State of Russian NGFW: What You Need to Know Before Implementation

Import substitution of network infrastructure may sound like a straightforward engineering task: replace foreign routers and NGFWs with domestic solutions. In practice, for us it turned into a redesign of the network model for production Kubernetes clusters with 100+ nodes and more than 1000 services.

We needed more than just a firewall. We needed a network access control system where each Kubernetes namespace has its own set of permissions on the NGFW: which internal and external resources it can access, and which it cannot. This requirement is driven by the status of critical information infrastructure.

In the previous setup, we authorized pod IPs through a custom application that sent syslog events to a foreign NGFW. But during the migration to Russian solutions, we found that familiar approaches no longer worked. For one vendor, we still had to validate behavior under real load. Another vendor did not support the syslog-based authorization flow we needed, but provided captive portal authorization integrated with a user directory. One of the vendors had an out-of-the-box solution for our case, but it did not fit because we operate multiple different NGFWs and wanted to avoid vendor lock-in.

That is where the most interesting part started. For captive portal authorization, we used Active Directory, but discovered a non-obvious limitation: the client IP is taken from the TCP session. This means the authorization request must originate from the pod’s own network namespace. A host agent sends the wrong IP, a sidecar is too expensive and risky for this kind of infrastructure function, and the standard approaches did not fit.

In this talk, I will explain how we had to completely change the network model while moving to the cloud, how we evaluated the usual options, why they failed under production constraints, and how legatus appeared as a result: a DaemonSet agent with access to the host network that finds the pod process PID, enters its network namespace, and authorizes against the captive portal on behalf of that pod.

This will be an honest engineering case study: where domestic solutions are already mature, where they still hurt, why foreign NGFWs are not perfect either, which architectural compromises we had to make, and what we would do differently next time.