Skip to main content

Illumio Core 21.5 Install, Configure, Upgrade

  • Illumio Core 21.5 Install, Configure, Upgrade
  • Upgrade Summary
  • Upgrading Illumio Core: Why and How

Upgrading Illumio Core: Why and How

Important

In addition to VEN upgrade, this guide discusses reasons to upgrade your PCE platform. Illumio Core Cloud customers rely on Illumio Operations to upgrade and manage the PCE platform. However, reading this guide is useful to learn about the key updates to Illumio Core by release.

Have You Been Missing Out?

Illumio adds new features constantly! We’re always busy innovating and improving. If you’ve had your Illumio software up and running for a while without upgrading, we’d like to encourage you to consider moving to a newer version.

We understand the appeal of stability and the trustworthiness of your current deployment. Your applications are vital to your organization, and stability is crucial. It can seem like a big step to update software that’s already working so well. But why not take a few moments to imagine how life could be if you had access to some of Illumio’s recent features (not to mention the fixes to known issues and limitations). And if you’re thinking the upgrade itself will be complicated, we’ve included a short summary below of how it’s done, so you can see the path ahead.

Best Practice: Pick a Standard or LTS Release

Pick the release type that’s right for your organization and maintain N-1 version status.

Standard Release

Standard releases of the PCE and VEN receive limited maintenance for 1 year. For customers who want to take advantage of the latest features as soon as they are available, and can commit to upgrading to the next release for bug fixes and security updates. Remember, you don’t have to upgrade your VENs to use most new PCE features. Check Versions and Compatibility on the Illumio Support site.

Long Term Support (LTS) Release

Long Term Support releases of the PCE and VEN receive active maintenance for 1 year and limited maintenance for another 2 years. For customers who wish to upgrade less frequently and stay on a version of the PCE or VEN with active maintenance support.

Features You’ve Been Missing

Here are just some of the things our tireless teams have engineered, tested, and sent out into the world, maybe while you weren’t looking, to increase the capabilities of Illumio Core and keep your essential systems even safer.

23.5.0

An Illumio Core Cloud customer release only.

November 2023. Works with VEN 18.2.3 - 23.2

  • New UI replaces classic UI to maximize user productivity and enable intuitive platform administration.

  • Policy templates: predefined policy definitions for some of the most popular security practices

  • New widgets in Ransomware Protection Dashboard.

  • Bulk import and export of workload labels.

  • Enhancements to visualization tools: Vulnerabilities tab, mapping members with no traffic, new group tabs.

  • New object type: Windows outbound process.

  • Traffic data for unpaired VENs.

  • Splunk TA and app version upgraded to 4.0.0, including support for MT4L, multiple PCEs, multiple organizations, and faster search.

23.4.0

An Illumio Core Cloud customer release only.

July 2023. Works with VEN 18.2.3 - 22.5.20

  • New PCE user interface (UI) is default for all new and upgrading customers.

  • Quick links to workload detail pages from the Dashboard.

  • Display more related information by clicking in pie charts on the Dashboard.

  • Policy Check is aware of network type, which makes rule writing easier.

  • New lost agent warning event indicates when a VEN has been unpaired from the PCE for longer than the uninstall timeout, then returns.

23.2.0

May 2023. Works with VEN 18.2.3 - 22.5.20

  • New PCE user interface (UI) to maximize user productivity and enable intuitive platform administration.

  • Ransomware Protection information is provided for each workload, aggregated in the main Dashboard.

  • Ringfencing rules shrink the security perimeter from a subnet or VLAN to a single application.

  • Set the VEN type, server or endpoint, in the pairing profile.

  • Configurable VEN upgrade timeout.

  • Configurable second FQDN for southbound traffic from VEN to PCE.

  • Extended support for RHEL 5 on VENs.

  • Explore features are enhanced in several ways, including daily auto-generation of a Default Graph report.

