Skip to main content

Illumio Core 25.2.10 Administration Guide

VEN Firewall Tampering Detection

The VEN Firewall Tampering Detection feature monitors host firewalls for unauthorized changes. Whether and when the VEN alerts the PCE about signs of tampering differs by VEN version (as detailed below). In all VEN versions, the VEN checks whether tampering occurred, and if tampering is verified, restores the policy. If the VEN can't communicate with the PCE while attempting to report suspected firewall tampering or during the rule restoration process, it attempts to recover the last-known good copy of its locally-stored policy.

What Triggers a Tampering Event

A host firewall tampering event occurs when another administrator or an attacker:

  • Adds a firewall rule to the Illumio firewall compartment.

  • Modifies a firewall rule added by Illumio.

  • Deletes a firewall rule added by Illumio.

  • Deletes all firewall rules (flush) added by Illumio.

How Tampering Detection Works

The VEN detects host firewall tampering on several operating systems, typically within seconds. For all supported OSs, the VEN checks whether runtime firewall rules have changed. Reporting detected tampering to the PCE can take up to 10 minutes but is typically much faster. When the VEN alerts the PCE differs by VEN release.

Table 3. Alert Timing and Format

VEN version

Alert order and format

Notes

VEN releases 26.2.20 and later

  1. Detect signs of possible tampering.

  2. Alert the PCE.

  3. Determine if tampering occurred.

  4. Restore rules if tampering verified.

  • If possible tampering is detected, the VEN sends an alert to the PCE immediately (pre-verification).

  • agent.tampering: severity = Warning (Settings > Troubleshoot > Events)

VEN releases pre-26.2.20

  1. Detect signs of possible tampering.

  2. Determine if tampering occurred.

  3. Alert the PCE.

  4. Restore rules if tampering verified.

  • The VEN doesn't alert the PCE unless and until tampering is verified.

  • agent.tampering: severity = Information (Settings >Troubleshoot > Events)



Table 4. Tampering Detection by Host OS

OS

Monitoring

Detection

Rule restoration process starts if tampering is verified?

Linux

Continuous

Looks for changes in the runtime firewall policy  to iptables, ipset, or IPsec compared to the PCE-generated Illumio policy.

Yes

Windows

Continuous

Looks for changes in the runtime firewall policy to WFP or IPsec compared to the PCE-generated Illumio policy.

AIX

Periodic (every 10 mins.)

Compares periodic snapshots of the runtime firewall policy with the PCE-generated Illumio policy.

Solaris

Periodic (every 10 mins.)

Compares periodic snapshots of the runtime firewall policy with the PCE-generated Illumio policy.



Firewall Change History

Changes to the firewall on a workload are historically recorded for an audit trail. Up to 10 changes to the firewall history are saved. On-prem customers can view the history via the PCE Support Reports (Settings > Troubleshoot).

View Tampering Alerts

You can view tampering alerts in the following locations:

  • On the host VEN

  • In the PCE web console

  • Via the /eventsIllumio Core REST API

  • In Splunk or other SIEM software: query for agent.tampering events in accordance with the SIEM vendor's query procedures.

On the VEN Host

Workload OS

Procedure

Linux

As root, separately execute the following commands:

Tail the VEN log file to see suspected tampering events and hash comparisons:

tail -f /opt/illumio_ven_data/log/platform.log
INFO: Possible tamper detected...
INFO: FW iptables checksums ... (compares security policy hashes to see if anything changed)

Windows

Check \programdata\illumio\log\platform.log and search "!!!Tampering detected"

Note

This alert displays "Filtering Platform Policy Change" when a tampering event is detected. Double-click the alert for detailed information.

Via the PCE UI

  1. To view agent.tampering events in the PCE web console, navigate to Settings > Troubleshoot > Events.

  2. Double-click an agent.tampering event to see its details.

Via the REST API

To return all tampering events for an organization, execute one of the following commands using your organization URI. (For more information, see Events in the REST API Developer Guide

  • Example Curl Command to Get Information for All agent.tampering Events:

    curl -i -X GET https://pce.example.com:8443/api/v2/orgs/1/events/?event_type=agent.tampering -H "Accept: application/json" -u $KEY:$TOKEN

  • Example Curl Command to Get Information for a Specific agent.tampering Event:

    curl -i -X GET https://pce.example.com:8443/api/v2/orgs/1/events/some_event_ID -H "Accept: application/json" -u $KEY:$TOKEN

  • Example JSON Response Body from Getting an agent.tampering Event:

    {
    "href": "/orgs/1/events/some_event_ID",
    "timestamp": "2019-06-17T05:42:10.419Z",
    "pce_fqdn": "someName.someDomain",
    "created_by": {
        "agent": {
            "href": "/orgs/1/agents/xxxxx",
            "hostname": "someHostname"
        }
    },
    "event_type": "agent.tampering",
    "status": "success",
    "severity": "err",
    "action": {
        "uuid": "xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx",
        "api_endpoint": "FILTERED",
        "api_method": "PUT",
        "http_status_code": 204,
        "src_ip": "xx.xxx.xx.xx"
    },
    "resource_changes": [],
    "notifications": [
        {
            "uuid": "yyyyyyyy-yyyy-yyyy-yyyy-yyyyyyyyyyyy",
"notification_type": "workload.oob_policy_changes",
            "info": {
                "tampering_revert_succeeded": true,
                "beginning_timestamp": "2019-06-17T05:42:10Z",
                "ending_timestamp": "2019-06-17T05:42:10Z",
                "num_events": 1
            }
        }
    ]
}