Is there a major difference between stateful firewalls that exist in the traditional networks and those that exist in SDN environment? In other word, do we have some special firewall devices that only work in SDN-based network?

  • 1
    There is no difference as far as SDN goes. It's sort of like asking about SDN web servers.
    – Ron Maupin
    Aug 9, 2016 at 23:18
  • 2
    I would think that in the true spirit of SDN you would throw away your physical firewalls and implement a firewall application on top of your controller. The controller then programs the network in such a way that only permitted traffic is forwarded. [I've just started here so don't have enough reputation yet to write comments - feel free to move this answer to the comments if you consider that more appropriate]
    – hertitu
    Aug 11, 2016 at 14:30
  • Did any answer help you? if so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you could provide and accept your own answer.
    – Ron Maupin
    Aug 9, 2017 at 14:09

4 Answers 4


The architecture of SDN prevents stateful in-line processing of packet flows (ignoring using firewall hardware, NFV or experimental stateful switches).

Therefore anything that monitors the state of a flow requires that state to be held by the controller. This causes unacceptable workload for the controller and increases state held across (typically) multiple controllers. Consequently most SDN FW proposals are either static or dynamic packet-filters, for example using a rule checking algorithm before installing FW switch rules.

Take for example, closing a TCP flow. A traditional firewall observes the FIN handshake (2x FIN, 2x ACK) as it happens and closes the firewall on seeing the last ACK packet. Rather that deal with this state, an OpenFlow switch uses a time-out, meaning the firewall hole is left open. An attacker can then use the switches renewal of a time-out to keep the firewall open until the attacker is finished.

For the controller to close the hole, means the controller needs to see the FIN packets (increasing rules in the rule space, possibly buffering in the switch) and the two responding ACKs, but obviously without seeing every ACK in the flow and equally obviously allowing the flow to finish correctly.

Setting up a flow based on seeing a SYN packet or two is easy. Removing a rule so your firewall is in synch with the two end hosts, not so easy using the SDN architecture.

Of course YMMV depending on what you want your SDN packet-filter to do.


In terms of functionality they would be roughly equal. The difference is typically in how you deploy them and manage them. The classic approach typically involves a physical machine whereas the SDN approach likely uses a virtual firewall spun up in a VM. It also manages the firewall in a completely programmatic way.

There are some technologies that relate to SDNish data centers, like VXLAN or NSH (Network Services Header) that you might find support for in a firewall focused on SDN while it might not be there, yet, in a classic firewall.


In traditional networking, there are stateful firewalls and next-generation firewalls. NGFWs perform deeper inspection compared to stateful firewalls.

Either of these types of firewalls can be implemented in an SDN fashion. The difference with SDN is that the firewall processing is done at the virtual NIC, whereas in traditional networking the firewall processing is done at the physical NIC(s) of the firewall(s).

If you think about virtual machines, and a feature such as VMWare's VMotion in an SDN solution, not only would the virtual machine move but the virtual firewall on the vNIC would follow it (as you move it).


All the above are reasonable replies, but if your deploying these in a carrier class network there is also the considerable issue of where you need to deploy them. One approach is to have an NFV micro instance ready to spin up at every node, but then they can rarely be stateful if the packet flow is dynamic. Another approach is to funnel all the traffic through a small number of points near the customer gateways to maintain state but at the cost of scaling. In an enterprise environment then firewalls can often be virtualised/scaled at the boundary of the SDN network or before the access layer.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.