Virtual network appliances: benefits and drawbacks
A while ago I decided to figure out how well various vendors support virtualized networking (one of the answers: some of the solutions don’t scale) and what can be done with virtual network appliances (I was pleasantly surprised by F5’s BIG-IP LTM VE and Vyatta). You’ll find some of my other thoughts on this subject in the Virtual network appliances: Benefits and drawbacks article published by SearchNetworking.
We were creating a GRE IPSEC tunnel back to another campus and you had to run a few scripts (that we didn't know existed) before the tunnel would properly come up. A Cisco being on one end and a Vyatta on the other.
CPU-based processing might not be bad in some cases (WAF, load balancing) where you can't do much in ASIC anyway. Routing on a VM is a total waste of resources (VMware tends to disagree :-P )
Not all the special purpose chips ( nitrox cavium , regex engine, 1588 ) are virtualized for hypervisor to share with virtual machines ( guilty of only verifying this for VMWare vSphere ). So its really difficult to leverage these resources for a virtual appliance. Unfortunately lot of network services I know ( e.g firewall, APM with DPI capabilities ) require these special chips.
I think the whole idea of 'virtualizing network appliances' is a temporary solution to the broader problem of 'virtualizing the network'. The problems of performance and scalability you point out are only part of the problem. If you start moving workloads around suddenly you've got to consider where your network devices are running?? How crazy is that?
However, in real-life circumstances, virtualized network appliances are sometimes the lesser evil (although they do make for interesting traffic flows).