Skip to main content

Illumio Segmentation for the Cloud User Guide

GCP Provisioning Troubleshooting Tips

Having trouble provisioning policy? Use these troubleshooting tips to resolve your provisioning errors.

VPC Firewall Rule Quota Reached

The project has reached the maximum number of VPC firewall rules allowed by Google Cloud. Illumio cannot provision additional rules.

  1. In the Google Cloud console, go to IAM & Admin and select Quotas & System Limits.

  2. Filter the quota list for Firewall rules in the Compute Engine API service.

  3. Select the quota and click Edit Quotas.

  4. Enter a new limit that accommodates the rules Illumio needs to provision, and submit the request.

    Alternatively, go to VPC network > Firewall and delete unused firewall rules.

  5. Consider consolidating rules by using network tags or service accounts as targets instead of per-instance rules.

  6. In the Illumio Console, retry provisioning for the affected rules.

Insufficient Permissions to Modify Firewall Rules

The Illumio service account does not have the IAM role required to modify VPC firewall rules in this project.

  1. In the Google Cloud console, go to IAM & Admin and select IAM.

  2. Locate the Illumio service account in the principals list.

  3. Click Edit principal, and then click Add another role.

  4. Select the Compute Security Admin (roles/compute.securityAdmin) role.

  5. Click Save.

  6. For a Shared VPC, grant the role on the host project rather than the service project.

  7. Confirm that no organization policy constraint blocks firewall rule changes for this project.

  8. In the Illumio Console, retry provisioning for the affected rules.