Illumio Core What's New and Release Notes for Release 24.2

E-127950

Traffic flowing on ignored interfaces is now ignored as expected

On Windows workloads, ICMP error packets traversing ignored network interfaces were not ignored as expected and were then blocked. This issue is resolved.

E-126071

Linux and AIX VEN activation issue is now fixed in SOCKS Proxy environment

Where a web proxy server was configured for a VEN, activation could fail on Linux and AIX workloads if the web proxy server also supported the SOCKS Proxy protocol.

E-125712

Excessive SID logging is fixed

This release fixes an issue that caused excessive logging of SIDs in agentmgr.log on Windows Domain Controllers.

E-125300

Traffic directionality and source/destination representation is fixed

When the Container Inherits Host Policy (CIHP) feature is enabled on a workload hosting a container, the VEN reports traffic flowing into the workload (that is, traffic flowing both to the host and to the hosted container(s)). The VEN collects and reports all traffic flows in the host network namespace. In some cases, the host and the PCE interpreted the directionality of the traffic differently. For example, the host interpreted traffic flowing inbound to the container as outbound traffic because it flowed out from the host. Conversely, the PCE interpreted the same traffic as flowing inbound to the container. Prior to VEN release 24.2.30, such traffic was depicted in the Traffic page as outbound traffic (consistent with the host's interpretation), which caused confusion. Beginning with VEN release 24.2.30, traffic in this case is now shown as inbound traffic (consistent with the customer and the PCE’s interpretation).

E-123210

Policy no longer fails when Machine Auth and Rule Hit Count are both enabled on Windows

On Windows workloads, VENs failed to generate policy if Machine Authentication (AdminConnect) and Rule Hit Count were both enabled. This issue is resolved.

E-123154

FQDN rules now function properly

FQDN rules did not function properly on systems using IPv6 DNS servers and nftables firewall. This issue is resolved.

E-122188

Policy sync error no longer occurs when a VEN operates in a web proxy environment

In environments where a web proxy was configured to direct the VEN to use the proxy to communicate with the PCE and the VEN was switched to Selective mode, new policy may not have been accepted even if there was no Deny rule blocking communication to the proxy. This issue is resolved.