Skip to main content

Illumio Core 25.2.10 Install, Configure, Upgrade

VEN Support for Red Hat 5

This section describes Illumio VEN support for the Red Hat 5 operating system.

For more about OS support for the VEN, see VEN OS Support and Dependencies in the Illumio Support portal.

History of Illumio Red Hat 5 Support

  • Illumio's initial support for Red Hat Enterprise Linux (RHEL) 5.5 or greater began in VEN release 18.2.x.

  • Illumio discontinued support for RHEL 5.x in VEN 18.3.x and later releases.

  • Illumio re-introduced support for RHEL 5.x in VEN release 23.2.10 and later releases.

  • Beginning in VEN release 24.2.20:

    • Illumio supports Oracle Linux 5 UEK

    • VEN activation fails if the ipset userspace binary is not installed on RHEL 5 workloads.

Requirements

  • VEN support for RHEL 5 requires VEN release 23.2.10 or later.

  • If no version number is listed for an OS package dependency, use the version included with the OS distribution.

  • If you are using a public Certificate Authority to sign your OnPrem PCE, or if you've deployed a SaaS PCE, then to install the VEN on RHEL 5.x, make sure that the latest Certificate Authorities are installed with your operating system.

  • Download the VEN software package (illumio-ven-pkgs) from the Illumio Support portal and use the VEN CTL to install and activate the VEN on the hosts in your environment.

Limitations for VEN Support on RHEL 5.x

Installing the VEN on RHEL 5 workloads presents the following limitations:

  • Must download VEN software package (RPM) and install and activate using the VEN CTL

    For RHEL 5 VENs, only the VEN CTL installation and activation methods are supported (see Linux: Install and Upgrade with CLI and VEN CTL). Download the VEN software package (illumio-ven-pkgs) from the Illumio Support portal. VEN installation using the VEN Library on the PCE is not supported.

  • On VEN release 24.2.20, VEN activation fails if ipset userspace binary isn't installed on the RHEL 5 workload

    The ipset userspace binary is not installed by default on RHEL 5 workloads. If the binary is missing while attempting to activate a 24.2.20 VEN on a RHEL 5 VEN workload, activation fails and the following Runtime Environment error occurs. To remedy, you must install the provided ipset userspace binary on the workload and then try again to activate the VEN:

     Cannot find ipset command. Please install /opt/illumio_ven/etc/extras/pkgs/ipset-<version>.x86_64.rpm

    On VEN releases from 23.2.10 to 24.2.10, VEN activation doesn't fail if the ipset userspace binary isn't detected on the workload but a failure may occur later when the VEN tries to apply policy.

  • Incompatible ipset modules may have been loaded on the workload

    If one or more incompatible ipset modules is loaded on the RHEL 5 workload, the VEN enters an error state and the following error message appears in the platform.log. To remedy, you must remove the incompatible ipset module from the workload.

    ERROR:: ilo_ipsets load returned non-zero. /opt/illumio_ven/bin/ilo_ipsets load -w workload/ .... /new 2>&1 insmod: error inserting '/opt/illumio_ven/etc/extras/modules/el5uek/5.11/ipset/ip_set_iphash.ko': -1 Unknown symbol in module Cannot load ip_set_iphash module. Cannot load ip_set_iphash module. Please unload incompatible modules ip_set.

  • Missing ipset modules can cause policy application failure

    On all VEN releases that support RHEL 5 (23.2.10 and later), applying policy fails if compatible ipset modules are missing. Beginning with VEN release 24.2.20, the VEN tries to resolve the failure if it occurs. VEN release 24.2.20 also provides the correct ipset modules for Oracle Linux 5 UEK.

  • VEN tampering may occur if the iptables service loads rules in iptables at boot

    Illumio recommends that you disable the iptables service before you install the VEN on RHEL workloads. This is necessary because the iptables service executes a script that loads rules in /etc/sysconfig/iptables at boot, which is undesirable for two reasons: (1) non-VEN rules may conflict with rules the VEN applies to the firewall, and (2) the VEN may regard these non-VEN rules as firewall tampering.

