Illumio Core 25.2.10 Install, Configure, Upgrade (On-Prem)

pcemigrate migrate --import-rbac successful completion

The pcemigrate migrate --import-rbac command was failing during the migration. This fix ensures the RBAC import completes successfully, allowing you to continue your migration workflow without any interruptions.

pcemigrate migrate command panic

The pcemigrate migrate command panicked with a nil-pointer dereference when workloads on the target PCE lacked hostnames. This fix ensures that the migration completes without interruptions even when some workloads lack hostname data.

pcemigrate wild-export and wkld-import support for complex filter files

The pcemigrate wild-export and wkld-import commands did not support complex filter files. This fix allows users to filter by hostnames, names, hrefs, and external datasets to streamline migration tasks.

venmigrate and AIX workload labels

The venmigrate command did not apply labels to AIX workloads. This fix ensures labels are correctly applied during migration, keeping your AIX workloads organized and consistent.

venmigrate and costly queries to the PCE

The venmigrate command used queries to the PCE instead of referencing the workload UUID. This fix improves migration performance and helps you manage workloads more efficiently.

pcemigrate base directory consistency

The pcemigrate base directory depended on the directory from which the command was executed. This fix ensures the command uses a consistent base directory so migration workflows run reliably from any location.

The pcemigrate sync command may continue updating some workloads on the target PCE even when no further changes are present on the source PCE.

Previously, if a policy object already synchronized to the target PCE was deleted on the source PCE and replaced with a new object with the same name, running pcemigrate sync would delete the object on the target PCE.

This issue has been resolved. The target PCE now updates the existing object with the content of the newly created object from the source PCE.

The tool may panic when pcemigrate migrate --only-import-objects is executed.

pcemigrate sync may fail to provision policy objects on the SaaS PCE

pcemigrate sync may fail to provision policy objects on the SaaS PCE if the content has not actually changed. The update is triggered by the object being provisioned on-prem, or by the absence of a map file, or by an empty map file while there are objects on-prem.

Improved Reliability for Policy Object Deletions

Resolved an issue where deleting certain policy objects—or provisioning them—could fail without triggering a pcemigratesync failure.

More Resilient Handling of HTTP 5xx Errors

Enhanced error-handling logic to better manage transient server-side (5xx) responses.

Unified Version Display

Tool version, commit ID, and timestamp now appear together on a single line for easier reference.

Stability Fix for Policy Object Removal

Addressed a condition that could cause the tool to panic when all objects of a specific policy type were deleted across on‑prem and SaaS environments.

An issue in the pcemigrate sync tool would cause it to stop unexpectedly when all policy objects of a specific type were deleted from the source PCE. This could prevent some policy objects from syncing. This issue is resolved, and pcemigrate sync now continues reliably in this scenario.

In custom migration scenarios, an issue was resolved in which the transplant-vens-status command failed to generate CSV output on Windows systems. The tool now correctly creates CSV files on Windows environments.

Previously, rules that contained unmanaged workloads without hostnames were pruned or dropped from rulesets during policy sync from on-prem to SaaS. The migration sync tool now correctly handles unmanaged workload references, ensuring that valid rules are preserved and not dropped.

Added tooling enhancements and workflows to support custom migration for large customers.

Introduced VEN transplant capabilities using pcemigrate, which enables bulk VEN migration without requiring venmigrate.