Illumio Core What's New and Release Notes for Release 24.2

macOS VEN authentication failed sporadically

Under certain race conditions, macOS VENs failed to authenticate with the Network Location Detection PCE API and incorrectly marked corporate interfaces as external interfaces, leading to corporate network traffic being dropped sporadically.

Policy failed to load on some OEL 5.11 UEK workloads with 24.2.10 VENs

Policy failed to load on workloads running Oracle Enterprise Linux 5.11 Unbreakable Enterprise Kernel (UEK) and with 24.2.10 VENs installed.

Policy application failure

In some cases, policy application failed in orgs with Rule Hit Count enabled.

VEN unable to create a support report

VENs installed on workloads configured with the Windows Server Core option failed to create a support report.

Customer's pre-existing iptables rules were removed 

After switching the VEN from Idle mode to a different node, an organization's pre-existing iptables rules were removed (which in turn blocked the associated traffic) even though the Illumio Core non-primary coexistence mode was enabled. The issue was caused by the use of a dash instead of an underscore between "non" and "primary" in the coexistence mode setting.

Connectivity lost following VEN upgrade 

On Solaris v11.4 workloads, immediately after upgrading a VEN to version 24.2.11, in some cases the VEN lost connectivity with the PCE. The issue stemmed from a change in the accepted /etc/firewall/pf.conf syntax.

Policy sync error thrown following Solaris VEN update

A policy sync error was thrown after updating a VEN on a Solaris workload from VEN release 21.5 to release 23.2. The error appeared after switching the VEN out of Idle mode.

Programming error when proxy communication was allowed in some cases

For a VEN behind a web proxy, a policy programming error occured if communication with the proxy was allowed by an FQDN in an IPList.

False-positive firewall tamper alerts appeared after upgrading Linux VEN to 24.2.10

After updating VENs on Linux workloads to VEN release 24.2.10, false-positive firewall tampering alerts appeared on the PCE every ten minutes. The issue stemmed from the presence of a deprecated conntrack chain in the firewall.

From the PCE, unable to upgrade or uninstall VENs installed on certain Windows workloads

An issue in Illumio Core Release 24.2.10-VEN prevented upgrading or unpairing VENs installed on Windows 7 and Windows Server 2008R2 workloads through the PCE web console. The ability to manually upgrade and uninstall VENs was unaffected.

E-119624

Excessive number of API requests impacted performance

In some circumstances, performance was impacted when the PCE tried to fulfill a higher-than-normal number of API requests from VENs.

VEN-PCE Communication Failed in a Proxy Environment

After upgrading a VEN in an environment where workloads are behind a proxy server and unable to resolve the PCE's FQDN, the VEN's communication with the PCE failed. The problem stemmed from an API version mismatch.

Re-activating a deactivated VEN fails on AIX workloads

If you deactivate a VEN installed on an AIX workload and later re-activate it, activation fails and a 401 error is thrown. This is a known issue. Workaround: After you deactivate the VEN, remove the backup folder under the VEN's data directory. WIth the backup folder removed, re-activation succeeds.

VEN failed to apply policy in certain circumstances

When operating in a proxy environment, VENs failed to apply the proxy bypass list, resulting in a failure to apply Illumio firewall policy.

VEN in degraded mode reports illumio-ven-ctl status is healthy

The output of the VEN status command illumio-ven-ctl status indicated a healthy VEN-PCE connection even though the VEN was in a degraded state throwing errors and blocking flows in response to API requests.