Network functions virtualisation (NFV)
In short: Network functions virtualisation (NFV) runs network functions such as firewalls, routers and mobile core elements as software on standard servers. The ETSI architecture splits it into functions, shared infrastructure and management and orchestration (MANO). NFV and SDN are separate ideas that work well together.
From boxes to software
Traditional networks are built from appliances: a router here, a firewall there, a load balancer and a WAN optimiser in the rack. Each new service means buying, shipping, racking and cabling more hardware. Network functions virtualisation (NFV) turns those functions into software that runs on ordinary x86 or Arm servers, using virtual machines or containers. Telecom operators started the work through an ETSI industry specification group, because their networks contained huge numbers of specialised boxes.
A software function is called a virtual network function (VNF) when it runs in a virtual machine, or a cloud-native network function (CNF) when it is built as containers, often managed by Kubernetes. Examples include virtual routers, firewalls, SD-WAN edges, load balancers and the components of a 5G core.
The ETSI NFV architecture
| Component | Role | Example |
|---|---|---|
| NFV infrastructure (NFVI) | Physical servers, storage and networking plus the virtualisation layer | Servers with a hypervisor or container runtime |
| Virtualised infrastructure manager (VIM) | Allocates compute, storage and network resources | OpenStack, Kubernetes |
| VNF manager (VNFM) | Instantiates, scales, heals and terminates functions | Vendor or generic managers |
| NFV orchestrator (NFVO) | Builds end-to-end services from several functions and manages resources across sites | Open-source projects such as ETSI OSM or ONAP, or vendor orchestrators |
Together the VIM, VNFM and NFVO are called management and orchestration (MANO).
NFV and SDN together
NFV and SDN are often mentioned together but solve different problems. NFV changes where network functions run: on shared servers instead of dedicated boxes. SDN changes how the network is controlled: centrally, through software. Combined, they enable service function chaining, where the controller steers a customer’s traffic through a chosen sequence of virtual functions, for example firewall, then intrusion prevention, then NAT. You will also see the same ideas in enterprise networks, such as a branch "universal CPE" box running a virtual router and firewall side by side.
Benefits include faster deployment, elastic scaling and less hardware. Challenges include matching the throughput of dedicated hardware, which often needs acceleration technologies such as SR-IOV or DPDK, managing many software versions, and the skills shift from box configuration to cloud operations.
Security considerations
- Shared infrastructure. Several functions, sometimes for several tenants, share hosts. Hypervisor and container isolation must be strong and patched (see virtualisation security).
- Image integrity. Only deploy signed, scanned images from trusted sources.
- MANO is a crown jewel. The orchestrator can create or delete any function. Protect it with strong authentication, role-based access and logging.
- East-west traffic. Traffic between functions on the same host may never touch a physical firewall, so apply virtual segmentation and monitoring.
- Lifecycle. Scaling and healing create new instances automatically, so security settings must be part of the template, not added by hand.
Tip: a classic exam question asks you to compare NFV and SDN. Say: NFV virtualises the functions; SDN centralises the control; each can exist without the other.
Practice
What is the difference between a VNF and a CNF?
Which three components make up NFV MANO?
Why is east-west traffic a concern in NFV?
Key takeaways
- NFV runs network functions as software on general-purpose servers.
- VNFs run in virtual machines; CNFs run as containers.
- The ETSI model splits NFV into functions, NFVI and MANO (NFVO, VNFM, VIM).
- NFV virtualises functions; SDN centralises control; together they enable service chaining.
- Protect MANO, image integrity and east-west traffic between functions.
Original content written by Mohamed Fayas for FM TecHub. © 2026 FM TecHub. You're welcome to share a link to this page; please don't copy the text elsewhere without permission.