Skip to main content

Illumio Core 25.2.10 Install, Configure, Upgrade (On-Prem)

AIX VEN Installation and Upgrade with CLI and VEN CTL

This topic describes how to install and upgrade the Illumio VEN on AIX systems using packaging commands and the VEN CTL.

AIX VEN install considerations

Review the following before proceeding.

General

  • AIX 5.3 is not supported. For the full list of supported AIX versions, see VEN OS Support and Package Dependencies on the Illumio Support site (login required).

  • SecureConnect and SecureConnect Gateway are not supported on AIX.

  • Custom installation directories are not supported.

Caution

Do not change the default installation directories. Doing so will cause installation to fail.

The VEN installs to the following directories by default:

  • /opt/illumio_ven

  • /opt/illumio_ven_data

Boot Scripts

As part of installation, the VEN creates RC scripts ("run commands") in /etc/rc3.d to start the VEN at boot.

Illumio IPFilter

IBM has discontinued support and development of IPFilter and has released it as an open source project on GitHub. Illumio provides its own supported version of IPFilter for use with the AIX VEN (version 17.1.2 and later).

Caution

Illumio supports only its provided version of IPFilter. You must install the Illumio-provided IPFilter package before installing the AIX VEN. The AIX VEN will not function correctly with IBM's IPFilter package.
Configuration Options for CA Bundle and CA DIR

Note

The options trusted_ca_bundle and trusted_ca_dir in runtime_env.yml are no longer used.

Core 22.2 introduced new options for configuring the CA bundle or CA directory it uses to verify the PCE TLS certificate. You can specify the new options in the /etc/default/illumio-agent file. The options are:

  • TRUSTED_CA_BUNDLE can point to a specific certificate bundle. For example:

    TRUSTED_CA_BUNDLE=/etc/ssl/certs/ca-bundle.crt

  • TRUSTED_CA_DIR can point to a directory containing certificates. For example:

    TRUSTED_CA_DIR=/etc/ssl/certs
Prerequisites

Ensure the following before proceeding with either installation or upgrade.

Required Directories

The following directories must exist on the AIX host:

  • /var/lib

  • /var/log

IPFilter Requirement

You must have Illumio IPFilter version 5.3.0.5002 or later installed before installing or upgrading the VEN. If you do not have it, see Install or Upgrade Illumio IPFilter before proceeding.

(Optional) Change the default username

Before installing the VEN, you may set an environment variable to change the username that owns the non-privileged portions of the installed software. Privileged portions are always owned by root, and the software can only be run as root.

Environment Variable

Description

VEN_NONPRIV_USER

An existing username to override the default username ilo-ven. The group name used is the primary group of the specified user.

Note

If you plan to change the default username, you must do so before installing the VEN.

Download VEN and IPFilter packages

This section applies to both fresh installations and upgrades.

  1. Go to the Illumio Support site (login required).

  2. Select Software > Download under the VEN section, then select your target VEN version. The Download VEN page appears, containing two tables: VEN and Other.

  3. In the VEN Packages row of the VEN table, click the filename to download the VEN tar file (BFF format).

  4. In the Other table, click the AIX IPFilter filename to download the Illumio-supported IPFilter package.

Note

The VEN package does not include the Illumio IPFilter package. You must download it separately.

Copy the packages to the server. Suggested locations:

  • VEN package: /tmp/VEN

  • IPFilter package: /tmp/ipfl

Choose an installation type

Depending on whether you are installing the VEN for the first time or upgrading an existing installation, follow the path that matches your situation.

Fresh AIX VEN installation

Follow these steps for a fresh VEN installation.

  1. Prepare the system.

    1. Copy the trusted root CA certificate to the following location:

      /var/ssl/certs/ca-bundle.crt

    2. Set permissions to make the file world-readable:

      chmod 644 /var/ssl/certs/ca-bundle.crt

  2. Download the VEN and IPFilter packages as described in Download VEN and IPFilter Packages.

  3. Install Illumio IPFilter 5.3.0.5002 or later (if not already installed).

    cd /tmp/ipfl
inutoc .
installp -acXYd . ipfl

    (Optional) If you anticipate a high number of network connections, configure higher limits in the IPFilter state table. The default state table limit is 65,536 entries; when reached, IPFilter drops packets. See Tuning the IPFilter State Table (AIX/Solaris).

