Skip to main content

Illumio Segmentation for the Cloud User Guide

Set up flow logs in your GCP environment

Learn how to grant flow log access by Illumio Segmentation for the Cloud.

Illumio Segmentation for the Cloud uses flow logs to provide visual diagrams and analysis of traffic between sources and destinations. After you set up flow logs, you must grant Illumio Segmentation for the Cloud access to these flow logs through your CSP.

  1. Set up flow logs.

  2. Review destinations before granting flow log access.

    See Review destinations before granting flow log access.

  3. Review prerequisites for granting flow log access.

    See Prerequisites for granting flow log access to GCP

  4. Grant flow log access.

    See Grant flow log access to your GCP instance.

Note

Do you have central log storage or cross-account storage? This is where flow logs generated from one account (such as "account A1") are stored in a destination belonging to another account (such as "account A2").

You can onboard the accounts in any order, but if you onboard "account A1" first, you will not see its flow logs until you onboard "account A2." See Onboarding GCP.

If you onboard the account that stores the flow logs ("account A2") first, you will not see the "account A1" traffic because it has not yet been onboarded.

You must also onboard the account that is generating flow logs ("account A1"). Otherwise, Illumio Segmentation for the Cloud does not properly map the flow logs.

You must onboard both.

Set up flow logs in GCP

Perform these steps before you Grant flow log access to your GCP instance. For VPC and Firewalls, use the following steps. In this example, you'll set up flow logs for a VPC.

Note

Illumio Segmentation for the Cloud supports the Compute Engine API. It does not support the Network Management API.

Step 1: Create a flow log configuration

  1. Log in to your Google Cloud Shell and go to the VPC networks page.

  2. Click on your VPC to open its details panel.

  3. Click the Subnets tab, select the subnets for which you want to enable flow logs, and click Manage flow logs.

  4. Click Add new configuration.

  5. Select Compute Engine. Illumio recommends using the default settings for the rest of the fields.

  6. Click Save.

  7. Browse to the VPC Flow Logs page > Subnet table to verify that you created the flow log configuration.

    For more information on using flow logs and enabling subnets, see the Google website.

Step 2: Set up a log router to direct the GCP Log Explorer

  1. Type 'log' in the search bar and select the Logs Explorer result.

  2. In the Logs Explorer, go to the left-hand navigation and click Log Router.

  3. Click Create sink.

  4. In Sink details, enter a name and optional description for your sink, and click Next.

  5. In Sink destination, select Cloud Pub/Sub topic for your sink service, and select an existing topic or create a new one. Click Next.

  6. In Choose logs to include in sink and Choose logs to filter out of sink, create your inclusion and exclusion filters. The log router will redirect only the logs that match the filter. For example, you might include resource.type="gce_subnetwork". You can put 'NOT' in front of an inclusion filter entry to exclude it.

    Tip

    Currently Illumio Segmentation for the Cloud processes only VPC and Firewall flow logs so include only those or exclude all other logs.

  7. Click Update Sink.

Important

Illumio supports these log sink filters. You must apply at least one log sink filter for each of your topics. Otherwise, Illumio will not display the topics and log sinks on the flow access page.

For Organizational level logging, Illumio recommends the following syntax:

logName:"networkmanagement.googleapis.com%2Fvpc_flows" OR logName:"compute.googleapis.com%2Fvpc_flows" OR logName:"networkmanagement.googleapis.com%2Ffirewall" OR logName:"compute.googleapis.com%2Ffirewall" OR logName="organizations/<ORGID>/logs/compute.googleapis.com%2Fvpc_flows" OR logName="organizations/<ORG-ID>/logs/compute.googleapis.com%2Ffirewall"

For Folder level logging, Illumio recommends the following syntax:

logName:"networkmanagement.googleapis.com%2Fvpc_flows" OR logName:"compute.googleapis.com%2Fvpc_flows" OR logName:"networkmanagement.googleapis.com%2Ffirewall" OR logName:"compute.googleapis.com%2Ffirewall" OR logName="folders<FOLDER-ID>/logs/networkmanagement.googleapis.com%2Fvpc_flows" OR logName="folders/<FOLDER-ID>/logs/compute.googleapis.com%2Ffirewall"

For Project level logging, Illumio recommends the following syntax:

logName="projects<PROJECT-ID>/logs/networkmanagement.googleapis.com%2Fvpc_flows" OR logName="projects<PROJECT-ID>/logs/compute.googleapis.com%2Fvpc_flows" OR logName="projects/<PROJECT-ID>/logs/networkmanagement.googleapis.com%2Ffirewall" OR logName="projects/<PROJECT-ID>/logs/compute.googleapis.com%2Ffirewall"

Step 3: Verify that flow logs are redirected

  1. Go to the Logs Explorer as previously described.

  2. Click Log Router, and look in the Name column for the name of the log router you created.

  3. Check the Destination column to verify that the destination contains the topic you selected or created when choosing your sink destination.

  4. Type 'topic' in the search bar and select the Topics Pub/Sub result.

  5. In the list of topics, click the topic that you just verified in the Log Router.

  6. Click on your subscription, click the Messages tab, and click Pull to verify that your sink is sending messages to the subscription.

Important

For all relevant firewall rules (VPC rules or hierarchical firewall policies), make sure to enable Firewall Rules Logging.

Illumio relies on the allowed/denied status field in firewall rule logs to summarize traffic flows. Flows without firewall rule logging enabled aren't summarized; consequently, you may see a Traffic Flow Summary page with zero summarized flows.

Step 4: Grant Flow Log Access