22.5.20

April 2023. Works with VEN 18.2.3 - 22.5.20

  • Regular maintenance release that solved software and security issues to refine the software and improve its reliability and performance. See "Resolved Issue in 22.5.20" in the Illumio Core Release Notes 22.5.

  • Deployment of Core VENs on Kubernetes nodes is deprecated. Instead, use Illumio Core for Kubernetes.

22.5.10+UI2

February 2023.

Returned the Explorer feature to the PCE web console for customers who still want to use the functionality in that area of the GUI. (In Illumio Core 22.5.0 and 22.5.10, Illumio removed the Explorer feature from the PCE web console main menu.)

22.5.10 (LTS Candidate)

January 2023. Works with VEN 18.2.3 - 22.5.10

  • VEN dashboard with broad, visualized information about VEN statistics.

  • VEN tampering protection: require a token with commands to avoid accidental or malicious actions.

  • Context menus in Illumination Plus.

  • See the amount of data transferred into and out of workloads and applications in a datacenter.

  • Mac OS support.

22.4.0 (Standard)

An Illumio Core Cloud customer release only.

October 2022. Works with VEN 18.2.3 - 22.4.0

  • ML/AI-based scanner detection, so that discovered scanners can become workloads.

  • Usability enhancements in the VEN details page.

  • Illumio Core REST API enhancements.

22.3.0 (Standard)

An Illumio Core Cloud customer release only.

August 2022. Works with VEN 18.2.3 - 22.3.0

  • Prevent the creation of spurious labels in the PCE.

  • REST API: SLB and Virtual Server API consistency and filtering.

  • Support for shared SNAT out of public clouds.

  • Support for non-domain joined interfaces for the Illumio Endpoint - Windows.

22.2.10 (LTS Candidate)

July 2022. Works with VEN 18.2.3 - 22.2.0

  • Replication and failover, with a PCE on "warm standby" for increased reliability.

  • Solved software and security issues to refine the software and improve its reliability and performance. See the Illumio Core Release Notes 22.2.10.

22.2.1 (LTS Candidate)

May 2022. Works with VEN 18.2.3 - 22.2.0

Regular maintenance release that solved software and security issues to refine the software and improve its reliability and performance. See the Illumio Core Release Notes 22.2.1.

22.2.0 (Standard)

May 2022. Works with VEN 18.2.3 - 22.2.0

  • Policy exclusions in ruleset scopes and rules. Define security policy by excluding unwanted labels.

  • Scopeless rules. Choose whether or not to include scopes when creating new rulesets.

  • Simplified rule writing UI. Show advanced rule writing features only when you need them.

  • Label type (Role, Application, etc.) is indicated by an icon, and you can filter by type when entering label names.

  • Illumination shows whether traffic is blocked by full enforcement or an enforcement boundary.

  • Disable and enable enforcement boundaries.

  • Generate reports from Explorer traffic flow queries.

22.1.3 PCE (Standard)

June 2022. Works with VEN 21.2.0 - 22.1.0

Important

Release available for Illumio Core Cloud customers only.

Regular maintenance release that solved software and security issues to refine the software and improve its reliability and performance. See the Illumio Core Release Notes 22.1.3.

22.1.2 PCE (Standard)

April 2022. Works with VEN 21.2.0 - 22.1.0

Important

Release available for Illumio Core Cloud customers only.

Regular maintenance release that solved software and security issues to refine the software and improve its reliability and performance. See the Illumio Core Release Notes 22.1.2.

22.1.1 PCE (Standard)

March 2022. Works with VEN 21.2.0 - 22.1.0

Important

Release available for Illumio Core Cloud customers only.

Regular maintenance release that solved software and security issues to refine the software and improve its reliability and performance. See the Illumio Core Release Notes 22.1.1.

