Skip to main content

Illumio Core 24.5 Install, Configure, Upgrade

Configure Flowlink

This section provides requirements and steps you need to follow to configure Flowlink.

Requirements

  • CentOS or RHEL server

  • Root privileges to the server

  • Flowlink RPM downloaded from the Illumio Support site

  • PCE with Service Account API Key and Secret

Important

You must have Global Owner privileges to configure Flowlink.

CPU, Memory, and Storage Requirements

To install Flowlink, your hardware must meet the capacity requirements detailed in this section.

Machine Type

Cores/Clock Speed1

RAM per Node2

Storage Device Size3 and IOPS4

Flowlink

2500 workloads

  • 2 cores

  • Intel® Xeon(R) CPU E5-2695 v4 at 2.10GHz or equivalent

8 GB

  • 1 x 20 GB

  • 100 IOPS per device

Footnotes:

1 CPUs:

  • The recommended number of cores is based only on physical cores from allocated CPUs, irrespective of hyper-threading or virtual cores. For example, in AWS one vCPU is only a single hyper-thread running on a physical core, which is half a core. 16 physical cores equates to 32 vCPUs in AWS.

  • Full reservations for vCPU. No overcommit.

2 Full reservations for vRAM. No overcommit.

3 Additional disk notes:

  • Storage requirements for network traffic data can increase rapidly as the amount of network traffic increases. Allocating a separate, large storage device for traffic data can accommodate these rapid changes without potentially interrupting the service.

  • Network File Systems (NFS) is not supported.

4 Input/output operations per second (IOPS) are based on 8K random write operations. IOPS specified for an average of 300 flow summaries (80% unique src_ip, dest_ip, dest_port, proto) per workload every 10 minutes. Different traffic profiles might require higher IOPS.

Flowlink Storage Partitioning

Storage Device

Partition mount point

Size to Allocate

Notes

Device 1, Partition A

/

20 GB

Logrotate must be configured to limit the disk consumption of Flow & System Logs.

Install Flowlink RPM

  1. Login as a root user.

  2. Install the RPM.

    The default install location is: /usr/local/bin/

    Standard installation:

    sudo su
rpm -ivh illumio-flowlink-x.x.x-yy.x86_64.rpm

    Important

    Only the Install Flowlink RPM step needs root user login.

    The Create a Service Account API Key, Create YAML Configuration File, and Run Flowlink steps can be run by logging in as any user.

In the following sections, /home/employee directory is used as an example. The api_info file should be in a directory writable by the user, for example in the /home/employee directory.

Create a Service Account API Key

Note

This procedure requires Global Owner privileges.

Keep in mind

  • There are two ways to create a Service Account API key for Flowlink:

    • Through the API. See API Keys.

    • Through the PCE Web Console (described in the procedure below).

  • The Org ID value is not shown when you create a Service Account API key.

  • Service accounts are always organization-based and specific to a PCE. While creating a service account, users create their permissions and an api_key is created implicitly. Deleting a service account removes its permissions and all associated API keys.

  1. In the PCE UI, go to Access > Service Accounts.

  2. Click Add and configure settings.

    • Name

    • Description (optional)

    • Access Restriction: None.

    • API Key expiration: Keep the default or choose a different option.

    • Roles and Scopes: Select Global Administrator. The All is chosen automatically and cannot be changed.

  3. Click Save.

  4. When the API Key Created dialog appears, preserve the credentials (make a note or download them).

    API-key-created.png

  5. Copy the values of the Authentication Username and Secret into to a text file on the Flowlink server.

    Use a space to separate the key and secret. For example:

    api_xxxxxxxxxxxxxx yyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyy

  6. Copy the absolute path of the file PCE API file /home/employee/api_info. You will need it in the Flowlink configuration file.

Configure HTTP/HTTPS Proxy

Note

Applies only to version 1.3.0 and later.

When Flowlink is running behind a proxy or in a corporate network and the PCE is in the cloud, Flowlink can access the PCE via HTTP/HTTPS proxy configurations.

The following configuration parameters are available to define an HTTP/HTTPS proxy:

proxy_config:
  https_proxy: <HTTPS_PROXY>
  http_proxy: {} <HTTPS_PROXY>{}

The following is an example of a Flowlink YAML configuration file:

proxy_config:
  https_proxy: http://proxy.corporate.com:3128
  http_proxy: http://proxy.corporate.com:3128

In the example above, the HTTP/HTTPS proxy is running on FQDN proxy.corporate.com{{ port: 3128}}.

Create YAML Configuration File

  1. In the /home/employee directory, create a YAML configuration file. You can find an example yml file at /usr/local/illumio/config.yml.example.

  2. Enter the parameters.

    Example of Flowlink configuration:

    pce_addr: mypce.example.com:8443
api_key: $cat /home/employee/api_info
data_directory: /home/employee
aggregation_minutes: 10
destinations:
  - name: netflow
    parser:
      type: netflow
    connectors:
      - type: udp
        properties:
          ports: '2055'

    The above configuration listens for NetFlow on UDP 2055 from any data source. The absolute path is: /home/employee/config.yaml.netflow