Palo Alto Networks today announced a virtual next-generation firewall designed specifically for use with Nvidia’s BlueField line of data processing units (DPUs).

Announced in late 2019, Nvidia’s — formerly Mellanox’s — BlueField-2 DPU is designed to offload up to 125 CPU cores worth of SDN, security, or storage workloads from the host server's CPU.

Palo Alto Networks claims this allows its VM-Series Firewalls, which run on standard server hardware, to achieve throughputs “close to 100 Gb/s” in most use cases, roughly a five-fold improvement versus running the same firewall on a CPU alone.

The new offering directly addresses the challenges faced by enterprises and network operators as they build out “cloud-like” data centers, Muninder Singh Sambi, Palo Alto Networks’ SVP of products, said in a statement.

Using DPUs and SmartNICs to accelerate firewalls is nothing new, Chris DePuy, technology analyst at 650 Group, noted in an email to SDxCentral. “DPUs and SmartNICs have been used in security appliances for years,” he said. “What’s changing is that the DPU is being used on a virtual software platform instead of an appliance. By using DPUs, the Palo Alto Networks VM-Series can use data center servers equipped with DPUs to scale to varying traffic patterns.”

The platform works by offloading packet filtering and forwarding processes to the DPU, from there it parses, classifies, and steers traffic flows based on a variety of policy criteria. This frees up CPU resources for security functionality, while also enabling users to sift out traffic that won’t benefit from inspection, using a function Palo Alto Networks calls intelligent traffic offload (ITO).

“Up to 80% of network traffic, including media and encrypted data in a data center, doesn’t need to be — or can’t be — inspected by a firewall,” Ash Bhalgat, Nvidia senior director of cloud, wrote in a blog post.

If, for example, the firewall detects encrypted or streaming media traffic, the platform directs the DPU to forward all subsequent packets their destination, freeing up CPU cycles for higher-priority traffic.

“In such environments, intelligent traffic offload will ensure that firewall resources are optimally utilized to inspect only those flows that benefit from continuous security inspection,” Bhalgat explained..

The announcement marks the latest vendor to throw its support behind Nvidia’s BlueField DPUs.

VMware last fall announced Project Monterey, which sought to bring a consistent management platform, in the form of vendor’s ESXi hypervisor, for distributed compute across multiple hardware accelerators using smartNICs and DPUs from the likes of Intel and Nvidia.

Meanwhile, rival hardware vendors including Intel, Fungible, and most recently Marvell launched DPU products of their own.

Marvell’s Octeon 10, announced late last month, claims to extend the DPU beyond the data-center-focused PCIe cards — like BlueField-2 or Intel’s FPGA-based infrastructure processing unit — to embedded applications like edge switches, SD-WAN appliances, routers, and firewalls.

Editors note, this story has been updated to correct the BlueField-2 DPU's core-offload capabilities.