Skip to main content

Illumio Core 21.5 Install, Configure, Upgrade

About NEN Installation and Architecture

This topic explains how the NEN is installed and the supported architectures.

PCE-based versus Standalone NEN Installation

Important

Beginning with this release, the NEN is deployed as a standalone installation only. New PCE-based installations are not supported.

In NEN 2.1.x, you had the choice of two types of NEN installations:

  • PCE-based NEN installation

    You installed the NEN on one of the PCE data nodes so that the NEN ran as a service on the PCE. When you installed the NEN as a service on a PCE data node, you had the option of installing it on both data nodes (data node 0 and data node 1) so that the NEN operated as a high availability (HA) pair.

  • Standalone NEN installation

    You installed the NEN on a separate Linux host. When you installed a standalone NEN, you did not have the option to configure the NEN deployment as a High Availability (HA) pair.

Beginning with this release, you must install the NEN on a separate Linux host (standalone installation). The PCE-based NEN installation is no longer supported. Standalone NEN installation has the following benefits:

  • Provides full (optional) HA support for Illumio On-Premises customers and Illumio Cloud customers.

  • Allows you to deploy NENs closer to your network devices such as load balancers and switches.

  • Supports higher scale with multiple NEN HA pairs paired to a single PCE cluster.

Important

Because release NEN 2.3.10 and later don't support a PCE-based installation, customers with existing installations (NEN 1.0.1 through NEN 2.1.0) must upgrade to NEN 2.3.10 or later. For information, see Upgrade NEN 2.1.0 PCE-based Installation to NEN 2.3.10 Standalone Installation.

NEN High Availability (HA) Support

Prior to this release, the NEN derived HA support from the PCE's HA capabilities. To take advantage of that support, you had to install the NEN on the PCE data nodes as part of the NEN's PCE-based installation. Beginning with this release, the NEN supports full HA as part of its standalone installation, independently of the PCE.

The following diagram illustrates how to plan your NEN installation to provide full HA support by installing it on two Linux hosts (node 1 and node 2). In an HA configuration, the primary NEN performs the following actions:

  • Retrieves configuration information from the PCE and reconciles it with the PCE database.

  • Determines what work needs to go into the work queue for the NEN HA pair.

If the primary NEN (on node 1) loses connectivity to the PCE, the secondary NEN (on node 2) becomes the primary NEN until the NEN on node 1 reestablishes connectivity with the PCE.

Note

For hardware requirements in an HA Pair implementation, see CPU, Memory, and Storage Requirements in this topic.

When using the NEN for SLB integration, both NENs (primary and secondary) can program any load balancer because they share the work queue. Either NEN can accept the next job from the work queue depending on their available capacity. This capability is available when the primary NEN has connectivity with the PCE.

nen-ha-pair-architecture.png

A PCE cluster supports multiple NENs per PCE, which can consist of multiple single node NENs, multiple NEN HA pairs, or a combination of both.

NEN Supercluster Support

In NEN 2.1.0 (when installed as part of Illumio Core 20.2.0, 21.1.0, or 21.2.x), Illumio provided limited support for the NEN with PCE Supercluster deployments. For information see, Manage NEN on Supercluster Leader in “NEN 2.1.0 New Features.” NEN releases prior to 2.1.0 did not provide Supercluster support.

NEN 2.3.10 extended its support for installing a NEN with a PCE Supercluster deployment in the following ways:

  • NEN Installation on a Supercluster Member

    You can pair the NEN to the other regions in the Supercluster; referred to as Supercluster “members.” Prior to this release, you could only install the NEN on the Supercluster leader. For more information about PCE Supercluster deployment architecture, see “Design Supercluster Deployment” in the PCE Supercluster Deployment Guide.

    Caution

    Plan your NEN installation carefully when you install it as part of a PCE Supercluster deployment. Once installed, you cannot move NENs from one PCE Supercluster member to another member.

  • Multiple NEN HA Pairs in a Supercluster Member

    Based on your scale requirements and the location of your network devices (such as SLBs), you can connect multiple NEN HA pairs to any cluster in a PCE Supercluster deployment (not just the PCE Supercluster leader). This enhancement is necessary to support environments with large numbers of SLBs and virtual servers that are geographically distributed.

    Note

    At a minimum, you must install a primary and secondary NEN HA pair in one of the Supercluster regions.

The following diagram illustrates how to plan your NEN installation in a PCE Supercluster deployment:

supercluster-architecture.png

CPU, Memory, and Storage Requirements

To install NEN(s) to support a given number of Server Load Balancers and Virtual IPs, your hardware must meet the hardware requirements detailed in this section.