NVIDIA DOCA 2.5 BlueField Appliance

The NVIDIA DOCA 2.5 BlueField Appliance is a purpose-built network security appliance anchored by the NVIDIA BlueField-3 Data Processing Unit, combining programmable Arm Cortex-A78 cores with a 400 Gbps ConnectX-7 network engine in a single hardened platform. Running the NVIDIA DOCA 2.5 software framework, the appliance exposes a unified API surface for constructing stateful firewall pipelines, cryptographic offload, deep packet inspection, and telemetry collection entirely within the DPU data path—freeing host CPU cycles for application workloads while enforcing policy at line rate.

The appliance is architected for zero-trust enforcement at the infrastructure layer, making it suitable for east-west microsegmentation between bare-metal servers, virtualized environments, and containerized workloads. DOCA 2.5 introduces enhanced service chaining capabilities, allowing operators to compose ordered security functions—including TLS 1.3 decryption, intrusion detection sensor integration, and flow-based analytics—without introducing additional appliance hops. Hardware-accelerated IPsec and TLS offload engines natively embedded in the BlueField-3 ASIC sustain cryptographic throughput that software-only solutions cannot match at comparable power envelopes.

Launched in 2025-Q3, this appliance addresses the growing enterprise requirement for a SmartNIC-class security enforcement point that is operationally transparent to host operating systems and hypervisors. Integration with NVIDIA DOCA App Shield enables runtime attestation and memory telemetry of host workloads directly from the DPU, adding a lateral inspection capability that complements perimeter controls. The result is a converged compute-and-security platform suited to hyperscale data centers, sovereign cloud deployments, financial services infrastructure, and any environment where encrypted traffic volumes and east-west traffic densities have outpaced conventional firewall appliance throughput.

Ideal for

• East-west microsegmentation enforcement between bare-metal and virtualized server workloads in multi-tenant data centers, isolating tenant traffic without requiring host agent software
• Inline TLS 1.3 and IPsec encrypted traffic inspection for compliance-driven environments such as financial services and healthcare, offloading cryptographic operations from host CPUs
• Zero-trust infrastructure enforcement at the server NIC layer for sovereign cloud and government data center deployments requiring hardware-attested policy enforcement
• High-frequency trading and low-latency financial workload protection where kernel-bypass RDMA traffic must be secured without introducing measurable latency penalties
• Runtime host workload attestation and memory telemetry via DOCA App Shield for detecting in-memory threats on co-located virtual machines without hypervisor-level agents
• Service provider NFV security insertion supporting ordered chaining of DPI, stateful firewall, and flow-based analytics functions within a single appliance at 400 Gbps line rate

Technical specifications

Available from Omnixon Global. Submit an RFQ and our team will confirm configuration and availability for your order.