Intelligent Traffic Offload service (ITO) is a Security subscription that, when configured with the BlueField-2 SmartNIC, increases capacity throughput for the VM-Series firewall. The ITO service inspects the first few packets of a new flow to determine whether it benefits from inspection. If not, the service offloads the flow to the SmartNIC, decreasing the load on the VM-Series firewall.

The VM-Series firewall and the SmartNIC must be installed on the same x86 physical host, and the VM-Series firewall must be deployed in virtual wire mode. Active/Passive HA is supported.

To increase effective throughput, the CN-Series firewall can now leverage AF XDP, an eBPF based socket that is optimized for high performance packet processing suited to cloud native services.

VM-Series firewalls now support multiple NIC types and multiple queues. You can configure both SR-IOV and DPDK for all hypervisors on cloud platforms that support multiple NIC types. In addition, a single NIC type with variable queues (available on some cloud platforms) is also supported.

Please contact Technical Support if you want to use this feature.

You can now deploy the CN-Series firewall as a Kubernetes service. In Kubernetes deployments with smaller nodes with more stringent resource constraints, deploying the CN-Series as a daemonset can be difficult. The challenges associated with predicting and provisioning the necessary resources can result in firewalls consuming more resources than required to support the traffic on the cluster. By deploying the CN-Series as a service, you can start with the right amount of resources and scale dynamically when necessary. When deployed as a service, the CN-Series firewall provides complete Layer 7 visibility, application-level segmentation, and protection for traffic in your native Kubernetes, OpenShift, AKS, EKS, or GKE environments using native Kubernetes constructs.

Customize dataplane cores is an optional feature that allows you to customize the number of dataplane cores in two ways:

Typically you increase the number of dataplane cores (which decreases the number of management plane cores) to improve performance.

You can now use IPVLAN in Layer 2 mode with your CN-Series deployment on EKS.