What Is Network Functions Virtualization?

Network Functions Virtualization (NFV) allows network operators to deploy and manage virtual network functions through software, rather than physical network hardware. The virtualization of network functions, such as routing, load balancing, and firewalls, saves time and costs in infrastructure management, deployment, and field resources. NFV was originally designed to decouple network functions from expensive proprietary hardware appliances.

This guide covers NFV deployment and management on AWS, through to monitoring, including the services and configurations to choose at each step.

Network Functions Virtualization (NFV) is an architectural approach that allows specialized network functions, such as load balancers, firewalls, session border controllers (SBCs), and network encryption, to run in a virtualized environment. NFV can decouple network functions from proprietary hardware, allowing them to run on commercially available hardware.

Each virtualized software implementation of a network function is called a virtualized network function (VNF). VNFs can run in virtual machines (VMs) on servers, allowing operators to deploy, manage, and scale networking capabilities more effectively. These functions can also run in cloud containers, where they are commonly known as cloud-native network functions (CNFs). Communication service providers (CSPs) are a major consumer of VNFs for running their networks.

Conventionally, network operators must invest in dedicated hardware and skilled personnel to deploy and operationalize these network functions. By deploying VNFs, you can reduce capital expenditure as you reduce the need to purchase expensive proprietary networking hardware. Network operators can respond to consumer trends and demands more proactively, as network functions virtualization infrastructure permits on-demand provisioning. For example, you can scale a network firewall up or down based on peak and non-peak traffic to optimize costs.

AWS helps network operators transition, deploy, manage, and scale their VNF workloads with AWS services:

• You can deploy VNFs on Amazon EC2, where some instances support up to 100 Gbps throughput
• Networking performance between instances can be further improved by using the Data Plane Development Kit with Enhanced Network Adapter (ENA) to support low-latency networking
• To support latency-sensitive edge environments, you can use Amazon Wavelength in telco partner data centers

In addition to VNF deployments, you can optimize your network design by following the best practices outlined in our Well Architected Framework.

Before choosing a deployment model, it’s important to understand how NFV has evolved to meet industry demands. The official NFV framework was first introduced by the European Telecommunications Standards Institute (ETSI) in 2012. The framework has evolved since then into a broad set of standards with regular updates and releases.

Network Functions Virtualization specifies several layers that enable network functions to operate cohesively in virtualized environments. Based on the ETSI management and orchestration (MANO) framework, an NFV architecture consists of the following layers:

• NFV Orchestrator: This layer provides high-level control over VNF lifecycle, external requests processing, and governance.
• VNF Manager: This module is responsible for initiating, replicating, scaling, healing, and decommissioning virtualized network functions.
• Virtualized Infrastructure Manager: It manages infrastructure provisioning, resource allocation, troubleshooting, and other operational functions.

Together, these layers allow VNFs to interact with business support systems and operational support systems in the NFV environment.

While the NFV architecture allows you to implement a cost-effective, flexible, and agile telecom network, there are different approaches to deploying VNFs. Network operators deploy the VNFs either on virtual machines or containers. We describe the differences below.

VM-based VNFs

Virtual machines (VMs) are software programs that emulate computers, including the operating system, drivers, and hardware dependencies. When the ETSI NFV framework was introduced, network operators started deploying VNFs in virtual machines. This deployment method is suitable for stateful VNFs, legacy network functions, or single-tenant network services.

Because VM-based VNFs run independently from the underlying hardware, network operators can deploy them without proprietary hardware. For example, you can deploy VNFs on Amazon EC2. Amazon EC2 is a cloud computing solution that lets you run workloads on scalable virtual servers called instances. By using Amazon EC2, you have virtually unlimited compute, networking, and storage capacity, which ensures the performance of deployed network functions at an affordable cost.

Containerized Network Functions (CNFs)

Containers are software packages that consist of the network function's source code, libraries, and other dependencies required to operate. Unlike virtual machines, containers don’t load the entire operating system when they are initiated. Containers are orchestrated through services like Kubernetes. This makes containerization suitable for hosting cloud-native VNFs and microservice-based network services.

On AWS, you can deploy containerized virtual network functions with Amazon Elastic Kubernetes Service (EKS). Amazon EKS is a managed service that lets you provision, manage, and scale Kubernetes across public, private, and hybrid cloud environments. Telco operators that want to implement 5G across distributed customer-managed services use Amazon EKS to deploy network components.

Note: When architecting NFVs on AWS, you have access to purpose-built VNF applications and services on AWS Marketplace, such as Cisco CSR1000v, Juniper vSRX, and Juniper vMX. These network components, including virtual firewalls, cloud-native routers, and AI-assisted networking, are offered by leading network solution providers.

To deploy VNFs on Amazon EC2, you must configure the instance to handle carrier-grade requirements, such as low-latency networking and multi-NIC routing. Here are the steps that help you get started:

• Select an EC2 instance that is optimized for high-throughput packet processing. For example, C5n, C6gn, C7gn, m5zn, and bare metal instances support high-performance networking, making them suitable for powering VNFs.
• Configure multiple Elastic Network Interfaces (ENIs) per instance to match the VNF interface topology. All instances come with a primary interface. However, you can add additional secondary interfaces, subject to the instance type, to allow multiple connections from external network services. Crucially, you must disable the Source/Destination Check when running services such as firewalls, load balancers, and routers to prevent traffic from being dropped.
• Use Enhanced Network Adapter (ENA) for high-bandwidth, low-latency networking between VNF instances. The feature is available on newer EC2 instances. To use ENA on older or custom AMIs, you must use an Amazon Machine Image (AMI) that includes the ENA driver.
• Manage access control for the respective VNF by opening the required ports in the instance security groups. Ensure that only authorized users are granted administrative privileges through AWS Identity and Access Management (IAM).