22.1.0 PCE (Standard — unreleased PCE version)

2022. Works with VEN 21.2.0 - 22.1.0

  • Rule writing available from Explorer

  • Enforcement Boundary information in Reports

  • Display of traffic blocked by Enforcement Boundaries in Explorer Reported view

  • Numerous Explorer usability enhancements

  • Numerous policy and workload incremental usability improvements

  • Single Pane of Glass (SPOG) enhancements

  • Certificate validation for SSO configuration

  • Signing for SAML requests

21.5.20 PCE (LTS)

March 2022. Works with VEN 18.2.3 - 21.5.20

Regular maintenance release that solved software and security issues to refine the software and improve its reliability and performance. See the Illumio Core Release Notes 21.5.20.

21.5.12 PCE (LTS)

FFebruary 2022. Works with VEN 18.2.3 - 21.5.20

The official LTS release for the Illumio Core 21.5.x release series. This regular maintenance release solved software and security issues to refine the software and improve its reliability and performance. See the Illumio Core Release Notes 21.5.12.

21.5.10 PCE (LTS Candidate)

January 2022. Works with VEN 18.2.3 - 21.5.20

  • VEN compatibility report updates for IPv6 support

  • Performance enhancements: policy provisioning, container workloads, Kubelink service updates, and convergence times

  • VEN support on IBM Z systems running RHEL 7 and RHEL 8

  • Label-based Security setting for IP Forwarding

  • Rotate database passwords and other internal secrets

21.5.1 PCE (Standard)

December 2021.

Regular maintenance release that solved software and security issues to refine the software and improve its reliability and performance. See the Illumio Core Release Notes 21.5.1.

21.5.0 PCE (Standard)

November 2021.

  • PCE Support Bundles: generate support reports in web console instead of command line.

  • Core services detector

  • Alerts displayed to tell whether the hardware provisioned for each node meets requirements.

  • Use FQDN instead of hostname to more easily distinguish messages from different hosts.

  • Enhanced security for keys and secrets.

  • 8-region Supercluster.

21.4.1 PCE (Illumio Core Cloud only)

October 2021. Works with VEN 18.2.x - 21.2.3 (Standard release)

  • Service Account management in the PCE web console

  • SSO support for service providers

  • Enhancements for the HAProxy TLS version limit

21.3.0 PCE (Illumio Core Cloud only)

August 2021. Works with VEN 18.2.x - 21.2.3 (Standard release)

  • Service Accounts: Instead of being associated with a user, an API key can be associated with a service.

  • Parallel Coordinates: In Explorer, search results using the Parallel Coordinates format are improved.

21.2.3 PCE (LTS)

October 2021. Works with VEN 18.2.x - 21.2.3 (LTS)

Regular maintenance release that solved software and security issues to refine the software and improve its reliability and performance. See the Illumio Core Release Notes 21.2.3.

21.2.2 PCE (LTS)

August 2021. Works with VEN 18.2.x - 21.2.2 (LTS)

  • Illumio Core Maintenance Release

  • Cloud available through the PCE web console

21.2.1 PCE (LTS candidate)

June 2021. Works with VEN 18.2.x - 21.2.1 (LTS candidate)

  • RHEL 8 supported for PCE

Note

21.2.1-PCE and 21.2.1-VEN are candidates for LTS. For information on Illumio software support for Standard and LTS releases and to verify the LTS status of the Core 21.2.1 release, see Versions and Releases on the Illumio Support portal.

21.2.0 PCE (Standard)

May 2021. Works with VEN 18.2.x - 21.2.0 (Standard)

  • Enforcement Boundaries: Build deny-list type rules without rule conflict, and maintaining Zero Trust.

  • Global Explorer: Unified results for members from every region in a supercluster.

  • Asynchronous Explorer queries: No need to wait for query to return results. Results can be retrieved for up to 24 hours.

  • Label groups for RBAC: Use label groups to define user permissions.

  • Supercluster replication enhancements.

  • Supercluster rolling upgrade when upgrading to a hotfix or a maintenance release.

  • LDAP improvements to support better user lookup.

  • Enhanced security for PCE TLS configuration.

  • Reports (preview): generate executive summary and app group summary reports.

