Firewall Virtualization for Grid Applications FVGA-BOF: Enabling the dynamic VO imonga@nortel.com

Firewall Issues – RG: OGF History Formally started in GGF Inspiration through the GHPN-RG Background Network - a first-class GRID Citizen Firewalls a big impediment to dynamic resource sharing Balance security with dynamic access Asymmetric access 2

Summary of Issues (FI-RG BOF) Enable the network-part of the “VO” Sharing of critical resources across the WAN Security enforcement at different layers Application level Network level Multiple policy/security enforcement points Host Lab Site EPR address resolution Firewall Performance for high-speed grid interconnects Support different mid-box architectures 3

What did we learn? A set of representative use-cases (GFD.83) Summary of Firewall requirements from Grid Applications Capabilities and shortcomings of existing firewalls and dynamic solns. 4

Why standards track? Firewall vendors product ALG for Grid Applications Likelihood of vendors to implement this specifically for grids not very strong Lots of researchers have contributed solns Lots of pros to Virtualization approach Avoid expensive “upgrades” Large vendor/product choice Interoperability assured Grid understanding 5

What skill sets do we need? Network Administrators Security Experts Grid Administrators Grid Middleware and application designers Virtualization experts …. 6

Is this contrary to industry trend? Services Oriented Infrastructure (SOI) Virtualization of all infrastructure Cloud Computing Virtual organizations the norm (though not in the pure Grid way) Web 2.0 application service providers Host multiple organizations Automation needed 7

Proposed Solution Make middleware and network resources known to each other Dynamic network resource management Grid middleware is network-aware End-to-end applicability Local authorization/authentication Independence of the Firewall vendor/implementation Capabilities may be different 8

Questions and discussion 9