  • The VEN cannot enforce FQDN policy (DNS-based rules).

  • The VEN doesn't support IPv6 or IPv6 ipsets

  • The VEN doesn't support byte counting.

  • AdminConnect (also known as Machine Auth) is not supported.

ULOG for Traffic Flows

VENs on RHEL 5 workloads use ULOG to log traffic flows.

Illumio Changes to iptables for VENs on RHEL 5.x Workloads

Note

These changes to iptables affecting Red Hat 5 also affect other Linux distributions using iptables, including Red Hat 6 and 7, Ubuntu, Debian, and SUSE.

In its support for RHEL 5, Illumio has changed the type of set the VEN uses for ipset.

  • To run the VEN on RHEL6/7, Ubuntu, Debian, SUSE versions, the VEN supports using only hash:net for ipset, used to store a single IP address or the CIDR.

  • To run the VEN on RHEL 5.x, for every ipset, you can select from two ipset types: iphash, used to store a single IP address, or nethash, used to store a CIDR.

To summarize:

Changes that Illumio made to support VENs on RHEL 5.x include:

  • The VEN uses iphash and nethash set types. Both have a limit of 65536 elements.

  • iphash can store only single IP addresses; nethash can store only CIDRs.

Changes that Illumio made to support VENs on RHEL 6/7, Ubuntu, Debian, SUSE and later versions include:

  • The VEN release 23.2.10 and later uses hash:ip to store single IP addresses and hash:net to store CIDRs.

Example to Illustrate the iptables Changes in Linux

The following example compares how Illumio generated iptables before and after VEN release 23.2.10 in RHEL 7.

RHEL 7 ipset prior to the RHEL 5 change1

RHEL 7 ipset after the RHEL 5 change2

RHEL 5 ipset beginning in VEN release 23.2.103

create ILON-F535B4CAC2EB950D hash:net

family inet maxelem 6 hashsize 6

create ILON-F535B4CAC2EB95000 hash:ip

family inet maxelem 3 hashsize 3

-N ILON-F535B4CAC2EB95000 iphash

add ILON-F535B4CAC2EB950D 10.10.10.10/32

add ILON-F535B4CAC2EB95000 10.10.10.10

-A ILON-F535B4CAC2EB95000 10.10.10.10

add ILON-F535B4CAC2EB950D 20.20.20.20/32

add ILON-F535B4CAC2EB95000 20.20.20.20

-A ILON-F535B4CAC2EB95000 20.20.20.20

add ILON-F535B4CAC2EB950D 30.30.30.30/32

add ILON-F535B4CAC2EB95000 30.30.30.30

-A ILON-F535B4CAC2EB95000 30.30.30.30

add ILON-F535B4CAC2EB950D 40.40.40.40/24

create ILON-F535B4CAC2EB95001 hash:net family inet maxelem 3 hashsize 3

-N ILON-F535B4CAC2EB95001 nethash

add ILON-F535B4CAC2EB950D 50.15.50.50/28

add ILON-F535B4CAC2EB95001 40.40.40.40/24

-A ILON-F535B4CAC2EB95001 40.40.40.40/24

add ILON-F535B4CAC2EB950D 60.60.60.60/31

add ILON-F535B4CAC2EB95001 50.50.50.50/28

-A ILON-F535B4CAC2EB95001 50.50.50.50/28

add ILON-F535B4CAC2EB95001 60.60.60.60/31

-A ILON-F535B4CAC2EB95001 60.60.60.60/31

  • 1 Prior to VEN release 23.2.10, this is how Illumio generated RHEL 7 for ipset.

  • 2 Beginning in VEN release 23.2.10, there is no need to change how you define IP Lists in the PCE; the VEN handles everything for you.

  • 3 Beginning with VEN release 23.2.10, this is how Illumio generates RHEL 7 for ipset.