  4. Install the VEN.

    1. Log in to the AIX host and become superuser.

    2. Run the following commands, where path_to_bff_file is the directory containing the AIX VEN BFF file:

      inutoc <path_to_bff_file>
      installp -acXYd <path_to_bff_file> illumio-ven

  5. Activate the VEN.

    Caution

    If you are using GRE or IPIP protocols, before activating the VEN, edit /etc/protocols to support those protocols. If the GRE and IPIP protocol lines are commented out, uncomment them.

    Use illumio-ven-ctl with the activate option to pair the VEN with the PCE. At minimum, you need the PCE hostname or IP address and an activation code (pairing key) generated from a pairing profile in the PCE web console.

    For information about obtaining an activation code, see Pairing Profiles and Scripts.

    /opt/illumio_ven/illumio-ven-ctl activate --management-server <pce_fqdn:port> --activation-code <code>

    Example:

    /opt/illumio_ven/illumio-ven-ctl activate --management-server pce.example.com:8443 --activation-code <code>
AIX VEN upgrade

Perform these procedures if you are upgrading an existing AIX VEN installation.

Install or upgrade the Illumio IPFilter

Important

If Illumio IPFilter 5.3.0.5002 or later is already installed, skip this procedure and proceed to Upgrade the AIX VEN.

This procedure describes two scenarios. Perform the scenario that matches your environment.

  • Scenario 1: Upgrade from the IBM IPFilter package to Illumio IPFilter 5.3.0.5002 or later.

  • Scenario 2: Upgrade from Illumio IPFilter 5.3.0.5001 to Illumio IPFilter 5.3.0.5002 or later.

Note

All steps below apply to both scenarios except step 4, which applies only to Scenario 1 (upgrading from IBM IPFilter).

  1. Download the IPFilter package as described in Download VEN and IPFilter Packages.

  2. Suspend the VEN if it is running:

    illumio-ven-ctl suspend

  3. Suspend the IBM ipf kernel extension:

    /lib/methods/cfg_ipf -u

    Note

    Repeat this command as many times as necessary until the ipf device instance is removed. If the command fails with Device Busy, reboot the system before continuing.

  4. [Scenario 1 only — upgrading from IBM IPFilter] Uninstall any IBM iFIX or ipfl packages, if present.

    Note

    Depending on your AIX version, you may have iFIX version IV89793s5a or IV89793s3a installed. If so, uninstall it. Neither version is needed. The following example command removes version IV89793s5a:

    emgr -r -L IV89793s5a.161102.epkg.Z

  5. Change to the directory containing the downloaded IPFilter package:

    cd /tmp/ipfl

  6. Upgrade IPFilter to Illumio version 5.3.0.5002 or later:

    inutoc . && installp -acXYd . ipfl

  7. (Optional) If you anticipate a high number of network connections, configure higher limits in the IPFilter state table. The default state table limit is 65,536 entries; when reached, IPFilter drops packets. See Tuning the IPFilter State Table (AIX/Solaris).

Upgrade the AIX VEN

Perform this procedure to upgrade the AIX VEN.

For supported upgrade paths, see Upgrade VEN on the Illumio Support portal (login required).

Caution

Illumio strongly recommends upgrading VENs only during scheduled maintenance windows.

Note

If the VEN was activated before the upgrade, it does not need to be activated again after the upgrade completes.

  1. Download the new VEN version and the IPFilter package as described in Download VEN and IPFilter Packages.

  2. Suspend the VEN.

    illumio-ven-ctl suspend

  3. Upgrade IPFilter (if necessary).

    Important

    If Illumio IPFilter 5.3.0.5002 or later is not already installed, upgrade IPFilter now by performing the steps in Install or Upgrade Illumio IPFilter. Return to this procedure when you are done. If Illumio IPFilter 5.3.0.5002 or later is already installed, skip this step.

  4. Upgrade the VEN.

    Run the following commands, where path_to_bff_file is the directory containing the new VEN BFF file:

    inutoc <path_to_bff_file>
    installp -acXYd <path_to_bff_file> illumio-ven

  5. Unsuspend the VEN.

    /opt/illumio_ven/illumio-ven-ctl unsuspend

  6. Verify the VEN status.

    /opt/illumio_ven/illumio-ven-ctl status -v