By decoupling the firewall services from the virtualization layer, traffic is directed to the distribution layer for firewall processing within a service module.

By deploying firewall software on a per virtual machine basis, firewall services will be distributed across multiple compute nodes.

Firewall services are implemented as kernel modules and provide traffic filtering between the virtual machine's vNIC and the vSwitch.

Firewall services are distributed as a software firewall appliance and may be deployed on more than one ESXi host for scalability and high availability.