NetScaler VPX is limited to 1Mbit/s, but all features are available.