  • RHEL 8 supported for PCE (preview)

21.1.0 PCE (Standard)

March 2021. Works with VEN 18.2.x - 21.1.0 (Standard)

  • LDAP authentication: PCE supports LDAP authentication for users with OpenLDAP and Active Directory.

  • Label restrictions for Kubernetes namespaces: Illumio administrators have a way to control which labels can be assigned by the developers managing their Kubernetes environments.

  • PCE hardening: PCE now takes additional steps to ensure its own security.

  • VEN proxy support on Linux, AIX, and Solaris: Extends VEN proxy support from Windows systems to Linux, AIX, and Solaris devices.

  • Aggressive tampering protection for nftables: Provides support for nftables that runs on RedHat. Detection of external firewall configurations are called aggressive tampering and the VEN will log such errors. Now, the VEN can detect any configuration that is not explicitly configured on the VEN.

20.2.0 PCE (Standard)

October 2020. Works with VEN 18.2.x - 20.2.0 (Standard)

  • Selective enforcement: Set enforcement policy to protect only a subset of applications or processes on a workload.

  • Access restrictions: Restrict the usage of API keys and the PCE web interface by IP address and block API requests coming in from non-allowed IP addresses.

  • Multi-node traffic database: Scale traffic data by sharding it across multiple PCE data nodes to store more data and improve read and write performance.

  • Centralized, automated VEN upgrade.

20.1.0 PCE (Standard)

April 2020. Works with VEN 18.2.x - 20.1.0 (Standard)

  • RBAC for app owners: Delegate policy writing to downstream teams; read-only access; per-app read/write. Think of this as zero-trust views into Illumination.

  • Reject connections: Configure workloads to send reject messages if there is a policy violation.

  • Flow collection: Windows broadcast traffic can clog up the system. Configure the PCE to drop or aggregate it.

19.3.3 PCE – 19.3.6 PCE (LTS)

September 2020 - January 2021. Works with VEN 18.2.x - 19.3.6

Regular maintenance releases that solved software and security issues to refine the software and improve its reliability and performance.

19.3.2 PCE (LTS)

July 2020. Works with VEN 18.2.x - 19.3.2

  • Health Metrics: Application metrics with configurable thresholds have been added to PCE health monitoring.

  • Workload clone alerts: Filter workloads by whether a clone has been detected.

  • Oracle Exadata support.

  • Containers now available in Supercluster member regions.

19.3.1 PCE (Standard)

March 2020. Works with VEN 18.2.x - 19.3.1

  • Containers are now supported with visibility and enforcement for Kubernetes and OpenShift.

  • UI: The App Group map is enhanced; in Explorer, the Connection State and draft view are improved.

19.1.0 PCE (Standard)

June 2019. Works with VEN 18.2.x - VEN 19.1.0 (Standard)

  • Switch visibility and enforcement with Network Enforcement Node: Secure workloads that are attached to network switches.

  • Use Rule Search to search and analyze rules, so you can fine-tune them and optimize enforcement.

  • Internal PCE log file rotation: To increase the amount of log data, customize the rotation of PCE log files.

  • Export reports in JSON and CSV to share the information with anyone who doesn’t have access to the PCE.

  • Workload Manager: A new user role to manage workloads, pairing profiles, and API keys.

18.3.1 PCE (Standard)

March 2019. Works with VEN 18.2.x - VEN 18.3.1 (Standard)

  • Internal syslog: You no longer need to manage the syslog and log rotation.

  • Policy revert: Return to previous version if a policy rollout is unsuccessful.

  • Session timeout can be set by organization owner to control timeout on user sessions.

  • Firewall coexistence between Illumio firewall and existing firewalls that use WFP or IPTables (requires upgrade to VEN 18.3.1)

18.2.5 PCE (LTS)

September 2019. Works with VEN 18.2.x - VEN 18.2.5 (Standard)

  • Common Criteria certified.

  • Risk & Compliance capability.

  • Vulnerability Maps: tune your segmentation to reduce the exposure of unpatched workloads

  • Events storage: Improved use of capacity in the events database.

