Skip to main content

Illumio Segmentation for the Cloud User Guide

Set up flow logs in your OCI environment

Learn how to grant flow log access by Illumio Segmentation for the Cloud.

Illumio Segmentation for the Cloud uses flow logs to provide visual diagrams and analysis of traffic between sources and destinations. After you set up flow logs, you must grant Illumio Segmentation for the Cloud access to these flow logs through your CSP.

  1. Set up flow logs.

  2. Review destinations before granting flow log access.

    See Review destinations before granting flow log access.

  3. Review prerequisites for granting flow log access.

    See Prerequisites for granting flow log access to OCI

  4. Grant flow log access.

    See Grant OCI flow log access.

Note

Do you have central log storage or cross-account storage? This is where flow logs generated from one account (such as "account A1") are stored in a destination belonging to another account (such as "account A2").

You can onboard the accounts in any order, but if you onboard "account A1" first, you will not see its flow logs until you onboard "account A2." See Onboarding OCI.

If you onboard the account that stores the flow logs ("account A2") first, you will not see the "account A1" traffic because it has not yet been onboarded.

You must also onboard the account that is generating flow logs ("account A1"). Otherwise, Illumio Segmentation for the Cloud does not properly map the flow logs.

You must onboard both.

Set up flow logs in OCI

You can set up flow logs in the console. You must do this before you Grant OCI flow log access.

This guide provides a concise step-by-step process for you to enable Virtual Cloud Network (VCN) flow logs in Oracle Cloud Infrastructure (OCI) and create a service connector to store these logs in an Object Storage bucket. Observe the following prerequisites:

  • OCI Access: Ensure that you have the necessary permissions to manage Networking, Logging, Service Connector Hub, and Object Storage services.

  • Existing VCN: Identify the VCN for which you want to enable flow logs.

  • Bucket: Create a bucket to store flow logs.

Enable VCN Flow Logs

  1. Browse to Networking > Virtual Cloud Networks.

  2. Select the compartment and choose your VCN.

  3. Browse to Networking > Resources > Flow Logs on the OCI console.

  4. Configure the Flow Log with the following:

    • Name: Enter a name for the flow log.

    • Compartment: Select the appropriate compartment.

    • Enablement Point: Select VCN.

    • Flow logs that need to be enabled: Select the appropriate VCN for which flow logs need to be enabled.

    • Flow Log Type: Choose All Traffic with 100% sampling rate.

    • Log Group: Select an existing log group or create a new one.

    • Log: Provide a name for the log.

  5. Click Create Flow Log.

Store Logs

  1. If an object storage bucket is not already available, browse to Storage > Buckets.

  2. Click Create Bucket, provide a name, and set the desired configurations.

  3. Navigate to Analytics and AI > Messaging > Service Connectors.

  4. Configure the Service Connector with the following:

    • Name: Enter a name for the connector.

    • Source:

      • Select Logs

      • Configure the source to use the Log Group and Log from your flow log

    • Target:

      • Select Object Storage and choose the bucket you created.

      • (Optional) Set the Object Name Prefix, Batch Rollover Size, and Batch Time Interval.

  5. Click Create Service Connector.

  6. Navigate to your Object Storage Bucket and confirm that log files are being generated and stored. This usually takes some time to show up, as connector will start streaming from the logging service.

What's next for OCI flow logs

Now you can Grant OCI flow log access.