Skip to main content

Illumio Segmentation for the Cloud User Guide

Set up flow logs in your Azure environment

Learn how to grant flow log access by Illumio Segmentation for the Cloud.

Illumio Segmentation for the Cloud uses flow logs to provide visual diagrams and analysis of traffic between sources and destinations. After you set up flow logs, you must grant Illumio Segmentation for the Cloud access to these flow logs through your CSP.

  1. Set up flow logs.

  2. Review destinations before granting flow log access.

    See Review destinations before granting flow log access.

  3. Review prerequisites for granting flow log access.

    See Prerequisites for granting flow log access to Azure.

  4. Grant flow log access.

    See Grant flow log access to your Azure instance.

Note

Do you have central log storage or cross-account storage? This is where flow logs generated from one account (such as "account A1") are stored in a destination belonging to another account (such as "account A2").

You can onboard the accounts in any order, but if you onboard "account A1" first, you will not see its flow logs until you onboard "account A2." See Onboarding Azure.

If you onboard the account that stores the flow logs ("account A2") first, you will not see the "account A1" traffic because it has not yet been onboarded.

You must also onboard the account that is generating flow logs ("account A1"). Otherwise, Illumio Segmentation for the Cloud does not properly map the flow logs.

You must onboard both.

Set up flow logs in Azure

You must do this before you Grant flow log access to your Azure instance. For VNETs and NSGs, see this Azure website.

Set up flow logs for Azure Firewalls

See this Azure website.

  1. Open the Azure portal and browse to Firewalls and click one of your Azure Firewalls.

  2. Click Diagnostic settings and click +Add diagnostic setting.

  3. Enter a Diagnostic setting name.

  4. Select all the logs you want Azure to generate. Be sure to select at least Azure Firewall Network Rule for Illumio to be able to ingest flow logs. At time of writing, Illumio does not support any other type of Azure Firewall rule log, including any legacy diagnostics.

  5. Select Archive to a storage account. For subscription and storage account selections, follow the same steps as for VNETs and NSGs.

  6. Click Save. If you have not already done so, onboard the Azure account. See Onboarding Azure.

What's next for Azure flow logs

Now you can Grant flow log access to your Azure instance.