How to Upgrade the Illumio PCE

Important

This information is provided for reference only. Illumio Core Cloud customers do not upgrade the PCE. Illumio Operations performs this function for Illumio Core Cloud customer.

This is a quick summary. For full instructions, see the PCE Installation Guide for the version you are upgrading to.

Starting with Illumio Core 19.3.0, the PCE is shipped in two parts:

  • PCE – Policy Compute Engine. This is the main processing engine.

  • UI – Browser-based console.

Quick Summary

Before you begin, choose the PCE version you want to upgrade to. Check the Upgrade Path page to see whether you can upgrade directly from your current version in one step, or whether you need to upgrade to another intermediate version first. Then start the upgrade:

  • Download the software, check upgrade prerequisites, and do a few additional preparation steps.

  • Back up the PCE and stop it.

  • Install the software.

  • You might need to update the PCE’s runtime environment file, depending on your currently installed version.

  • Migrate the PCE database.

    To migrate the PCE from one datacenter to another, refer to the Knowledge Base article Migrate the PCE from one Datacenter to Another.

The upgrade is done! Set the PCE’s runlevel to 5 to resume normal operations.

Steps

  1. Download the two software packages (PCE and UI) from the Illumio Support portal to the /tmp folder on your PCE nodes. The UI package is only needed on core nodes, not data nodes.

  2. Back up the PCE with these commands:

    1. Find the node that is running agent_traffic_redis_server:

      sudo -u ilo-pce illumio-pce-ctl cluster-status

    2. On the node that is running agent_traffic_redis_server:

      sudo -u ilo-pce illumio-pce-db-management dump --file db-dump-file

    3. Store a copy of each node's runtime_env.yml file.

  3. Stop the PCE on all nodes:

    sudo -u ilo-pce illumio-pce-ctl stop --wait

  4. On core nodes, install the UI and PCE. Specify both RPM files on the command line:

    rpm -Uvh illumio_pce_rpm illumio_ui_rpm

  5. On data nodes, install the PCE only:

    rpm -Uvh illumio_pce_rpm

  6. Check the Release Notes for all versions after the one you are upgrading from to see whether any of the changes require updates to runtime_env.yml. If so, update the file on all nodes, then check it:

    sudo -u ilo-pce illumio-pce-ctl check-env

  7. Start the PCE on all nodes:

    sudo -u ilo-pce illumio-pce-ctl start --runlevel 1

  8. Migrate the database (you can run this on any node):

    sudo -u ilo-pce illumio-pce-db-management migrate

  9. After database migration is complete, bring the PCE back up to its normal operational level:

    sudo -u ilo-pce illumio-pce-ctl set-runlevel 5

  10. VEN software can also be upgraded now. Go on to the next section to find out how.

How to Upgrade the Illumio VEN

This is a quick summary. For full instructions, see the VEN Installation Guide for the version you are upgrading to.

Note

See also the Knowledge Base article named "Can You Install a VEN on the Workloads Running the Illumio PCE?" for more information.

After you upgrade the PCE, earlier versions of the VEN will still work, but some of the newer PCE features only work with newer VENs (consult the Release Notes to find out exactly which ones). And, of course, each VEN version includes new features and fixed issues. If you want to upgrade your VEN software, follow these steps.

  1. Download the software from the Illumio Support portal.

  2. Run this command on any PCE core node:

    (If you want to upgrade just some of the VENs, you can list them instead of using the --all flag. See "VEN Installation & Upgrade with VEN CTL" in the VEN Installation and Upgrade Guide.)

    sudo -u ilo-pce illumio-pce-ctl ven-upgrade venReleaseId --all

Congratulations – you have upgraded your PCE cluster and VENs to a newer version. Start enjoying the improved UI, better role-based access control, containerization, and other new capabilities of the upgraded PCE and VEN.

If you have questions, don’t hesitate to reach out to your Customer Success Advisor. We will be happy to provide guidance.