Azure Provisioning Troubleshooting Tips
Having trouble provisioning policy? Use these troubleshooting tips to resolve your provisioning errors.
Network Security Group Rule Limit Reached
The network security group has reached the maximum number of security rules allowed by Azure, so Illumio cannot provision additional rules.
In the Azure portal, go to Subscriptions and select the affected subscription.
In the left pane, select Usage + quotas.
Filter for Networking and locate the Network Security Group Rules quota.
In Inbound security rules and Outbound security rules, remove unused rules.
Consider consolidating rules by using application security groups or service tags in place of individual IP addresses.
In the Illumio Console, retry provisioning for the affected rules.
Insufficient Permissions to Modify Network Security Groups
The Illumio service principal does not have the role assignment required to modify network security group rules in this scope.
Illumio recommends updating the permissions. For instructions, see Azure read and write policy.
If additional permissions are missing, go to the Azure portal and follow these steps:
In the Azure portal, go to the affected subscription or resource group.
In the left pane, select Access control (IAM).
Select Add > Add role assignment.
On the Role tab, select Network Contributor.
On the Members tab, click + Select members and choose the Illumio service principal.
Click Review + assign to complete the assignment.
Confirm that no Azure Policy denies network security group rule changes in this scope.
In the Illumio Console, retry provisioning for the affected rules.
Insufficient Permissions to Modify Firewall Policies
The Illumio service principal does not have the role assignment required to modify Azure Firewall policy rule collections in this scope.
In the Azure portal, go to Firewall Policies and select the affected policy.
In the left pane, select Access control (IAM).
Select Add > Add role assignment.
On the Role tab, select Network Contributor, or a custom role that grants Microsoft.Network/firewallPolicies/ruleCollectionGroups/write.
On the Members tab, click + Select members and choose the Illumio service principal.
Click Review + assign to complete the assignment.
Confirm that no Azure Policy denies firewall policy changes in this scope.
In the Illumio Console, retry provisioning for the affected rules.
Network Security Group Locked (ReadOnly or CanNotDelete)
A ReadOnly or CanNotDelete lock is applied to the network security group, its resource group, or the subscription, which prevents Illumio from provisioning rules.
In the Azure portal, go to the affected network security group.
In the left pane, select Locks.
Review the locks applied at the resource, resource group, and subscription levels, because locks are inherited.
Select the ReadOnly or CanNotDelete lock that applies to the resource and click Delete.