Note: If you’re deploying a stateful VNF that requires maintaining state between restarts, consider using EC2 instances equipped with Amazon Elastic Block Store (EBS).

AWS Telco Network Builder (TNB) is a service to deploy cloud-based telco networks at scale. It simplifies VNF deployment by allowing network engineers to define telco requirements in a template that they can reuse across locations globally. To ensure consistent coverage, high availability, and timely network updates, AWS TNB integrates with AWS Regions, AWS Outposts, and AWS Local Zones. Here are the steps to deploy VNFs with AWS TNB:

1. Prepare and upload function packages

First, create a network function package from the AWS TNB console. A network function package comes in CSAR file format, containing a Virtual Network Function Descriptor (VNFD) and other VM components. A cloud-native network function CSAR file also contains Helm charts and a container image. The VNFD describes the operational behavior and initiation parameters of the network function, which helps network engineers manage the VNF lifecycle. After reviewing the function packages, upload them to the console.

Note: When architecting a cloud-based VNF, you can obtain CSAR packages from AWS ISV partners. Alternatively, get started with AWS TNB GitHub samples.

2. Create network packages

Network packages consist of network descriptor (NSD) files that describe the network functions that you want to deploy on the cloud infrastructure. You define the compute resources, network function version, VPC subnets, and EKS clusters required in the deployment.

Depending on the network requirements, the NSD file might include user data scripts, lifecycle hook scripts, and plugin configurations.

3. Create and instantiate the network

Instantiate the network infrastructure based on the NSD file you created. When you instantiate a network instance, AWS TNB automatically provisions the underlying infrastructure and resources, including NFV deployment and your defined inter-VPC networking capabilities.

4. Manage deployed VNFs

After deploying the network, you can monitor the VNF health and perform necessary interventions if required. For example, you can update the network function’s configurations or update the network instance with a new network package. AWS TNB offers automated lifecycle management features for deployment, upgrades, updates, and offlining.

When architecting cloud-based network functions, it’s important to ensure operational resilience and failover with high-availability VNFs. Common approaches include deploying active-active or active-standby clusters across different availability zones and scaling virtual resources based on real-time traffic. AWS helps you build highly available VNF clusters in different ways:

• You can deploy VNF instances across multiple Availability Zones and reassign Elastic IPs to secondary VNF interfaces, based on a trigger such as a health check, during failover. This allows standby nodes to take over and assume the active node’s IP address, which minimizes operational disruption.
• Additionally, you can use EC2 Auto Scaling lifecycle hooks to reattach additional network interfaces on instance launch. Configuration management can make sure that VNFs install all necessary packages before receiving traffic.
• To enable geo-redundancy, you can create active-passive or active-active instance pools with VPC routing failover. Use services like AWS Lambda with Amazon EventBridge to capture abnormal events so the network can activate backup nodes.

Operationalizing VNF on AWS cloud allows network engineers to scale in or scale out to meet network demands and optimize cloud costs. When you deploy VNFs with EC2 instances, you can trigger EC2 Auto Scaling with metric alarms in Amazon CloudWatch. For example, custom metrics such as subscriber count, sessions, and throughput are useful for determining whether compute resources should be adjusted. You can define EC2 Auto Scaling groups in AWS CloudFormation stacks to apply dynamic scaling consistently throughout the entire architecture. Consequently, the network can easily create additional VNF instances, with new instances deployed across multiple AZs to handle growing traffic.

Network operators must continuously monitor key metrics for both the VNFs and their underlying cloud infrastructure. Setting up an end-to-end telemetry system helps address performance bottlenecks, operational challenges, and security issues before they impact customer experience. You can use Amazon CloudWatch to track EC2 instance metrics and set alarms when they go beyond specific thresholds.

To strengthen security posture, use AWS Network Firewall and Amazon GuardDuty to build a security perimeter around the VNF instances.

• AWS Network Firewall blocks threats from affecting the VPC with rule-based filtering and deep packet inspection. It automatically scales its infrastructure to protect VNF instances even as traffic grows.
• Amazon GuardDuty provides threat detection on your AWS account activity and network traffic logs. By surfacing security findings, CSPs can implement timely remediation efforts to prevent service disruptions.

NFV allows network operators to reduce the total cost of ownership, improve service quality, and innovate with cloud native capabilities using CNFs. By shifting network functions from dedicated hardware devices to virtualized layers, engineering teams can focus on building new network services rather than provisioning and maintaining infrastructure. Adoption of 5G across regions has seen the application of both VM- and container-based network functions. Effective VNF deployment, however, requires thorough consideration across resource provisioning, availability, security, and scalability.

AWS helps you architect scalable, cost-effective, and agile network functions that comply with telco-grade requirements. By deploying VNFs using services such as Amazon EC2 and AWS Telco Network Builder (AWS TNB), you can meet stringent service quality requirements, achieve low-latency and high throughput, and reuse the same network blocks globally.

Explore the full range of cloud solutions for telco on AWS to find the right fit for your network requirements.